Post #4167714

2026-07-28 06:52 UTC

@mttaggart@infosec.exchange …but we still don’t get to know if just giving those researchers a similarly-sized pile of money and then hiring like 3x as many people instead of burning tokens might not have been about as effective. the first vulnpocalypse I recall was Project Zero, which was scary at the time, and this is all orders of magnitude more money than that.

Replies (1)

@mttaggart@infosec.exchange 2026-07-28 13:09

@glyph@mastodon.social If I'm following, the counterfactual we're exploring is: if all of these companies could have inflated their FTE pool with software testing experts, would we have the same outcome? Maybe? To be honest, I really don't think enough software testing experts exist to even do that. This is one of the most rarefied skills in the entire industry. And exploit development even moreso. Or, maybe they do all exist, but they're all working in basements in CIS states developing 0-days to sell. Or they were. I guess I'm trying to say I think there were real structural barriers to this being a feasible approach at scale. That said, the capacity of these models to perform these specific tasks does not absolve the industry of its many sins. But now a duty of care question faces dev shops of all sizes: do we use these models to find vulns and attempt patches first, or do we abstain and let unscrupulous actors find them for us?

Open ##4167713