The idea's always appealed to me. From time to time we re-codify laws, we need to do the same for all human knowledge.

Set a baseline year - presumably whenever you start the project - and try to distill everything into a single encyclopedia of all human knowledge, a reference for getting someone from the stone age to the information age in as few steps as possible. We really don't need every paper ever published, and trying to keep it all means we're not in control of what is missing when something inevitably gets lost. It's a massive project, and would take a long time and inevitably be imperfect, but I think it's worth the attempt.

When you have the best encyclopedia you can churn out, you etch it into quartz tablets that can be human-read with a decent magnifying glass, and you put those tablets into a cave in some very geologically stable place. And then you take your digital copies and give them to whoever wants them.

I must be missing some point, but repository signing and developer 2FA access will not prevent a rogue actor to register an account and push malicious software.

Commercial software has three competing groups of profit-seekers: the vendor, the corporate user, and hackers.

• * Vendors of commercial software (that is not explicitly designed to be secure) is provided by vendors with just good enough security. Security could be a total facade but it appears to be secure and thus selected by businesses.
  • * Vendors of software explicitly designed to be secure will have a much better chance of resisting hackers as their reputation is a major factor in profiting. However, they are still profit-seekers so there are limits to their own security.
• * Hackers specialize in different pieces of software and the fewer vulnerabilities, the longer specialization requires. When a hacker (group) specializes in a pieces of commercial software and exploits a vulnerability then then response vendor response is a patch that is just good enough to prevent it from happening in the same way. Vulnerabilities in the similar vein may be discovered in the process and patched but there is no grand effort to seek out all vulnerabilities that span any meaningful length of time.
• * For the corporate user, If too many security breaches occur due to a particular piece of software then that piece of software is not selected for and thus a new piece of software replaces it's function. The new software may or may not have superior security but by switching anyone specifically targeting you must specialize in a new piece of software which is done in the hope of increasing the cost/time for you to be attacked by the same actor.
  • * If the commercial software is a dependency of other software then it can cause a locked-in effect where the (perceived) cost of moving to a new system exceeds to cost of further breaches. So even if commercial software is likely to be breached again, so long as the (perceived) cost of switching software exceeds that of another breach then the commercial software is determined to be just good enough and thus remains selected for.

The result is businesses will continue using a bad commercial software so long as it is perceived as just good enough. Before most commercial software was deeply tied to relying on remote servers, old versions of software remained just good enough, so long as no unsolvable problems were encountered. Remote servers are now used to function as an instant unsolvable problem and thus forcing a version upgrade which has added new added vulnerabilities.

Final note: Commercial software will ALWAYS fail when pitted against nation-state actors because the cost to a nation-state is largely irrelevant as the primary motive using the information gained from the breach. As such, the only way to resist nation-state actors is to use software and hardware that is designed expressly to be secure. That said, doing this merely shifts the focus/burden to the system/people that surrounds your software/hardware.

Legacy CHC employee here, and all I can say is that yes, it's bad.

Most of us have been down or idle for 10 days, unable to login or do any real work since a lot of our tools are also down or inaccessible (jira, clarity, servicenow, etc etc).

Keep a happy thought that this shit will get straightened out soon.

When will corporations, Governments, and courts realize that high security and strong encryption are critical to prevent these attacks from happening??? If I wasn't so old, I'd go back to school to specialize in cybersecurity consulting.

Given that these are the lowest form of life, and

Given that they are interfering with life giving drugs, and Given that innocent people could die.

When found, they should be terminated with extreme prejudice.

AI is dreaming up drugs that no one has ever seen. Now we’ve got to see if they work.

ChatGPT Gaining Foothold in Drug Development, Clinical Trials .

I didn't read the Bloomberg article because it's subscription-walled, but I did read the Gizmodo equivalent. It didn't say how long the teams were given, but I suspect it was a lot less time than scientists spent with AI when they started finding new drugs.

If AI can help scientists create new drugs, it seems very unlikely to me that it can't help them to create bioweapons as well. This story comes across as criticism-deflecting feel-good propaganda.