As someone who has been programming for about 25 years now and has always been frustrated by the tendency of software devs, and in particular web devs, to not address the root issues but just scaffold on top of them and try to hide the ugly bits under the carpet, I feel a bit vindicated.
Everybody in the industry knows that we've been building on quicksand. Moore's law meant that we could just sacrifice performance and add a dozen layer on top of technology from the 90s (if not older) and keep the thing chugging along.
Look at the PHP situation:
- HTTP is an old and quirky protocol with a lot of surface open for attackers that are rarely useful nowadays and might be better left off to higher layers. But of course, we can't break compat, so everybody still implements all the naughty parts, just in case.
- PHP was a joke language from the start, we were making fun of it in the early 2000s, the fact that over 20 years later it still powers a huge chunk of the web is enough to demonstrate that we're not serious people. Cue the PHP fans telling me that "it's good now". Maybe, I don't really care, the effort that went into making it good should have gone into ditching PHP for a better language 20 years ago. The bandaid mentality is what got us in this situation.
- And of course to add insult to injury, PHP, this security-critical language, is still implemented in garbo C using things like setjmp/longjmp. Just to make sure to absolutely maximize the damage if a vuln is discovered, I suppose. Brilliant.
- Oh and all of this is still running overwhelmingly on top of x86 which is its own bag of legacy garbage. "No but you don't get it, modern CPUs are really more like RISC CPUs, the RISC ISA is translated internally" yeah exactly that's my point let's stop doing things like that.
We're a clown industry. We only made it this far because, usually, buggy code doesn't kill people and we can iterate and patch things quickly. We never had to do things correctly, we could flourish with abysmal levels of quality acceptance. This may not be true anymore.
Of course the reason things are done this way is generally to maintain backward compatibility and make transition easier. At least now that we have LLMs this excuse will hopefully vanish: porting even huge codebases to a new language/framework, something that was a tremendous undertaking mere months ago, is now vastly easier and faster. We can leave the 1990s behind us.
> We're a clown industry. We only made it this far because, usually, buggy code doesn't kill people and we can iterate and patch things quickly
I think you have things backwards. Devs aren't clowns who make it this far. But in industries where buggy code doesn't kill people, devs are expected to ship fast and iterate, because they can and more importantly, it serves the business.
Personally, I'm all about good software engineering principles, unfortunately I don't think you can last long in most companies if you're too opinionated about this and can't compromise (and it's getting even worse with AI, reading the code is no longer a requirement, go explain your teammate that there's an abstraction leak in their code...).
Yes... there are statisticians on my team, for example. They're capable, thoughtful individuals however have little exposure to the oblique and (outwardly) contradictory ways in which production software fails.
But explaining that openly, as is your duty, means surfacing something which could be read as 'bad work' by a non-technical manager unable to grasp the complexity. So in low-trust teams it very quickly becomes a game of brinkmanship, or a prisoner's dilemma for technical diligence
I am currently in a stalemate where I have written a proposal that is very technical. The only “business” outcome is that we clean up a massive security mess and rebase on a new consistent architecture.
My manager can’t understand the RFC, and knows that clean up projects aren’t palatable to his senior eng leadership so he keeps asking me to simplify or derive some business justification. I’ve proposed superficial ones like improving security posture etc but he wants a hard number that can be measured (yet another senior leadership mandate).
I’m kind of exasperated and honestly think it’s his job to figure this out.
You've uncovered the kernel of the software industry- if it works well enough, don't touch it. This is why legacy software hangs around for longer than it should.
The problem is the "interface" of software engineering being oblique to outsiders. It's alchemy in essence.
The logical extrapolation of AI capabilities stress-testing human software is all bugs being discoverable. Hence, you have to aim for actually bug-free software.
The only way to do that is to make your code provable. That again is only realistically doable using AI.
In the process, people will have to turn the current mere pretense of software engineering into reality, making the engineering part explicit.
That in turn only works when humans actually understand what they're doing and can communicate it to outsiders.
Thank you! I entered the industry a lot more meticulous, test driven development, integration tests, end-to-end.
But shipping faster was pushed at almost every company until, if it's not revenue generating, stop putting resources into it. Not all are like this but it's not all or nothing, it's always a sliding scale how much you can put into making the software correct.
