Well, I don't want to get on the capital E - engineering tangent regarding software. But yeah, agreed on that. In most cases, we have been vibe engineering software this whole time.

Tangent aside, entropy favors the attacker even in the case of a building that has PE stamps on the plans and passes all codes at time of construction. Just leave it alone for a while with no maintenance, it will fall. Or, hire one man to correctly place charges. Far less work than what it took to build it.

edit: I want to make clear that what amazes me is how hard we fight entropy. We have built fragile societies, fragile technologies, we ourselves are fragile. And yet, humans are generally pretty cool and choose not to destroy all of these things, though we do have a few assholes amongst us.

"Software architecture" and engineering quality overall has had questionable quality at best. I don't see how vibe coding big new systems will make it better. I predict vibe coding will make for an even more golden age of hacking and a large increase in ransomware and breaking into systems. Today's giant hodgepodge of glued together software products could actually be better than vibing up something new.

I'd also expect the offensive side of hacking into systems will greatly benefit from LLMs finding an almost endless series of new vulnerabilities in even crappier llm software. I'm just so cynical.

That's kind of the definition of life tho, a system that fights, or "exports" entropy. Built in to our very code. Even the sand castle kickers are doing it for many years just just to be able get to the point to kick.

In the physical sense, entropy favors the attacker because destroying something is just helping it along the path it wants to take. Everything wants to turn into dust, all the time. It takes energy to prevent it from happening. The attacker can use significantly less energy to get it moving.

Consider the energy requirements to construct a skyscraper compared to the energy requirements to demolish one.

With our current technology, that's true, but there were hundreds of years where fortifications were pretty well impregnable showing that human technological capacity is bounded well before the laws of entropy come into play.

“It’s easy to destroy a building than to build one” is still true, building codes or not.

buildings may be quite hard to destroy, but the relevant question is whether it is proportionally harder to build one.

required codes and standards may raise one (difficulty of removal) or both (difficulty of removal + difficulty of construction) in varying proportion.

The tools to "knock over" a software system are easy to download and come by, but do require some skill.

On the other hand, "You wouldn't download a wrecking ball?"

Indeed, except when you get into the critical software realm. Firmware for pacemakers, avionics etc. There are respective ISO's/regulations and enforcement bodies.

I wonder if that ever expands to traditional software when the stakes and blast radius increase significantly with time.

I mean for just the EU you have:

Digital Operational Resilience Act (DORA) and Cyber Resilience Act (CRA) which enforce mandatory governance and processes like resilience testing and cybersecurity lifecycle requirements.

GDPR & Data Protection frameworks which requires architecture to support CRUD operations on all PII, data minimization, customer-managed encryption architectures and so forth.

...and the anti-vibe code framework aka the EU AI Act, which requires human oversight and data quality controls.

This is completely aside from any industry specific engineering codes like in Finance where you have to adhere to things like ISO 20022 or iXBRL/ESEF standards, user accessibility mandates, and PCI Compliance mandates for things like Security Architecture over and above the CRA.