fathermarz

It makes sense, I have a skewed perspective because I have only been in security software.

Thanks for that anecdote

I think maybe my lens is slightly skewed because I have only worked in security software? This is shocking to me.

Holy smokes, is security just not a priority at all anymore? Like in what world do we live in, that this is acceptable. And at the volume this has been happening, bad guys are having a FIELD DAY.

This is getting crazy and is another feather in the cap of unhinged American investing and business culture right now.

My first question, what does a BI company need $100M for?

Why does it seem that Figma’s logo is on every company’s trust badge list. Do they spend millions on SaaS subscriptions? Or are they getting bamboozled into getting their name hijacked for trust?

Is this just me or do other people feel this is getting out of hand?

Emergencies = No Internet

What about no power? You gonna run your generator for your local model? What are we doing here? Have we lost our way completely?

Security has always been cat and mouse, we are now just experiencing a high volume of cats and mice running wild.

I would disagree that this is not “formal verification” as that discounts the entire software supply chain and how attacks actually show up.

Is this end to end verification? Cause this sounds closer to validation than verification.

I would definitely use this for https://littledaily.me

I think it would be a nice addition once you get a larger spread of data! Great idea

If you have followed their latest OS releases you would see an uptick trend on stability and consistency, instead of new.

This is one of the first things I saw back in March that began that trend in my eyes. https://9to5mac.com/2026/03/24/apple-details-safari-26-4-wit...

This specific situation was an EMR multi step implementation that included multiple hands from billing, sales, tech support, PMO, and someone named Trudy who “usually knows where things are in stuff like this”.

I’m surprised at the reasoning behind using the most expensive model which likely led to the “doing too much”. I think it would have been nice to have A/B tested different hospital setups in order to maximize not only efficiency but to see where the strength of each model started to emerge in a given role.

Fable feels like overkill for this also.

I have lost faith in signature AV and CVE feeds for that matter. Attackers test against scanners until they come back clean and avoid known fingerprints. The only way I see to catch things now is behaviour diffing through static analysis.

Disclosure: I build Vigilance, which does this.

This is the least vibe-coded looking thing I have seen in weeks on HN. Not sure if you looked at the repo or if you’re just fatigued from all the slop. Commits look simple and the README is short and purposeful.

In my experience, it depends on the community. Where I live most people are retired so there is tons of interest and a really well ran community program called Elder College. I would look into similar programs near you!

This is very accurate. I teach seniors about how to use AI responsibly and they are always mind blown, and I keep it very high level. The amount of Chat”GTP” users there are out there that have no idea who the main vendors are. Most of them also think that Google is just a “search” company.

This is amazingly awesome. Very intriguing and what a great idea in the first place. One of the most important pieces of modern software IMO.

I’ve worked in software supply-chain security for six years doing binary analysis on firmware, industrial controls systems, and commodity IT closed/open source software. What I learned is that in hopes to secure the software supply chain we have ran a very similar playbook and mostly over engineered the problem, with SBOMs and VEX documents and expected the industry to comply. But what was discovered was that every SBOM looks different depending on who produced it and at what step in the chain, and it didn’t make anything more secure because it was nothing but an ingredients list and in some cases a CVE dump attached. This is not helpful for anyone who actually triages software.

I built Vigilance to be a simple alternative to the problem to watch for one thing in any part of the supply chain. What files changed in ability and what that ability is. It compares one version of a file to another and says what inside it gained a new ability. This takes what used to be a diff of files from a few thousand in worst case to a list of under 4 with clear stated intentions and at any point within the supply chain. I built it to reduce noise and make the boots on the ground job of triaging simpler and easier.

It’s a single Go binary, no dependencies, no AI, no CVE database. It can run on edge devices to end user computers, build servers to dev machines and air gapped environments. The free version sends basic telemetry reports up for that state file hash and any powers, no file paths, no names, no user information. This is going to be used for research and improving the product. The paid version is licensed completely offline so no telemetry is sent to us but it operates the exact same way to the user on an unlimited number of machines.

Early adopters get two years free if they supply a logo and/or testimonial for the product.

You can try it on most npm packages in the sandbox at https://vigihq.com/sandbox. The sandbox has a daily cap and I am happy to answer any questions.

I think that now we are starting to see the hype go bye-bye and the real use cases are starting to emerge. However, the systems that come out must be constructed with care aligned with our world has been constructed (reality) and not how the AI Labs believe it should be (theory).

I believe the comment was to say you can not create a join for data that does not exist. Access to financial records is trivial, but there is likely no such comparable record that one can query on for water/industrial. Maybe metrics like water quality for some of them, but not the other security data exists other than shodan/censys (weak and out of context) which could take months per site to collect.

AFAIK the most robust data they have on industrial sectors is within the national labs, and even then its considered sparse.

> Top down regulation drives the systematic change, just like it did with the banking sector.

Banking is resourced well enough to absorb that regulation and stand up a compliance team. I bring up ATC because of the consequence. Default passwords are a symptom, not the failure mode.

ATC is already federal, with the FAA running that. 20 years of regulation has not fixed the problems that still plague that industry: outdated equipment, short-staffed, a small niche talent and training pipeline, and people dying as a consequence of those systemic problems. That's even closer to my point. Making something regulated doesn't change the inherent problems inside the industry.

Yes there are pieces of what you are saying that make sense theoretically. But what I mean by a silver bullet, is it is a systemic change that needs to happen in a bigger swing than just “regulate”.

It is a top down initiative that needs to happen in a more meaningful way. It’s adjacent in a similar way to the issue of air traffic controllers. Talent shortage, old equipment, old hats, burn out and the like.

It needs some real backing and effort to make it happen.

Ouch. You just caused a major outage for <insert critical system>. Either you costed your company millions of dollars or you killed someone.

OT does not equal IT

National Security has always been a federal government responsibility yes. But what does that fundamentally mean for boots on the ground?

NSA doesn’t do IT for the DoD/W, DHS doesn’t do IT for the government, CISA only gives guidance where they can. And IT does not equal OT. The issue comes down to actual skilled people hours to do the work and resource constraints to do so.

I agree that in theory this would not be a stretch if the stars aligned, but these are for the most part, not federal government funded entities nor government controlled even at a state level. They are usually clooged together by 100 years of paper maché. And that’s just water. What about Energy? Data Centers? Pharma? Regulation is way too far behind to just instantly drop a silver bullet.

And 100% agree that we are witnessing repercussions of leadership that did not have much forethought but that ain’t new and goes back quite a ways especially in CI.