These are also many of the most looked at, most often fuzzed, SAST scanned, valgrind'd things in the world.

I really don't think it will be as bad as all that. We have not seen Apache, Nginx, etc pwnd like this, or OpenSSH, or Bind, or postfix ...

I could go on. I think the actual posture and condition of most of these project is far better than you apparently expect. (I guess we are going to see who is right).

What AI is finding is stuff the other scanners miss, which is stuff where there is a clear temporal component. We are going to see races, toc-tou, probably more stuff like these PHP issues which if I understand correctly is a use-after-free or something you could at least force into that taxonomy.

So there are going to be new bugs found, even seriously impactful appearing ones, but the reach-ability and chances of successful exploitation outside laboratory conditions is going be low... Do they work when it is a VM on you lab server you can hammer away at with 1000 threads yes; when there is a AWS ELB in-front or a waf that has any impact on request ordering or pipe-lining, good luck..

I am not saying people won't be spending more hours patching over the next year or so than they have been, they will but the sky probably also isn't falling

People say that but I think they say it without a lot of real understand of what the web was like when it was born, and second that PHP5(+) does not look much like PHP 4(-)

Before PHP there were CGI scripts/programs, which were Perl, sh, or C or if you were on Windows classic-asp. If you wanted maintainability your wrote in Perl (yeah I am being serious) and if you wanted performance or needed to do something complicated you wrote it in C. Remember we are talking 1995-97 here there isn't even a C++ standard yet! These were you main choices for 'web development'.

PHP let people do what demanded C in something that did not have to be compiled and did require understanding C style memory management. Here comes the big BUT though, all the really good, really useful library code out there was C. All those library authors did not talk to each other so everyone was different in terms of conventions, who allocates the the caller or the called, who frees, are we passing references or values for primitives, etc. All different and php did not attempt to hide any of that as it pulled in those libraries it wrapped them in its runtime and memory management without attempting make their use orthogonal and part of some consistent ecosystem.

It wasn't a 'hack' it just was not a complete abstraction.

That was 'fine' for people who came to PHP from writing C, and were using PHP because it let them make changes on the fly, saved writing a lot of boiler plate request life-cycle management stuff, etc. It all made sense, if you can at it not from C though it was confusing mine-filed of gotchas. It made web development possible for a whole lot of people who never got access to compiler. That was cool, but it also put a lot of power in the hands of people the way the Visual Basic "Declare" keyword did, and unsurprising they did hack-y things with it, cause themselves all sorts of problems..

This is true in a lot of case.

The other case is where the fund managers and 'market makers' are not tied to the individual companies, they also don't care about long term performance. They only care about the ROI, on their position.

If a 'savvy' analyst determines the latest round of layoffs will mean a huge jump in earnings per-share for the current product cycle, and knows that is usually 2 years or so long. They just put a tickler in to sell 18 months out; before retail an state pension funds work out ACME has nothing in the pipe line and will soon be going to market with quick application of lipstick on their current products up against likely superior offerings from competitors, and it will end in tears. Or that the current round of enshitification is going burn thru the remaining customer loyalty they have enjoyed jeprodizing their future market position or whatever the case may be.

They simply don't care because they can make a profitable trade today. They are 'owners' and 'investors' but they don't have a traditional sense of ownership and concern. I come back to the problem not being 'capitalism' or even hard nosed capitalism ie 'you don't work you don't eat', 'you don't produce value nobody will buy' but rather on of to great a number of abstractions and with them to many perverse incentives.

I have said it before i really do think the 401k system has broken not just markets but our society. Your point "so essentially the retirement accounts are yes votes and not ownership oversight" is DEAD ON!

You would think the video of a French woman standing outside her market, pleading with the mob to stop looting her own space, pleading that she supported them, spoke in favor of their continued residence in France, and watching these criminals ignore her. Nope, her support was neither necessary nor appreciated, the mob intends to win by violence.

But, while you might think on this, the Leftists dare not think, for to do so is to expose the perfidy of their leadership and their utter failure to discern plain facts.

England may be lost. France has time. The rest of Europe is waking up, though many nations are feeling trapped, it seems, and cannot respond to the invasion. And, given the nature of the invaders, it will be blood that decides this.

