3 ms·
AI will shorten update windows dramatically. 2026 is the worst year to be thinking about dependency cooldowns, we need to think about dependency warmups instead
by miki123211 6mo ago
AI will shorten update windows dramatically. 2026 is the worst year to be thinking about dependency cooldowns, we need to think about dependency warmups instead.
Soon, there will be no such thing as a safe way to disclose a vulnerability in an open source project. Centralized SaaS will have a major security advantage here.
- woah 6mo agoYou could have a web of trust where Linux-using organizations each spend $x continuously scanning and patching their own dependencies with AI, and sending each other patches and scans.
- dakolli 6mo agoLLMs aren't capable of doing this, and never will be no matter what Anthropic tries tell you.
- fragmede 6mo agoMozilla seems to think it can. https://blog.mozilla.org/en/privacy-security/ai-security-zero-day-vulnerabilities/ https://blog.mozilla.org/en/privacy-security/ai-security-zer...
- a_vanderbilt 6mo agoThat's the same mindset some people had 3 years ago when they said AI wouldn't be capable of software development. Look where we are now.
- dakolli 6mo agoI have unlimited access to every single frontier model, I've tested all of them, they are not good at writing software. They are basically slot machines, sometimes you win a little bit and sometimes you win a lot but usually you just burn a ton of time and money sitting and staring at a screen (and frying your brain).
- lll-o-lll 6mo agoClosed source centralized SaaS will have a major security advantage. Edit: Because an RCE in a open-source dependency means you are just as vulnerable when the security patch lands? I don’t see the controversy.