Something I’m having trouble connecting here is: it took time for all of those things to be physically available to everyone, which is what took time. Conjecture, but AI is kinda already everywhere it’s gonna be; it’s largely adopted in every possible place it can be. And I don’t necessarily have a point, it’s more so just an observation on how I think it is different, though I’d love to hear other points or arguments.
> You get more done without realising you're learning less
Unfortunately, I think many folks now just don't place any value on learning or knowing things because they can "just ask AI".
That's probably my biggest fear with AI is that people just don't see any value to knowing things anymore. And quite ironically, AI is amazing for learning new things.
No no no this is incorrect and conjecture with ZERO evidence behind it.
People ABSOLUTELY place a ton of value on. Learning new things? You yourself JUST called this out but somehow “many folks” don’t place value on learning new things? What’s many? 20? 50? A million? Ten million?
I can agree with the claim that people don't place value on learning new things. It may be anecdotal, but I know that a large portion of people I have talked to genuinely do not care. It's sad, but true. I see it all the time in person and through social media.
Yea. Fedora has been one of my favorite OS's for years, but exactly what you describe "If one compromised update snuck this guy in.." has spooked me to something with a much slower release cadence. I guess I accept that more unpatched known vulns stick around, but yea when I start thinking about how many software packages -> the number of devs, build systems, etc. It just gets overwhelming thinking about how many threat actors are probably trying to get in from each avenue.
I'd love to hear other takes on this though... Current thought is to just use something with a whole lot of exposure, in a whole lot of environments, pretty far downstream so the package hits all of that exposure, and hope someone spots it, kinda like xz. I tend to keep my base OS extremely minimal and do all my real work in VMs.
The contra is that “stable” releases are now a liability, because it takes longer for upstream fixes to be back-ported. Recently, for bugs that are quickly exploitable in the wild.
A recent example is the TCP options use-after-free, where it took Canonical a couple days to patch LTS beyond when the fix was first available in Fedora 45.
And these are just for public CVEs. I’m also worried that there are a lot of quiet fixes being made with new agentic review tooling, which may fix an undiscovered bug but will never be back-ported.
Damned if you, damned if you don't. Update constantly and you might get a fun little surprise shipped to you in one of the updates. Update occasionally and you'll miss the critical fix(es) to a vulnerability you have.
I think the only way out is extreme scrutiny of all updates and paranoid minimization of all attack vectors, but the industry is only going to settle into that local minimum after we go through some devastating breaches.
Yea I should have put it in my first post, but that is the one I have come across a lot reading some of the package maintainers comments from fedora on reddit. It's a really good point. Thanks!
Yep. First few years is just getting a read on who is accurate, who is precise, and who is both. Lots of alarms going off all the time in this industry.
reply