Predictions: - If it's even mentioned (hopefully, given log4j topics), nobody will concretely commit to anything that would look like "funding those open sourc

Predictions: - If it's even mentioned (hopefully, given log4j topics), nobody will concretely commit to anything that would look like "funding those open source projects we all use internally, rely on, and just assume will be fine." Or putting serious resources to fuzzing, analyzing, and generally beating the hell out of packages like that, committing any fixes back upstream. - Nobody will be willing to consider that the reason we're in this spot is because we've spent all our effort on complexity and new features instead of actually locking down and making bulletproof a smaller set of features. To borrow from Apple's recent issues as discussed in Project Zero's writings [0], I'm sure your support for an obscure Xerox compression algorithm was used never, or nearly so, in practice (in text messages!). However, your inclusion of it allowed a nice entry point for some absolutely nasty software. Perhaps, instead of supporting every format under the sun you can find, you can support the common ones only, and lock those down. No, instead, we can convert our facial expressions into animated animals and send them to people (I'm not sure I want to know how many weird corner cases that code has). - Nothing will change, ransomware will continue, reporters trying to shine light on questionable countries will continue having their phones/laptops/watches/etc hacked to hell and back, and we'll continue stumbling forward in the complexity canyon that swallows everything that gets near it. We could make major security improvements if we were willing to say, "Let's focus on the 20% of the features that make up 80% of the use, and turn the rest off by default." Simplify the software drastically, which then means we can simplify the hardware because performance isn't as critical. But the tech industry's internal structures are absolutely opposed to this - you're promoted for shipping new features, not maintaining things, and not doing weird low level security analysis and fuzzing. I'm pretty damned pessimistic about the state of computer security, if it's not obvious. [0]: https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i...