IMO this is a perspective from software engineering.

But this is an electrical problem. Interference is a huge issue with any engineering that involves physical things and these kinds of attacks are just interference problems. This issue is no different from a microwave knocking out your Wi-Fi. These attacks have become possible because the acceptable interference threshold that chip makers have been using has turned out to be too low.

How do you fix interference problems? First, you choose a new threshold of acceptable interference and then you engineer better isolation, you lower density, and/or you switch technology.

We could make shared computing complete safe tomorrow if we wanted to so I think calling this the end to shared computing is quite alarmist. The issue is that we collectively want to both have the cake and eat it too: we currently have a certain cost-to-compute ratio that we have become accustomed to and we don't want to compromise that. We're basically buying time until we can invent a new technology that can achieve the same density without the same level of interference.

In a world where insecure high density exists, secure low density is at odds with cloud computing: the cloud makes sense only if you can efficiently utilize you computing power round the clock and make it cheaper than shipping mostly idle terminals. If securing the cloud is expensive, then there's a cutoff point where it's better to ship highly dense, cheap terminals.

So maybe "screwed as a field" is not an exaggeration if the field is butt computing.

"Lower density" is a really hard sell at the moment...

Right, we may be entering an era in which secure network computing is impractical and the impact could be very far reaching.

I've been experimenting with isolating work activity from personal activity. It's amazing how difficult it is to prevent information from leaking between networks and applications. It's hard to find alternative solutions for entrenched convergence/convenience features like copy/paste, messaging and entertainment. Working remotely reveals too much about your personal and work relationships to corporations and VPNs only help to connect more dots. I can't curl up in a hammock with 3 laptops and a phone on a nice day, so I keep returning to a single device that does it all.

Sorry, entering? Just like climate change some of us have been warning that a lack of focus on and willingness to challenge the fundamentals of building software and systems would lead to non-securable computing in the general case. That warning has been sounding since the 1990s. Nobody cares. It took a meat plant and pipeline paying a ransom in cryptocurrency for everyone to notice that we are completely and irredeemably fucked as a computing species. We are already there, my guy, and it’s only a matter of time now.

Think about someone trying to do basic ETL. Like having a tabular file and summing it or something. Don’t use Excel, we say, stand up a $4 million Spark and AWS architecture with seven hundred pitfalls that can let bored Russians take over your whole network as if they were going to the dry cleaners because remember, you just might be Google someday. That’s where we are. It’s been a complete industry failure for a decade and it’s only getting worse. Accelerating, even: now you need some operationally-terrifying Kubernetes to even be at the table, and then as an industry we (rightly) say running this stuff ourselves is too hard, so pay Amazon to do it rather than even ponder if we have settled on the right approach.

Tada: Humanity just lost computing to three companies. We very likely aren’t getting it back.

There are probably 5,000 people doing this work who can adequately secure such a system and make it mostly impermeable. Where middle computing is royally screwed is that nearly all of them work in San Francisco or its clones abroad. So then you get “best practice” blog posts and industry think pieces and the lowest bidder ties them together into something resembling a competent computing system. That’s been the state of the art since 2004 everywhere except Santa Clara county.

With the exception of some areas in the IC and DoD, I just described the entirety of US government IT. That ETL example? It’s actually real and underpins a small part of Medicare across several government contracts. Because the tools the valley exports are all they’ve got, and we sure love building systems with massive footguns, and then shaming organizations publicly for missing item #543 on the tribal “secure your computing system” checklist and shooting themselves.

The entire industry must change, top to bottom, but just like climate change, again, that’s a nonstarter. Posix and the Web are not the path forward and I hope I live to see the industry figure that out. I’m increasingly skeptical. The good news is my hometown might flood into the sea first, sparing me from considering in my last moments that every argument I’ve ever made in this profession has fallen on deaf ears and that everyone has to derive our industry’s peril from first principles for themselves.

Right, on average industry has been failing forever. The difference now is it might not be practical for anyone to actually secure an internet server or web browser, full stop. I think that is a fundamentally different situation.

I think we have been in that situation since everybody started mimicking how Google does things

I like your writing style.