Not to defend China - its amoral indefensible blight on the planet - but the average Chinese citizen being one 1/3 as productive is not the only way the math works out. It certainly can be the case that we are not measuring productivity accurately and/or are using the wrong metrics as a proxy.

For on thing productivity is a measure of progress toward a goal, does China have the same goals we do? I am not sure "Biggest GDP" is really what Xi is after.

I think looking at Europe is good example. They are mostly capitalist but the best parts of it also using the petrol chemical cheat code. Germany is struggling, they have trouble even trying to allocate and spend their own stimulus packages. The rest of the EU make the US debt spiral situation look solvable ;-) by comparison and the bond market does not share that view.

I think you could say that hard-nosed brand of capitalism is what has carried us this far and why we don't look like France right now. I mean seriously compare the BLM unrest, or Jan 6 (if you like) in the US to what is happening in France right now. There is no comparison, in terms of how destructive and destabilizing it is/was. Take away all the various politicking and window dressing about what is going in France right now and it boils down to - a large segment public accustomed to increasing socialism is upset the government won't give them nicer stuff, and government that is by no-means opposed to affording people lots for entitlements pushing back on doing so because those in office recognize it isnt sustainability affordable.

The problem isn't capitalism and it isn't how 'hard-nosed' that capitalism might be it is an ownership and direction problem. Capitalism as described by someone like Adam Smith assumes self interest but it assumed the owner of the capital would be in control of it. That is if you are the owner of a company you want it to continue to grow for at-least-your-life-time but probably that of your children and grand children. Today the CEO is employee and the owners are largely inactive shareholders (they don't vote on much, read board meeting records etc) they are not interested in how the company will perform 20 years from now they are ONLY interested at most in how it will perform between now and maybe the next dividend date. The CEO is only interested in the current quarter and perhaps next, he does not plan to be there longer than 18mons in anycase and is perfectly happy to move on if the quarterly bonus are not fat.

Ross Perot tried to explain this to the public when he said 'Giant Sucking Sound'. Anyone with a brain could see 'trade modernization' was going to create massive windfalls for ownership short term as the divested expensive American workers, real-estate, and regulatory environments and bought cheap labor in Mexico and further afield; but anyone with a brain could see what that was going to mean 30 years on.. Well here we are. An America that can't make things, and I don't think has bright economic future at all, unless we make some PAINFUL choices today to course correct. Because guess what AI datacenters dont care where they are at and models/IP will always be stolen by whoever wants it enough. In the end you have to make things - physical things - people want.

Lots of profitable corporations out there seem to refute your claim.

Let's translate that accurately...

greed = profit

immoral = cheating

success = survival

MBAs are taught to succeed, by the rules until the rules fail them, then without (hopefully) getting caught. Employees, materials, information, technology, all these are resources to be used to generate profit.

Corporations do not exist for any purpose than to continue their existence, and, usually, derive a profit from their activities, whatever those may be, while continuing their existence. Shell and holding corporations are specialized forms of corporations, generally structured to accomplish specific purposes.

To decry corporations, and those who lead, manage, or support them as exclusively immoral and/or in opposition to the good purposes of society at large is simplistic at best, and generally misguided. You may not like the corporate method of organizing a business venture, but there are limited options. Because the concept of 'corporation' is for me interchangeable with the concept of 'company', which is literally translated into 'group or gathering'. How you succeed in accomplishing things that require more than a few people in some other fashion is something I cannot fathom. Companies/corporations are not new, and neither are their abuses.

But feel free to point out my naivete, and how horrible the world is because of it and whatever you proclaim is evil, and state your case for not being a willing part of it. We all want to live, so we are all caught in the web of society, and make our way either as best we can, with or without regard for the success of others.

Yes it does, but video games are different. Nobody downloads an "update" for their movie that removes scenes or disables it. That is where the Stop Killing Games movement really should focus. It should be illegal to send out a patch that neuters the game, then announce version 2 of the game is on sale for $50.

As if 99% of the sites you're visiting aren't 'spying' on you also.

Including *this* one*.

* - /. has some features that suffer when a decent ad blocker is active in your browser. So, if I want to expand comments, I have to disable my preferred ad blocker. Kudos, &%%holes.

yes but people instinctively understand mechanical devices wear out. There is/was no natural reason to assume that about software. For the first decades of computing most of the public encountered that wasn't the case, quite the opposite in fact in 1995, the COBOL program you wrote in 1965 still worked fine. The DOS program you bought in 1985 still ran on Windows 95 just fine (well it was as likely to work as it ever was on any given DOS machine ;-) maybe more).

