News for hackers. Stuff that matters.
Re:AI is forcing us to pay off 40 years of technical debt by octoberfranklin on Wednesday November 04, 2026 @07:27AM (#50364646)
This is the real reason for the vulnpocalypse, not "technical debt".

NSA spent 20 years stockpiling vulns and pushing the industry towards half-assed solutions like address sanitization and pointer tagging when they could have put the industry on memory-safe languages instead.

They managed to get the IME/PSP/TrustZone into 99% of the CPUs out there by mandating it for government purchases; they could have done the same thing with memory-safe languages. But instead they chose to stockpile vulns. Hope they burn in hell for this.

Re:AI is forcing us to pay off 40 years of technical debt by FartyMcFarter on Wednesday November 04, 2026 @07:32AM (#50364698)
Why do you think the NSA could have put the industry on memory-safe languages?

Even if they wanted to, I highly doubt they could push the industry to do that. The industry does what it wants to do, and rewriting tons of software was far from its priorities.

There's also the fact that rewriting software tends to introduce a lot of new bugs.

Re:AI is forcing us to pay off 40 years of technical debt by lambdaone on Wednesday November 04, 2026 @07:42AM (#50364772)
The U.S. government could have required all new software for any government-procured system to be written memory-safe languages, thus making it ubiquitous. This could have been phased in slowly with a few years of on-ramp time to allow for industry to acquire the relevant skills.
Re:AI is forcing us to pay off 40 years of technical debt by terminalcommand on Wednesday November 04, 2026 @07:46AM (#50364807)
But even in memory-safe languages, compiler bugs are still an issue. The theory is perfect but the implementation is flawed. In such case once the compiler bugs are found, the software would have to be rewritten to compile. For example an 11 year old memory bug was discovered recently in the rust compiler: https://www.penligent.ai/hackinglabs/rust-borrow-checker-bug....

Memory safe languages are not a silver bullet either.

Re:AI is forcing us to pay off 40 years of technical debt by GTP on Wednesday November 04, 2026 @07:59AM (#50364938)
Definitely not a silver bullet (consider also that memory management isn'the only source for vulns), but still much better than C/C++.
Re:AI is forcing us to pay off 40 years of technical debt by dns_snek on Wednesday November 04, 2026 @01:44PM (#50369800)
[delayed]
Re:AI is forcing us to pay off 40 years of technical debt by terminalcommand on Wednesday November 04, 2026 @03:07PM (#50370796)
No, you are wrong. Rust compiler bug uncovered this month was aboıt memory safety: https://www.penligent.ai/hackinglabs/rust-borrow-checker-bug....

Basically, the borrow checker allowed writing memory unsafe programs without using the keyword unsafe.

Compilers for C, C++ etc. are well established but Rust is a relatively new language. There are many bugs to come just like this.

Using a memory safe language is not a silver bullet for writing memory safe code. The implementation of the memory safe language introduces bugs as well.

Re:AI is forcing us to pay off 40 years of technical debt by dns_snek on Wednesday November 04, 2026 @05:42PM (#50372509)
[delayed]
Re:AI is forcing us to pay off 40 years of technical debt by bluGill on Wednesday November 04, 2026 @07:50AM (#50364842)
The U.S. government had pushed Ada for years and it never worked out. The government was forced to accept C++ because industry was rebelling against ADA, even though ADA was memory safe. Well, Ada did have the ability to be memory unsafe. It was much better by default.
Re:AI is forcing us to pay off 40 years of technical debt by jazzypants on Thursday November 05, 2026 @09:52AM (#50379814)
I mean, the government could have just stopped working with those rebellious, incompetent contractors, but I guess the pork barrel was just too enticing.
Re:AI is forcing us to pay off 40 years of technical debt by elcritch on Wednesday November 04, 2026 @07:53AM (#50364870)
The DoD tried that with Ada and largely failed. That was with defense contractors whose primary customer mandated it. That was despite Ada being proven to work in its first projects.
Re:AI is forcing us to pay off 40 years of technical debt by elzbardico on Wednesday November 04, 2026 @08:14AM (#50365103)
The DoD have even created their own language: ADA. Massive contracts power, but different markets to incentivize.

The distance between the usual consumer/b2b tech startup and the kind of company that sells software to the air force is even bigger than the distance between Google and the kind of company who hires Accenture.

Re:AI is forcing us to pay off 40 years of technical debt by octoberfranklin on Thursday November 05, 2026 @09:33AM (#50379568)
Why do you think the NSA could have put the industry on memory-safe languages?

Did you even read my comment? I very explicitly answered this.

Government purchasing requirements have an immense effect on industry. IME/PSP/TrustZone have 99% CPU coverage because NSA put "owner-inaccessible oversight processor with disjoint physical address space" into federal sourcing requirements.

They could easily have done the same with "memory-safe language". Note this is not the same as "must use Ada" which is obviously dumb. The IME/PSP/TrustZone req worked so well because they specified the feature not the implementation (and indeed it has been implemented three different ways).

But instead, NSA actively pushed in the opposite direction and funded all sorts of kludges to try to keep memory-unsafe languages kicking as long as possible.

They have actively sabotaged the national security of their own country.

Re:AI is forcing us to pay off 40 years of technical debt by aa-jv on Wednesday November 04, 2026 @07:49AM (#50364839)
>IME/PSP/TrustZone into 99% of the CPUs

Yeah, about that. Its the biggest vulnerability in the industry. Nobody wants to confront this fact, though.

Too much profit to be made in in oppression/human rights abuses.

Re:AI is forcing us to pay off 40 years of technical debt by leonidasrup on Wednesday November 04, 2026 @08:48AM (#50365476)
Sometime the profit made by the companies for inserting backdoors can be quantified:

" In 2013, The New York Times reported that documents in their possession but never released to the public "appear to confirm" that the backdoor was real, and had been deliberately inserted by the NSA as part of its Bullrun decryption program. In December 2013, a Reuters news article alleged that in 2004, before NIST standardized Dual_EC_DRBG, NSA paid RSA Security $10 million in a secret deal to use Dual_EC_DRBG as the default in the RSA BSAFE cryptography library, which resulted in RSA Security becoming the most important distributor of the insecure algorithm. "

https://en.wikipedia.org/wiki/Dual_EC_DRBG

Re:AI is forcing us to pay off 40 years of technical debt by aa-jv on Wednesday November 04, 2026 @10:36AM (#50367097)
Yeah.

People seem to be fine with it as long as their own team seems to be profiting from it - but for those of us who are not subject citizens of the NSA's government, it is a truly heinous state of affairs.