I'm a software artisan deep down but I could never justify putting too much time into making the stuff I used to build "clean and fully maintainable". I tried, but eventually I realized that if I didn't get things out of the door, my company would start losing money and I'd lose my job. Who cares about perfect software in a bankruptcy auction?
There are things you buy out there that don't need Swiss quality because most people will simply not need the quality or won't have the money to pay for it.
I think the biggest problem isn't that a random webpage is sloppy, but when a critical system that could kill people is built the same way as the random webpage.
I hear you, but humans are incredibly bad at context switching like that.
Near the point where things become minorly safety critical, people will blur the line. The point where safety kicks in moves a little further out, and we start blurring the lines again.
There’s a reason the FAA is anal-retentive about things with only very minor safety implications, like the in-flight entertainment system or turning on airplane mode. It helps prevent complacency where it actually really does matter.
You either do it the right way 100% of the time, or I’m not taking bets that you’ll do it right on a particular occasion.
> eventually I realized that if I didn't get things out of the door, my company would start losing money and I'd lose my job.
This is like 90% because most tech is different enough that civil torts don’t exist for them yet, so they don’t have to care.
Eg if Google deletes all your photos they kind of just shrug and you’re out of luck. If I deposited photos at a bank who burned them without notice or approval, they’re on the hook for that.
The law will eventually catch up and acknowledge that bits can have value. Then everyone will have to care again.
You are describing my field - Systems Engineering.
We track EVERY requirement to ensure it is met. Maybe it's a safety issue; maybe it's landscaping approvals (I work in Rail). Regardless, it's bigger $ if not caught up front, and if you start grading requirements on perceived risk, you start the slippery slope to not caring. Example: mark all landscaping requirements as "Not Critical". Then scheduled clearing of the right-of-way is missed. Then pedestrians are at risk with blocked line-of-sight, and trees might drop across the rail.
I can't say I disagree. How it is with engineers they get certified as PEs due to the responsibility they have. In my mind it be similar, you don't need everyone engineer certified, but if you over X revenue or employees side it should apply, and be required to have Y numbers of certified based on company size. Then the companies like with their lawyers, will have to figure out how to follow the regulations and push forward.
I think this is good thinking. I work for a state agency that deals with construction codes and licensing of building contractors, electricians, etc. If the safety of the web is in such a critical state of vulnerability as to potentially impact what the article author terms "normal" non-tech people, maybe there should be some certification that is government-regulated like you suggest. Or maybe that'll happen after real (not potential) devastation occurs - that's how building codes came around.
Look at the solo projects from professional devs with nobody overseeing them. Look at what so many of your colleagues submit despite the frustration of your thoughtful team lead and manager. Look at what your so many of your team leads asks for even when they've been granted full discretion. Some select few are great, but most are disturbing if you have any sense of quality or preparedness yourself.
Even for decades before AI, there was lazy naive misguided slop everywhere. During the social coding era of the last 15 years this even amplified itself, streamers and influencers and conference presenters -- professional developers themselves -- would share horrid practices to wide applause. Moving fast and breaking things was what developers were excited about. Rigor was dead. Correctness was a problem for later. Code was presumed best written by a rando on github who'd accumulated a lot of stars rather than by a known responsible hand. Security was a copy and paste job from Stack Overflow, not something to be comprehended and considered.
If only it were a top down problem from outsiders!
But the truth is that the call has been coming from inside the house all along, and the outsiders giving direction have had no problem finding celebrated industry "experts" and "thought leaders" affirming and encouraging all the clowning they could imagine.
Developers could always move fast and do things right but most just didn't have any interest in learning how, and many of those who might have just gave up on bothering.
Thanks for the counterpoint. It's true that being sloppy and taking shortcuts isn't always a calculated business decision and it can be a lack of skills.
Shipping bad software does not serve the business indefinitely. Application/product security was expensive relative to its perceived value, so it was underfunded nearly everywhere.
Completely agree, but the problem is that the execs don’t understand that. People at the leadership level don’t truly understand or prioritize technical debt. Paying down the debt can be really hard to sell to leadership.
I agree... many people seem very purist. But I think it depends on what you're doing. Some things make sense to do fast and cheap. I work helping fundraising, and it's often better to have 95% solution that is delivered on time than a 100% solution that comes out after the campaign has ended for example. Management should warn us ahead of time and give us the time and the space to do it right, sure, but how often is that reality? As long as it's a conscious trade off I think it's fine.
