WAT?

It takes more than couple days to test and push software patches. You do want things tested right, you'd hate get a TZ file where someone fat fingered something and systems set to a given zone all default to GMT or something right because they can't parse the row needed?

Also it isn't just computers timezone change impact. Contracts may involve hourly payments etc, and people might need to negotiate changes; not many people maybe but not nobody.

Honestly I don't see any universe where responsible governance would change time standards with less than years notice. Not that it does not happen but there is no reason that is should. What possibly makes it so urgent to change right now if you want to stop doing DST -> STD vs pass the law now have it take effect before the next would be time change after this one?

yeah I have done a bit of that on my little personal projects, that I have "vibe coded".

It is fun because you get to look at code, like it is the 90s again, and everything there is relevant and important. As much as people fear AI is going to generate a lot of incomprehensible mud-ball programs, it is actually pretty good and generating concise things, that are easy to read.

HOWEVER...

Those personal projects don't resemble the requirements of contemporary software. Even internal enterprise software these days often needs support for stuff like internationalization, accessibility support, adaptive UI that is useful and efficent for the comptroller with the 43" monitor and for the CEO who insists he only needs a 6" mobile phone for all the things.

The libraries are big because they do all that stuff, and if skip them you don't get that stuff. 80% of the time you don't need that stuff. That said, for your little S-corp, or even smaller LLC you might not need that stuff right now but very suddenly you might find that you do. When you do you'll be rewriting or at least rebasing a lot of code back onto those big library stacks; where as if you'd used them in the fist place it would probably be just add some start up parameters to flip on 'high contrast mode' in the display tool kit for the color blind person you just hired. Alternative you could try to just add the functionality you now need, but of course then you are just putting the complexity right back and getting to run a new untested system, with lot of fun corner cases and gotchas for you to discover all by yourself because you did not know enough about the subject to tell the AI Agent what it all it really needed to do.

It is fashionable to hate on all the complexity, but to often people forget about the simplicity it affords. You can today get an incredible amount of functionality out of handful of lines of "application" code. If I use a browser as my UI, a single gives me an edit control where a user can write click and get spelling suggestions, the get ranged selection support, I can style it with a few more lines of re-usable css, screen readers know what to do with it, and more; try that with your win32 CreateWindowEx() edit control....

Complexity means bugs, because bugs are ultimately a function of interactions that were not considered fully, the more stuff interacting either the more buggy it will be or the more effort will be need to control for it. The complexity though exists because people demanded it, society decided software had to be usable even if you don't speak English, and we decided things like it should portable even if you change computer architecture, and .... achieving all that without the library ecosystem really would be impractical.

LOL it was the last crash that created the "you're the product" tech industry. Everyone woke in 2000 and realized nobody had a real business plan, and started sell; tech's answer was monitize the users.

Holly crap dude you think with regulating big tech is going to give you more freedom. I have 20% share in the Brooklyn Bride if you are interested, I am willing to sell for pennies on the dollar!

Seriously all regulating AI will do is make it harder or impossible for open source and open models. Regulation is what Anthropic and OpenAI want, they are littleral asking for it. Why? Because they only have a realistic revenue stream and by extension business if either; the history of computers getting faster and cheaper suddenly stops.. or they can someone legally keep people from publishing stuff and others from selling hardware. That is 100% what that is all about no matter what they say, and Democrats will play right into it. We all better hope they don't get both Houses.

Not like IPv6 solves anything with lots of ISP blocking inbound IPv6 connections.

Right that is the real problem isn't. Google has not yet worked exactly how to stuff enough ad impressions to make money without destroying the utility the user is getting out of the experience to the point they are likely to abandon Google for a traditional search engine or go pay for Chat-GPT or something.

Really 'ad words' in AI summaries ought to be "easy" from an implementation standpoint. The 'problem' is doing its going to use even more tokens that need to be paid for.

I agree

The winners here are going to be people with actual hardware IP (Nvidia, Apple, others), people with actual hardware fabs, and likely Google and Meta. I predict despite the current crazy valuations the Magnificent-7 eventually end up acquiring the leading AI labs.

The real costs are in building models, not hosting them comparatively speaking and that picture only improves as the energy infrastructure and hardware markets gradually align to the volume demands. The labs are already just reselling the hyperscallers computer, there is no reason those guys are not going to take 'good enough' models and beat them on price.

Having the 'best' models is an asset someone with existing SaaS, Marketing, etc business on the hand can leverage and by extension justify the expense. That is why I see OpenAI and Anthropic eventually becoming acquisition targets once the gold-rush investors capitulate on their valuations.

The option is for them to get directly into the datacenter biz (not contracting for them and agreeing consumption commitments but actually building them and owning the dirt all they way up to the roof top chillers. Anthropic seems to be trying to make that play but I still don't know where the revenue will really come from...

