pacificpendant
I tend to agree with the article’s statement about the value of the test code though, may even have been true before LLM code took over.
We have had fuel price protests too, sometimes involving blockades by hauliers. https://en.wikipedia.org/wiki/Fuel_protests_in_the_United_Ki...
I am old enough to remember old programmers complaining about the wave of new shareware/freeware apps that people made with Visual Basic when that came out. Many of the apps were visually awful because it opened up desktop app development to people with no aesthetic experience.
I don’t see that awful style any more despite those tools for rapid UI creation still existing, did those people get better or did they get bored and move on to other things?
I guess the same will happen with vibe-coders, they’ll get the experience to make better software or their poor quality apps won’t give them what they want and they’ll move on.
There are a few examples of the types of apps people are making in the comments on this page and it sounds like a lot of the time it’s custom apps for a personal itch that might appeal to very few other people.
Similar to how I have Python scripts on my computer that I won’t publish. They’re not production quality, but I know how to deal with their quirks. I suspect a lot of the apps mentioned in the comments are similar and maybe that’s fine.
I imagine some of the rise is people using AI to clone existing apps too.
It’s something I’m interested improving on as well as predictions in general. I saw you suggested Thinking Fast and Slow and I’ve skimmed through some of Superforecasters. Metaculus have a bunch of resources too.
Depending on who you ask an SBOM might not need a hash. NTIA only recommend a hash.
Related to your point though is that just because a dependency is vulnerable doesn’t mean the software using it is affected too. It might not use the functionality that’s vulnerable. Which means a supplier needs to share their assessment of each dependency vulnerability.
There are sometimes links to external data in OSM using Wikidata for example.
If a tool wants to remain relevant it should try to minimise false positives, in some cases this might mean removing rules that are going to throw false positives significantly more often than true positives. Tools should also be run such that anyone that receive alerts should be able to flag false positives with minimal effort.
The response to this false positive could be to fix Prometheus, but if you end up having to fix lots of things it's more of a sign of a bad rule that is making you concentrate on things with a low value to the goal of improving security.
Semgrep has a nginx ruleset too https://semgrep.dev/p/nginx
EDIT: "Mr [Peter] Dennis also said he thought the boys would have been lightly sedated by a doctor who joined them in the chamber, to prevent them from panicking during the journey out." From the BBC live reporting webpage.
In cold war era America would people have felt any different knowing that a Russian invasion was only 20% likely rather than 30%? For something so /serious/ any non-zero probability is something that should be prepared for.