Just take a look at some of the opensource academic, infrastructure or "passion-projects", where there is no management pressures to "move fast & break-things" and ship-ship-ship. They tend to be very stable, very predictable - and very high quality.
I've seen software that academics write. It's no better than average. It's often cut-and-paste code, or these days AI slop. Software is a means to an end in academia, rarely a product in itself.
Wow, it’s almost like it’s really hard to get everything perfectly right and this is endemic to software, particularly when the language accepts incorrect code.
The only two things we know mitigate this are proofs (eg rust borrow checker, lean, etc) and DST which is basically the equivalent of accelerated time testing which is done in other industries too. Most people don’t even bother with property testing
simias referred to the industry and you took it personally.
Why is it whenever someone mentions the shortcomings of software industry, there is always a comment saying "no no no, developers were just following orders!"
He spoke of a clown industry. That means the industry as a whole. That includes, but by far isn't limited to, the devs. Which of course have to operate in an environment, most of them set by their employers. And of course, responsibility scales with the position in the hierarchy. So yes, to a large part it is the management setting deadlines, budgets, staffing and planning allowing for technical soundness and of course safety and security.
But also every developer has a responsibility. At least not to promote any technology which is part of the problem.
Don't all industries work this way? Construction has "old work" and "new work" versions of many parts. For instance, replacing windows on a finished house is a different job from installing windows on a house that's still under construction, so they build "replacement windows" and "new windows." We don't demolish functional homes unless they are unsalvageable; we cut into drywall and patch over the hole. The drywall would look bad if you looked at the backside of it, but the homeowners can't see the inside of the drywall and don't care.
It's coordination problems and large scale distributed action, not some moral character of how serious the people are. Effort is not fungible. To make php good, you only have to act at one point, in a localized way, at the php foundation. To ditch php, you have to act in a coordinated way across any resource strapped companies and individuals. Just see how hard it was to ditch Python 2 or how ipv4 is still not ditched.
Trying to understand underlying reasons and incentive structures is much more productive and useful than simply venting about the worse moral character and seriousness of people in one industry vs the next. Curiously, the grass seems always greener - when you ask people in other industries, you'll often hear endless complaints about the state of things there too.
You exercise every code path with a unit or integration test.
I tend to write integration tests for the paths users take through the application (website), and fill in the holes with unit tests. I'll also write unit tests for methods that change often or are critical, such as business logic.
> We're a clown industry. We only made it this far because, usually, buggy code doesn't kill people and we can iterate and patch things quickly. We never had to do things correctly, we could flourish with abysmal levels of quality acceptance.
What industry do you think is different?
I've had a decent amount of construction work done on my house, and if I had a pound for every shortcut that the guys doing the work took, it would pay for the work they did. And these are the _good_ ones. The bad ones don't even bother following the legal requirements. Somewhat recently [0] it was found that less than half of healthcare workers followed recommendations on _hand washing_.
Residential construction isn’t much better. But the people who build the really tall stuff, the structures that would kill people if they collapse, that’s real engineering. The odd bridge that collapses is usually a political problem (lack of funds for maintenance).
I use to joke about PHP in the early 2000s, but now that I see the "better languages", I am starting to like PHP.
If you want a web page that works with a database (aka. CRUD), presents it in HTML form, and with a bit of business logic, like 90% of websites, then PHP does it simply. None of these astronautic patterns like you see in Spring, the dependency hell that comes with node, or whatever the cool kids are using right now. There is a reason PHP became so successful despite the hate it gets.
PHP is not great for security, it was terrible when it started, but now it is decent. And sure, a vulnerability was found, it is now fixed, every time a vulnerability is found and fixed, PHP becomes better. New technology may have an advantage due to better design, safer languages, etc... but you shouldn't dismiss the qualities that 20 years of bugfixes get you.
