https://en.wikipedia.org/wiki/Parable_of_the_broken_window

Basically, if you accept this line of reasoning, then someone going around breaking windows and someone else going around repairing them can be seen as good because it creates jobs. But that would be nonsensical and create poverty. That's why economists focus on wealth creation not job creation.

Fixing security bugs is only needed because people exploit them. It creates work but it doesn't create wealth.

One way to think about it is that production allows you to pay for stuff. Not necessarily directly but by way of trading. It is the output you use to buy things like security.

Consider an apple farm. What does the apple farm produce to pay its bills? Apples. They could also dedicate resources to pears, &c, and that would add to their production -- to the goods they produce, the goods with which they (indirectly) purchase tractors, fence posts, &c. They could also dedicate resources to security -- more fences, &c -- and this may even be prudent. Maybe thieves are getting taller. This doesn't really add to production, though; at best, it maintains production at the status quo ante (assuming the fence is effective).

The software is better in the end but not all of it will be productive.

  If that same city was subjected to weekly riots

  That's productive.

The point it, this was not happening before. LLMs made cheap cyber attack possible. But it didn't make the implementation of fixes correspondingly cheap. So now everyone needs to spend extra money/effort to install grills to cover where LLMs fall short.

For postgres, this absolutely makes sense though as long as people are willing to shell out the profits from LLM use to support postgres development. That is one way this could workout for everyone..

Then they have a pikachu face when someone smashes their car window to steal something worth $50 they left on front seat because “who would do that?”.

What is even better thief will most likely pawn this for $10 but for him it is effortless $10.

Not obvious to me. I am generally a fan of Cyberspace manifesto and the free Internet, I think it's great people can reach outside their ingroup and talk to strangers and ostensible enemies.

But, that doesn't mean we should give up physical security, the guarantee that the connecting party comes from a certain physical location (state, company). I think allowing connections from anywhere by default is fundamentally flawed security architecture, for certain things.

The algorithm is: if the threat model is valid, there are vulnerabilities and you either have some software everybody knows about or a gang of hackers specifically targeting you, you should patch.

The part of the industry that profits from security theater will want you to patch no matter what, even if your business goes down in flames due to downtimes and new bugs introduced by patched components. They won't remind you to assess the threat model first.

I don't think that's true.

In medicine, science often doesn't know how specific drug really is working. They just do a lot of tests and if these tests are positive enough, they ship it. I think it's good analogy. Biology is very complicated and it's out of our grasp to truly understand how various parts of it interact with each other on so many levels. But if something helps, it's stupid not to use it just because we don't fully understand it. Sometimes it bites. Sometimes it bites 30 years later. But we still follow that approach.

Software is similar. The complexity of the systems we build is enormous, when we're taking in account all the moving parts. I just read that someone emits radiowaves toggling memory bit and ex-filtrating information. How can you account for that? Probably you can't. But we still need software for good things.

This is one of the least talked about and most useful features in any harness I would say, the review feature. I have never not found issues (either security or implementation) running it, no matter the code base or language.

It's not that the LLM code is that great, but that many overestimated the human code and the human review.

Human-written code isn’t inherently buggy, and LLM-written code isn’t inherently bug free. What is irresponsible is shipping code you don’t understand, and that will only increase with LLM-written code. A major reason why so much of the world’s software sucks is precisely that we think of it in terms of what’s “economical” and not what’s good or right. What we need is to slow the fuck down and stop treating every facet of life like a transaction. Software is filled to the brim with dude bros who “move fast and break things” and actively exploit people as their business model and somehow are called “the brightest minds of our generation”. Our priorities aren’t right.