Software right seem to people like book, and their experience with books had been they were quite readable sometimes across several generations if they were cared for and protected (see the family Bible).

The rule here should not be that you can't 'sell' clients for your game server. I don't think the government should dictate the business model, but it really should make sure consumer understand WHAT specifically they are getting and not getting in exchange for their dollar.

There should be some limitations that come along with license terms that are not open ended, that is you are providing a binary(ies) or source code that will run on a given platform, ie a computer with a given instruction ISA and operating system with a given set of libraries and syscalls. If there is something else you need to make 'effective use' of the product that isn't either provided or made availible by a disinterested third-party, like a server component, vendors should be required to be up front and in your face about that.

This ^^

We do not live in a command economy. It is not the role of congress to decide what business models are appropriate. It is the role of congress to make sure free citizens are able to make informed decisions.

What is really need here IMHO is good warning labels like what is placed on a pack of cigarettes.

WARNING - This software does not function without access to components not included, with no certainly of future availability or access pricing.

WARNING - This product contains digitial rights management, the license terms represent an open end RENTAL agreement, revocable by the issuer not a sale.

Require those to appear DIRECTLY above the check out button for online sales, and be on the face of boxes and printed manuals if they apply.

The 16GB version has that printed on the board. You can't count on the jumper resistor to tell you, for obvious reasons.

This could be help if they did print RAM capacity on every board... But then they would not be able to take raw boards, solder on RAM, set the jumper, and poof, board for sale. This way, they manufacture bare boards in quantity, and the 16GB is a different board, IIRC, 5 jumper positions unlabeled, where the 1,2,4,8 boards have 4 jumper positions and are usually labeled. Fewer SKUs.

The FSF wants everything to be free. Well, actually,. not everything. They happily accept your donations, so perhaps 'voluntary' pricing they can support.

But voluntary pricing seems, inevitably, to become zero.

I agree, dfghjk, Stallman is a soft sociopath.

"Yes, SELL, not RENT. That means the purchaser OWNS the result. And should be able to do whatever the &*_@ they want with it."

And the argument for Metrovision bypasses comes back to life. No, Raspberry PI owners generally do not expect to defeat the legal licensing of content to avoid the cost of purchasing, but, but. I suspect at the root of this is the RPi Foundation might just be upset that there are boards out there being sold, with mor RTAM than manufactured with, for more money. Money that the RPiF did not get. I've got a collection of Raspberry Pi 5s, 8 and 16GB versions. I bought the 16GB at MicroCenter during their Phoenix opening, sheer luck as it was the last of the last shipment before retail pricing kicked in, and for $99. Today retail is $305. I ought to scalp it and buy some hats, but if I had a 4GB board, imagine soldering in 16GB and reselling it for $200 more...

I get it. And I'm not as whiny as the FSF, mostly because they are to vigilante for me. It's money. That's all.

That supposed newer software has fewer vulnerabilities than older software.

Broadly speaking that is likely true, you python backed REST service with SPA front-end, is not probably going to suffer from memory saftey issue like the C based CGI program it replaced. I'll grant you that, but I don't see any evidence at all out there to supposed it is not as target rich in terms of authorization/authentication/business logic flaws as anything it replaced.

I don't have experience with BOA but I do have system experience in other megabanks and I can tell you most of them have a front-end/backend architecture where the system of record that actually does settlements has quite a lot of isolation in front of it and separately enforces transaction rules. If for example you found an IDOR in the web banking application and you swapped your account ID in an internal transfer for an account not your own which you discovered by whatever means as the funds source to one of your other accounts as the destination, it *might* let move the money. The system might treat you like you have the money for the rest of the day. So you might be able to pay other people within the institution etc (where they can roll it back) or take money from an ATM. However when the backend processes all the transactions from the day to do settlements it will be REJECTED by some old hunk of COBOL or maybe...Java..

They will clean it up and come after you.. That is real reason a lot of these bugs don't probably get exercised. It isn't that people using the public components of these systems don't see interesting things breeze by their browser consoles or even burp suite instances, they probably do, they just know even if it worked they are 100% going to be caught; and their Jubilee would last about a day before turning into something that looks more like Revelation.