As for x86, yep, it is legacy, but it is not completely stupid either. The "RISC core" is not right, it is not like x86 become ARM or RISC V code internally. It is translated into long microcode-style instructions that wouldn't make sense as an ISA, where a compact representation is important for memory/cache reasons. RISC code is also translated just like x86 code, and the advantage of CISC vs RISC has gone back and forth. Now it seems we are going back towards RISC again, but before that, it was CISC, and before that, RISC again. The quirk about x86 that complicates things seems to be the variable length instructions. But the real problem is not really about which ISA is the best (it is a very small part of modern CPUs), it is more about licensing and backwards compatibility.
Yeah PHP was the first time web applications really "clicked" for me because there were not a hundred layers of abstractions between the html page and the application code. I was new to programming, and I took a look at J2EE and its literal million lines of code pet store that was supposed to be the shining example of how to do J2EE right, and I was like wtf is all of this... PHP though it was so easy to just make a page that gets some stuff from a DB, does some stuff with it, and outputs the result. I didn't need to read a 500 page book to get started with it.
In the end, PHP wasn't great, but around 2000 it was a great intro to building things on the web.
PHP's other advantage is deployment: it's simple. In the 2000's, I used to work at an enterprise Java shop but also did PHP freelance work. The amount of bullshit you had to go through to deploy a Java app on JBoss was insane.
> PHP was a joke language from the start.... Cue the PHP fans telling me that "it's good now".
First, I am not a PHP fan, but I will absolutely stick up for the "its good now".
Yes, absolutely no debate the old PHP 4.x/5.x was shocking. However to give PHP their due, they absolutely did make serious efforts in 7.x/8.x. They deserve due recognition for that.
Unfortunately lots of people – I'm guessing you're one of them – still have battle-scars from 4.x/5.x and they think (incorrectly) that 7.x/8.x is "more of the same".
Second "joke language", well, cast your mind back to what else was available at the time... ColdFusion, CGI, ASPX ... it was not exactly a beautiful world back then.
Sure, to borrow your terminology, the Java fans will be along soon to tell us all how awesome Java is for the web. But many of us still bear battle-scars of the horrors of Java stacktraces, messing around with incomprehensible XML config files, Java's penchant for eating RAM for breakfast, and generally trying to figure out why the hell Tomcat is not working (again !).
> ColdFusion, CGI, ASPX ... it was not exactly a beautiful world back then.
Pffft. VRML is the whole game, baby! Once everyone runs out and gets an SGI oxygen, Nobody is going to use freaking web browsers ever again. I mean, HTML, what a joke.
Also, ASPX (so ASP.Net) was a vastly superior technology to PHP. It was my first love, and I ditched it for Ruby on Rails, but ASP.Net was really good. Especially when you ran it on Linux using Mono.
The previous post probably should have said classic ASP, not ASPX.
Classic ASP was the more direct competitor to PHP, while ASP.net came along later, as part of a next generation of web server languages/frameworks/platforms.
Wait a second, in very recent years the major Java projects I touched were still messing around with incomprehensible XML config files. Has that actually changed in some part of the industry?
Yes, when I started getting into Spring(Boot?) in 2013-14 I was complaining about the annotation magic that you needed to sprinkle around the code, so that you could have a Java project take a long time to start up and fall over. The response at the time was that it was so much better than the old XML way that you "had" to do. So that kind of XML hasn't been needed for 10+ years.
Unless you count the XML dependency management with Maven, which isn't too bad.
> Has that actually changed in some part of the industry?
I suspect the only thing that's changed is that Oracle now charge you for the pleasure. ;)
More seriously though, its been a long time since I've touched Java, but I suspect the only thing that's changed is that its all hidden in magical kubernetes containers these days.
Not sure if you know what you are talking about? Most users of Java don't pay anything to Oracle. Many things have changed in the Java world. Kubernetes doesn't have any special relation to Java.
> Not sure if you know what you are talking about? Most users of Java don't pay anything to Oracle.
Congratulations Java Fan on missing BOTH the smily-face at the end of the first phrase AND the "More seriously though" at the start of the second.
I'm glad someone still loves Java though. ;)
P.S. The kubernetes reference was – since that one appears to have gone over the top of your head too – that in todays world Kubernetes is extraordinarily popular and therefore it is likely most people now hide the complexities of Java deployment into a container that is magically generated and deployed through CI/CD. Hence I was inferring that life is probably "easier" today with Java because you just deploy the magical container.
CVE-2026-109618 is evidence that it is absolutely not "good now". To make a pro-PHP argument the week that PHP's shortcomings just cost half the internet millions of dollars of lost time panic-patching an RCE is... an interesting choice.
