alt Hacker NewsDoesn’t this imply a software design issue where it is just written in a way to have these security bugs and patching them 1 by 1 is not what should be done but the whole design should change which can eliminate full classes of security bugs without any particular patches being necessary?
Replies
This is what the Rust advocates have been trying to say for a decade now. But C enthusiasts would always chime in that those bugs were just caused by careless devs and a real C programmer is fine.
The only thing I know is that if I wanted to learn how to program, I have thousands of tutorials on the Internet and Youtube teaching everything from if/else to data structures and big O.
But if I wanted to learn software design and architecture, I'd probably not even know where to start.
[dead]
Yes, and we didn't need AI to figure this out. Linux has been averaging ~500 security-relevant bugs per release since at least early 2024, before LLMs got any good at security research: https://social.kernel.org/notice/B9nU6wnmFvh5atXSG8. Now AI has pushed it to ~2000 per release, which is considerably higher, but at this point, does it make a difference?
There are plenty of design decisions that could fundamentally change things. But they're not being taken. What you're seeing is the revealed preference of this system: Security is important, but not enough to make people incur the cost of adopting major changes in pursuing it.