Your replacement costs are off. Fiber basically lasts forever (Wikipedia says 60-100 years), you typically replace it if you need a different fiber type. That will probably not happen with modern fiber. What you need to replace regularly (every 5 years or so) is the optical components and the switches, but that is a lot cheaper than laying fiber because everything is readily accessible.

Note: If you cannot do it at that price, but several of your competitors can, there is a problem on _your_ side.

Indeed. Most people are not educated enough to get that comparison though.

There is no absolute protection against user stupidity. Incidentally, banks here will refuse that login. They require machines to be registered for online banking. And they have time-outs.

Bind has gotten better, but 10 years ago and longer it was utter crap with regards to security.

What the AI does is not impressive. Finding use-after-free requires you to be competent and wanting to find them. Approaches for finding and avoiding them are well established, the current slop-coders (with or without AI) just do not know or use them. AI is not needed in any way. AI is just the ElCheapo approach when you do not care about finding all of them (due to LLM unreliability).

By the user against the AI agent? Yes. But online-banking needs authorization by the bank and that involves more than just the act of logging in. It includes tools used, geolocation of login, etc. and does even include what the user does and recent usage history and even things like cards issues, credit rating, etc.

The bank is _not_ talking about the login itself.

So he does not understand what the banks are talking about? Also a possibility.

Humans destroying their living conditions on a global scale due to greed, stupidity and lack of caring. How much of the current high-tech civilization will survive? Anything between "almost all" and "nothing" seems to be possible. Will humanity itself survive? Probably. But will it ever be able to go beyond primitive tribes again? Unclear.

Now, being in the midst of it is far less appealing.

I would be wary of that statement. It says "nowhere as easy as log4shell". Log4shell was so easy to attack that it is hard to imagine making it any easier. And second, while the author claims the published exploits do not work against "vanilla PHP", that is a really weak statement and there is no analysis given why they do not work and what is needed in addition.

At this time, any kind of use after free vulnerability in production code musst be regarded as a sign of gross incompetence. This one seems to have been harder to find or nobody was looking. But still.

Ways to find/avoid: Zeroing pointers on free, "gcc -f analyzer", tests with valgrind (test data needs to trigger at leat a read to free'ed memory), code review, some other tools and less less general ways. The first two are cheap and should be standard. Code review for this problem should be at well.

Zeroing memory on freeing it may or may not do anything. Generally, unless you had secrets in that memory, it will probably not help or only cover part of the possible scenarios. It is also computationally expensive. Hence you should think about it, but doing it generally is probably not the best idea.

Yes, probably. I call these "personality prosthetics" because apparently people doing these things are severely lacking in that.

Did they not stop doing QA a while ago? Their bumbling about incompetently certainly seems to suggest so.

That is not how that works. Does somebody explain to you how banking regulation works? Well, obviously, because you are clearly completely clueless while shooting your mouth off. All too common these days.

So, banks are highly regulated. And one thing they are responsible for is protecting their users from technological and attacker-caused risks. The degree varies, but they have that responsibility basically everywhere. There is a reason that private bank customers do not get API access, for example and it is not cost. On the cost-side, banks would like if somebody else were to develop all their client-side banking software and they had no part in any of it. But here is the thing: If a bank opens up an interface to a private customer that the private customer cannot reasonably be expected to understand and that is risky to use, then the bank may well become liable for the damage done and may face additional penalties.

What else is new.