>CVE-2026-109618 is evidence that it is absolutely not "good now"
That's a C language error, not a PHP language error. I don't see that CVE as particularly different from when they showed python's dictionaries could be attacked using dictionary hash-collision (something that also affected PHP). It's worse in being remotely executable, rather than merely a denial of service, but it's ultimately a facet of the C implementation rather than something wrong with the language itself. CVEs, even remote ones, will happen. Even java had its logging execution attack.
I've made fun of plenty of things in PHP over time, but the language hit the mark it was aiming for initially. It was easy. A 12 year old could sit down and write an ugly little forum and it would work. Because it was easy for amateurs, a lot of amateurs wrote in it, and there's a ton of clumsy code out there. Because it was easy to setup and run with minimal setup, popular packages were very popular. Wordpress vulnerabilities matter because it was very easy for programming chop shops to hack out tons of websites for all the millions of little businesses out there that didn't often follow up on patching etc once that was done. PHP was bad largely for the same reason BASIC was bad. It was easy.
PHP being easy gives it a huge blast radius for anything that goes wrong with its implementation or popular frameworks and libraries.
I have actually gotten a tremendous amount of value from PHP and WordPress: the via negativa! They showed me, in remarkable detail, how things should not be designed.
(I'm not kidding. If you take each element of their designs and invert it, you end up with a very solid design.)
On that note, I misspoke somewhat: I assert that PHP and JavaScript were not "badly designed", because that would imply that someone sat down, carefully considered how the different parts of the system interact, second order consequences etc. — and then somehow came to all the incorrect decisions. Rather, it's quite clear a serious design process has simply not occurred to begin with.
Once I recognized this phenomenon, I began to see it in all areas of life. Things are much worse than they could be, simply because nobody has designed them to be good. They just ended up the way they are now, by accident of history.
--
Polemic aside, I am fond of JS and PHP in many respects. I just think we should clean them up! "This mess has always been here, so it's too late to clean it now" would be laughed at in any other context.
We already broke compat with "use strict". Now we just need a "use sane" :)
>We're a clown industry. We only made it this far because, usually, buggy code doesn't kill people
Another industry does even better: the medical/health industry. It's both a clown industry AND kills people AND they have made it way beyond what software can only dream.
Having 25+ years experience straddling both disciplines, i.e. in both CS (Dev) and Medicine (as a licensed provider) -- and who currently works in frontier drug discovery, can wholeheartedly confirm both industries are a joke.
The big fun factor is the place in the Venn diagram where they both intersect. I used to work for a medical device manufacturer who's biggest and most popular product routinely had stack traces at inopportune times.
Oh I assure you, all industries are clown-driven, clown-built, and clown-maintained. Nobody has time to do things according to a retrospective analysis of "best" which will just be re-evaluated next generation. We build with what we have and fix when we must.
It's simply not realistic to expect the entire world rewrite its entire technology stack from scratch, starting at the transistor level on up every time there's a new industry innovation in security or performance.
LLMs might make this somewhat easier, but you're still going to have to deal with backwards compatibility and legacy systems. Completely eliminating the use of architectural cornerstones like x86 or HTTP or even PHP across the entire industry isn't going to happen anytime soon, let alone overnight, especially if the only argument for doing so is "we could design this better if we implemented it from scratch".
Another thing that has bothered me for a long time: we have far too many data isolation mechanisms, each with their own idiosyncrasies and trying to cover up for each other's gaps. Very very roughly, from source code up:
On the other hand we have few mechanisms to share data: the filesystem, clipboard, sockets, maybe dbus. Shared memory if you're feeling brave.
If a script wants to know what file is currently open on my editor or what email attachments I recently uploaded, the editor or email client has to explicitly implement this feature via one of those limited mechanisms. Almost nobody does this, so we're stuck with black box applications that are hostile to customization.
You have a point that there are a lot of separation mechanisms and that, if things were designed better, fewer would be needed but by the same argument it also seems unwise to increase the number of mechanisms to share data. Sockets by themselves are quite big enough on their own to quite literally drive the whole internet through.
A socket is just a raw byte stream. It's a solid base layer, but you'll have to implement your own communication protocol on top, and it'll require copying the data from one process to another. A "stream" is the wrong metaphor for local data sharing.