Not that anyone in the TOS cast really deserves much criticism as far as how they manage(d) their celebrity, but Koenig always came off as a class act. In every interview he always seems grateful to just have had the privilege of being part of something big. Really seem to care about the fans and wanted to be entertaining for them at conventions and the like, was willing to participate in some of the fandom projects. Just a good guy.

Nice little supply chain attack.

Hijack of shipment of servers equipped with presently very very expense silicon that nobody will consider just disposing, insert your implants, let some patsys get busted and the kit get returned to the owners.

Bonus points make it seem like a general / widely implemented scheme by hijacking some large liquor shipments and various other goods as well. Pass out the spoils at the field office party or fence them to finance some other activities that need kept well away from oversight.

These are also many of the most looked at, most often fuzzed, SAST scanned, valgrind'd things in the world.

I really don't think it will be as bad as all that. We have not seen Apache, Nginx, etc pwnd like this, or OpenSSH, or Bind, or postfix ...

I could go on. I think the actual posture and condition of most of these project is far better than you apparently expect. (I guess we are going to see who is right).

What AI is finding is stuff the other scanners miss, which is stuff where there is a clear temporal component. We are going to see races, toc-tou, probably more stuff like these PHP issues which if I understand correctly is a use-after-free or something you could at least force into that taxonomy.

So there are going to be new bugs found, even seriously impactful appearing ones, but the reach-ability and chances of successful exploitation outside laboratory conditions is going be low... Do they work when it is a VM on you lab server you can hammer away at with 1000 threads yes; when there is a AWS ELB in-front or a waf that has any impact on request ordering or pipe-lining, good luck..

I am not saying people won't be spending more hours patching over the next year or so than they have been, they will but the sky probably also isn't falling

People say that but I think they say it without a lot of real understand of what the web was like when it was born, and second that PHP5(+) does not look much like PHP 4(-)

Before PHP there were CGI scripts/programs, which were Perl, sh, or C or if you were on Windows classic-asp. If you wanted maintainability your wrote in Perl (yeah I am being serious) and if you wanted performance or needed to do something complicated you wrote it in C. Remember we are talking 1995-97 here there isn't even a C++ standard yet! These were you main choices for 'web development'.

PHP let people do what demanded C in something that did not have to be compiled and did require understanding C style memory management. Here comes the big BUT though, all the really good, really useful library code out there was C. All those library authors did not talk to each other so everyone was different in terms of conventions, who allocates the the caller or the called, who frees, are we passing references or values for primitives, etc. All different and php did not attempt to hide any of that as it pulled in those libraries it wrapped them in its runtime and memory management without attempting make their use orthogonal and part of some consistent ecosystem.

It wasn't a 'hack' it just was not a complete abstraction.

That was 'fine' for people who came to PHP from writing C, and were using PHP because it let them make changes on the fly, saved writing a lot of boiler plate request life-cycle management stuff, etc. It all made sense, if you can at it not from C though it was confusing mine-filed of gotchas. It made web development possible for a whole lot of people who never got access to compiler. That was cool, but it also put a lot of power in the hands of people the way the Visual Basic "Declare" keyword did, and unsurprising they did hack-y things with it, cause themselves all sorts of problems..

This is true in a lot of case.

The other case is where the fund managers and 'market makers' are not tied to the individual companies, they also don't care about long term performance. They only care about the ROI, on their position.

If a 'savvy' analyst determines the latest round of layoffs will mean a huge jump in earnings per-share for the current product cycle, and knows that is usually 2 years or so long. They just put a tickler in to sell 18 months out; before retail an state pension funds work out ACME has nothing in the pipe line and will soon be going to market with quick application of lipstick on their current products up against likely superior offerings from competitors, and it will end in tears. Or that the current round of enshitification is going burn thru the remaining customer loyalty they have enjoyed jeprodizing their future market position or whatever the case may be.

They simply don't care because they can make a profitable trade today. They are 'owners' and 'investors' but they don't have a traditional sense of ownership and concern. I come back to the problem not being 'capitalism' or even hard nosed capitalism ie 'you don't work you don't eat', 'you don't produce value nobody will buy' but rather on of to great a number of abstractions and with them to many perverse incentives.

I have said it before i really do think the 401k system has broken not just markets but our society. Your point "so essentially the retirement accounts are yes votes and not ownership oversight" is DEAD ON!

Not to defend China - its amoral indefensible blight on the planet - but the average Chinese citizen being one 1/3 as productive is not the only way the math works out. It certainly can be the case that we are not measuring productivity accurately and/or are using the wrong metrics as a proxy.

For on thing productivity is a measure of progress toward a goal, does China have the same goals we do? I am not sure "Biggest GDP" is really what Xi is after.

I think looking at Europe is good example. They are mostly capitalist but the best parts of it also using the petrol chemical cheat code. Germany is struggling, they have trouble even trying to allocate and spend their own stimulus packages. The rest of the EU make the US debt spiral situation look solvable ;-) by comparison and the bond market does not share that view.

