Banking apps are not “websites” by coincidence they happen to be apps using same technology to show the interface but there is huge difference between website and web app.
This distinction is important especially because people are notoriously confusing the two and expect web apps to be like websites and conversely implement websites with tech that is supposed to be used to build web applications bloating internet pipes with JS where HTML and CSS would be sufficient.
Don’t forget we don’t live in a pacifist utopia. Companies don’t work on the same ideas just because they think they can make it better.
Companies work on the same ideas because they want to own IP, data etc. and then charge money.
The other way around they work on the same ideas not to be charged by others and control their business.
“software industry” is not some big happy hippie family. Patent wars, browser wars, OS wars - well we get a lot of open source for free but that’s not the norm.
Everyone thinks that system is outdated. I don’t think we have any cybersecurity professionals claiming otherwise.
It is in use just because it already is there and to make something new will be tough.
I think we should drop the score entirely. Just give me details and I should be able to make my risk management based on if it is RCE is it local or just info disclosure etc.
Global scoring is something that feels right but in practice it is totally wrong. Biggest damage happens when management that doesn’t understand any of that wants to have excel sheets green.
Scores are still useful - individual context is always still on the enterprise to determine. But scores could be replaced with a list of capabilities the vuln modifies instead, for nuance. Thing is that there's a HUGE structure of scanning and reporting built on top of the CVE scores. It's load bearing for a lot of stuff.
It already is a thing since I believe April as I follow cybersec.
Last year May, June, July counts of sec bulbs was order of magnitude lower than this year.
But idea is that it will not last forever. New code will be vuln checked by AI as well. So now we are in transition period that is awful but it won’t last.
Funny how 5yo needs sanding down, 15yo you need power tools like grinder, 30yo needs explosives to take ego down like major life event, death of close one or their own close call.
Have the same idea. Compiled code with static type checking, existing SAST and formatting tools and there is quite sensible code hallucinated. You still have to check higher level requirements on your own … but LLMs with all that was mentioned are hard to beat on code quality. I usually had devs oposing those tools “because it makes their work harder” and “why can’t they just do stuff” - LLM is not like that ;) LLM doesn’t waste 2 weeks on new project arguing between agents weather it should be tabs or spaces for indentation.
It was „what–if that may never happen” before agentic AI.
Nowadays you can be pretty certain it will be exploited.
It is not just run faster than slowest guy to get away from the bear, now it is dozens of bears per runner and bears are stupid enough to chew on anything but also smart enough once they bite something tasty that works will just continue biting that.
I do expect there will be more closed knowledge forums. Unfortunately one person exposing it to LLM provider will be enough to break the whole idea. But I believe there will be many that will keep secrets for some in group.
This distinction is important especially because people are notoriously confusing the two and expect web apps to be like websites and conversely implement websites with tech that is supposed to be used to build web applications bloating internet pipes with JS where HTML and CSS would be sufficient.
reply