The data is already in memory and the source program knows its "shape"; there should be an easy mechanism to provide access to that by default, like /proc or gdb but for arbitrary data structures and with better UI.
Non-technical managers don't want to wait for the 'nerds' to 'do it right' because that takes a long time and the nerds don't agree on how best to solve the problem because most capable nerds (who sort of know what they are doing) are working on lower-level problems and making the big bucks (they are not running WordPress for the local News Paper).
So that leaves non-technical managers telling non-technical nerds to just install WordPress. Then, AI comes along and wipes them out. And everyone is like... how did this happen?
And, we know how to write code properly if that's what is required. There are methodologies from avionics and other critical code where every line of code has an audit trail back to a requirement. Where malloc is disallowed. If you want to compare it to other engineering, there are skyscrapers and there are doghouses. Most software is doghouses.
>Non-technical managers don't want to wait for the 'nerds' to 'do it right' because that takes a long time and the nerds don't agree on how best to solve the problem because most capable nerds (who sort of know what they are doing) are working on lower-level problems and making the big bucks (they are not running WordPress for the local News Paper).
>So that leaves non-technical managers telling non-technical nerds to just install WordPress.
Good summary of how the world operates generally everywhere. It's a clown world.
> Oh and all of this is still running overwhelmingly on top of x86 which is its own bag of legacy garbage. "No but you don't get it, modern CPUs are really more like RISC CPUs, the RISC ISA is translated internally" yeah exactly that's my point let's stop doing things like that.
The interesting thing is that memory bandwidth has become a big issue. CISC instructions take up less space than the equivalent RISC instructions, so you can effectively get more instructions per cache line. Effectively the CISC to RISC conversion acts as a type of decompression. Because if that, stopping the CISC messiness without moving to a compressed instruction stream would actually hurt performance.
> CISC instructions take up less space than the equivalent RISC instructions
In theory CISC instructions take less space than the equivalent RISC instructions, but x86 has lots of legacy features which makes it far less efficient than a CISC could be.
I'll generally agree, and I include myself in this industry, but we've simply have been bound by compatibility. I don't think anyone chose intentionally to keep the crap around; it was simply never worth it to pay the "break compatibility" cost, until now.
> to not address the root issues but just scaffold on top of them and try to hide the ugly bits under the carpet, I feel a bit vindicated.
There's only one area I sorta give a pass, and that's mainframes. It takes an insane amount of physical servers to replace a mainframe. Why IBM didn't invest more into making mainframes a drastically better platform for devs is beyond me. I don't know that any other server platform has ever achieved the level of uptime a mainframe has.
Still, it is no excuse to leave them with ultra legacy code that remains unmaintained for decades.
Absolutely. The industry could have moved towards safer languages, better coding methodology and formal verification years ago (see for example MISRA C as at least a partial movement in this direction). It didn't, because it was cheaper not to.
What language was a better choice than PHP in 2006? Or in 2001? Some times what we see (now) is a choice that looked like the best option (then) and only became less good over time. Humans do that pretty often?
I am no fan of PHP but it wasn't really a joke language. Its goal I think was to add some dynamic snippets to your homepage for which I guess it served its purpose pretty good. PHP even originally stood for Personal Home Page iirc. The problem seems to be that the rest of the language was built on top of that. I haven't used PHP in over a decade, so I don't know if it's still the case, but you used to start a PHP file with a PHP opening tag, which is such a weird "feature", but I guess kinda makes sense in a world where everything outside of PHP tags used to be HTML.I remember seeing PHP files that were impossible to work with: thousands of lines with HTML mixed in with PHP classes etc.
Exactly. There was even a whole domain of expertise (SRE) that exploded because of the lack of engineering rigor. That's not to say if everyone did all the right things all the time there would be NO need for SREs, but there would be fewer of us - something that I've tried to communicate to everyone I've worked for in the past ~14 years of being one.
But we had to deliver. We had to increase shareholder value.
SREs became a thing because management realized the DevOps mindset of making your programmers DBAs and sys admins wasn't really working but management were too ashamed to admit they were wrong so they invented a new term.
Any effort towards a perceived best practice or bug fix that doesn’t have a measurable impact on the business is a wasted opportunity cost. Engineers only have jobs because the software they build makes money. It’s not art work.