I think you could say that hard-nosed brand of capitalism is what has carried us this far and why we don't look like France right now. I mean seriously compare the BLM unrest, or Jan 6 (if you like) in the US to what is happening in France right now. There is no comparison, in terms of how destructive and destabilizing it is/was. Take away all the various politicking and window dressing about what is going in France right now and it boils down to - a large segment public accustomed to increasing socialism is upset the government won't give them nicer stuff, and government that is by no-means opposed to affording people lots for entitlements pushing back on doing so because those in office recognize it isnt sustainability affordable.

The problem isn't capitalism and it isn't how 'hard-nosed' that capitalism might be it is an ownership and direction problem. Capitalism as described by someone like Adam Smith assumes self interest but it assumed the owner of the capital would be in control of it. That is if you are the owner of a company you want it to continue to grow for at-least-your-life-time but probably that of your children and grand children. Today the CEO is employee and the owners are largely inactive shareholders (they don't vote on much, read board meeting records etc) they are not interested in how the company will perform 20 years from now they are ONLY interested at most in how it will perform between now and maybe the next dividend date. The CEO is only interested in the current quarter and perhaps next, he does not plan to be there longer than 18mons in anycase and is perfectly happy to move on if the quarterly bonus are not fat.

Ross Perot tried to explain this to the public when he said 'Giant Sucking Sound'. Anyone with a brain could see 'trade modernization' was going to create massive windfalls for ownership short term as the divested expensive American workers, real-estate, and regulatory environments and bought cheap labor in Mexico and further afield; but anyone with a brain could see what that was going to mean 30 years on.. Well here we are. An America that can't make things, and I don't think has bright economic future at all, unless we make some PAINFUL choices today to course correct. Because guess what AI datacenters dont care where they are at and models/IP will always be stolen by whoever wants it enough. In the end you have to make things - physical things - people want.

yes but people instinctively understand mechanical devices wear out. There is/was no natural reason to assume that about software. For the first decades of computing most of the public encountered that wasn't the case, quite the opposite in fact in 1995, the COBOL program you wrote in 1965 still worked fine. The DOS program you bought in 1985 still ran on Windows 95 just fine (well it was as likely to work as it ever was on any given DOS machine ;-) maybe more).

Software right seem to people like book, and their experience with books had been they were quite readable sometimes across several generations if they were cared for and protected (see the family Bible).

The rule here should not be that you can't 'sell' clients for your game server. I don't think the government should dictate the business model, but it really should make sure consumer understand WHAT specifically they are getting and not getting in exchange for their dollar.

There should be some limitations that come along with license terms that are not open ended, that is you are providing a binary(ies) or source code that will run on a given platform, ie a computer with a given instruction ISA and operating system with a given set of libraries and syscalls. If there is something else you need to make 'effective use' of the product that isn't either provided or made availible by a disinterested third-party, like a server component, vendors should be required to be up front and in your face about that.

This ^^

We do not live in a command economy. It is not the role of congress to decide what business models are appropriate. It is the role of congress to make sure free citizens are able to make informed decisions.

What is really need here IMHO is good warning labels like what is placed on a pack of cigarettes.

WARNING - This software does not function without access to components not included, with no certainly of future availability or access pricing.

WARNING - This product contains digitial rights management, the license terms represent an open end RENTAL agreement, revocable by the issuer not a sale.

Require those to appear DIRECTLY above the check out button for online sales, and be on the face of boxes and printed manuals if they apply.

That supposed newer software has fewer vulnerabilities than older software.

Broadly speaking that is likely true, you python backed REST service with SPA front-end, is not probably going to suffer from memory saftey issue like the C based CGI program it replaced. I'll grant you that, but I don't see any evidence at all out there to supposed it is not as target rich in terms of authorization/authentication/business logic flaws as anything it replaced.

I don't have experience with BOA but I do have system experience in other megabanks and I can tell you most of them have a front-end/backend architecture where the system of record that actually does settlements has quite a lot of isolation in front of it and separately enforces transaction rules. If for example you found an IDOR in the web banking application and you swapped your account ID in an internal transfer for an account not your own which you discovered by whatever means as the funds source to one of your other accounts as the destination, it *might* let move the money. The system might treat you like you have the money for the rest of the day. So you might be able to pay other people within the institution etc (where they can roll it back) or take money from an ATM. However when the backend processes all the transactions from the day to do settlements it will be REJECTED by some old hunk of COBOL or maybe...Java..

They will clean it up and come after you.. That is real reason a lot of these bugs don't probably get exercised. It isn't that people using the public components of these systems don't see interesting things breeze by their browser consoles or even burp suite instances, they probably do, they just know even if it worked they are 100% going to be caught; and their Jubilee would last about a day before turning into something that looks more like Revelation.