There quality should be there, but it should only ever be “good enough”
Just goes to show how quality never is and never was a key to success. Same with JS. That trash only became successful (widely used and popular) because it was conveniently available in the browser and hit a user need.
Your desire is not to build things on quicksand but your solution is to just throw LLMs at everything and rewrite it all? That's not the solution and causing even more rapid churn by ditching backwards compatibility is just going to exacerbate the problem.
This goes double when you add in the same non-technical-sourced pressures that caused developers to take shortcuts are still there, and now even worse with their unrealistic expectations for LLMs.
With AI you can actually start fresh, don't know if its that easy in CPU design, but you can literally rewrite something from the ground up with rust or whatever you want now, and make it reproduce the behavior of your old program
The reason PHP and other, "joke languages" are still in use is because business needs power businesses, not engineering wants. Plenty of businesses are still run on pen, paper, and custom spreadsheets because those things just work or work well enough. Could they do a better job or scale up more with a SaaS offering or two? Possibly, but why?
> PHP was a joke language from the start, we were making fun of it in the early 2000s, the fact that over 20 years later it still powers a huge chunk of the web is enough to demonstrate that we're not serious people.
Don't forget the other half of the web development stack: Javascript. The absolute worst scripting language ever desi--well no, it wasn't designed, it just kind of happened accidentally. At least PHP solved a problem of the day, Javascript was nonsense from the start, and somehow managed to become critical infrastructure.
I'm seeing this claim all over this sub-thread and I will stick up for JS here.
While yes, PHP begun as a collection of macros and was never intended to be a programming language, JS was made by someone with intention. To quote from wiki,
> [Eich] originally joined intending to put Scheme "in the browser", but his Netscape managers insisted that the language's syntax resemble that of Java. As a result, Eich devised a language that had much of the functionality of Scheme, the object-orientation of Self, and the syntax of Java.
I've seen quotes before from Eich himself I believe that he was combining these influences at the time - Scheme's closures, Self's prototypes. It didn't "just happen".
Things have moved on from PHP, but at the time, the alternatives had many more tradeoffs in a wide range of cases. Without PHP the internet would have unfolded much differently, much more slowly.
The "bandaid" mentality you decry exists of course, and is outright bad in some cases, but is just good business in many others.
Rewriting everything makes no sense. And, of course, in the vast majority of cases is never going to happen, so advocating for that is effectively advocating doing nothing at all for 90%+ of sites. A much more efficient and effective approach to using AI here would be to find and fix issues in the PHP runtime, and to assist in automating the deployment of the runtime. Time spent on this fixes thousands and millions of sites at a time, in a consistent, improvable way, rather than one at a time, in a piecemeal way.
> We're a clown industry
I think if we want to bring more engineering discipline to software development, we need sober analysis, not outraged rants.
> As someone who has been programming for about 25 years now and has always been frustrated by the tendency of software devs, and in particular web devs, to not address the root issues but just scaffold on top of them and try to hide the ugly bits under the carpet, I feel a bit vindicated.
Not sure why you would. It seems like the people who made these compromises were roughly right and the problem only escalated when it also came with a solution.
I get your drift but... This sounds a bit like advocating "why not ditch all progamming languages and build some super language that makes no exploits possible". While we are at it, ditch the Von Neumann architecture. Or saying "why not ditch all natural languages in favor of Esperanto".
No, we don't need the "perfect language". But we definitely need to switch to better methods - which were available for decades already - more quickly. There are plenty of memory-safe languages. They have been available for decades. And here we are, a huge amount of servers affected by a memory bug, in especially badly written C. There are probably many more fundamental design bugs in PHP.
Not sure if I disagree with all your points, but this one caught my attention:
> HTTP is an old and quirky protocol with a lot of surface open for attackers that are rarely useful nowadays
HTTP 1.x is that, perhaps. But I was in the trenches when HTTP/2 came out, brand new and running on binary. It was so new that there were very few implementations around, and my team had to code one. The people who worked on the spec had a lot of learning to apply from HTTP 1.1. That resulted in many nice bits in HTTP/2, but HTTP/2 also had serious issues at a spec level. Which is my way of saying that "modern" doesn't necessarily mean "bug free".
Was it software devs? I've always had the impression it was management that didn't want to give us time to address technical debt, but just focus on shipping more features.
I've certainly taken time to address tech debt whenever I could. Which was not as often as I'd like.
> the tendency of software devs, and in particular web devs
Software devs absolutely love to create a mess, and are never challenged by business, product, management, or you name it, to increase speed to market, cut down cost estimates and, to say it crudely, deliver half-assed work.
It's especially fun when not implementing the naughty bits is its own source of vulns. Your code is simpler and less prone to RCE, but your proxy mishandling or whatever allows for credential smuggling attacks, identity spoofing, request smuggling, cache poisoning, and all the normal issues at the application layer.
I hope that the current enclosure of hardware + the help of AI means that we might finally, finally have an era of optimization in which software is made to run much better on existing and older hardware. How nice it would be to have an OS and basic software that opened instantly, responded as soon as I clicked, etc.
> the effort that went into making it good should have gone into ditching PHP
What effort? PHP foundation has one employee!
> The bandaid mentality is what got us in this situation.
> We're a clown industry.
We are clown industry becauee nobody would sponsor solid research, infrastructure and fixing all those bugs! PHP is junk literslly written over nights by some volunteers!
I suspect you're being intentionally obtuse here but the PHP Foundation isn't where PHP gets written. Zend are the closest we have to the PHP company I guess, and they have approximately 100 employees, then you've got however many people are employed either as contractors or by other companies with a primary focus of working on PHP itself.
> PHP is junk literslly(sic) written over nights by some volunteers!
And yet everyone knows this, and millions of people still continue to use it and develop new software with it, to avoid learning from our mistakes. The software industry is just not interested in fixing these problems; I've heard people upset that AI is pointing out flaws, instead of being upset that flaws exist. Deeply unserious.
Yup. Another reminder of how far software engineering lags behind other engineering disciplines in rigor and accountability. The chickens are coming home to roost.
You forgot NPM. Whereby we download code from unknown authors on GitHub and run in with full access to our filesystem on our machines. No vulnerability, it's been designed like this, we even have designed scripts to autoupdate vulnerabilites, that's the proof that vulns are not common.
> We never had to do things correctly, we could flourish with abysmal levels of quality acceptance. This may not be true anymore.
Ironically, the opposite is the case with LLMs. Now those on your teams that wanted to stop the clownery will be overruled by the vast amount of bullshit code from their less skilled peers. Of course, those that care can use LLMs to faster clean up, but there's no way they are able to keep up.
Managers always favored outcome over correctness, and not giving two shits about the internals was, and will always be, incentivized.
>to not address the root issues but just scaffold on top of them and try to hide the ugly bits under the carpet
It's totally the devs fault and not the environments devs have to work in. Deadlines forced down on you until you have to make compromises, 24/7 having to compete with people who actually don't care because you have to meet months end payments somehow. Whole businesses blinded by a tech gold rush.
>We're a clown industry.
I do agree here, but that includes every non dev person.
You don't see the same problems in say, structural engineering as you do in software engineering. I suggest this is due to needing to go through the formal training required of a structural engineer, and membership bodies like chartered institutions, with standards and codes of ethics. We might want to reflect on that
The state space of what you must check to ensure correctness in physical engineering is infinitesimal compared to ensuring correctness in software. Correctness in software is qualitatively more difficult by nature and an open problem at a theoretical level.
No amount of bureaucracy and process theater gets around this fact. There is a vast and very expensive gap in software between "don't do stupid things" and "this is actually correct". The tooling to close this gap is severely deficient and not for lack of trying. In physical engineering we've had automated design checking for decades because it is a relatively trivial problem in those domains.
It would be great if compilers could generate proofs but after decades of research they can't even generate SIMD code in most contexts.
Structural engineering, is engineering (though mechanical engineers would disagree), 'software engineering' not so much. It just happens to be a word that's a useful synonym for 'building things'.
I rarely call myself an 'engineer', preferring developer or programmer.
Isn't software "engineering" or shouldn't it be considered that? Creating a new painting program might not be considered that and a software failure would have little impact, but there is a huge amount of software which is essential for the operation of complex systems. We just had large parts of the internet impacted by the PHP bug - a lot of businesses were harmed in their fundamental processes by it. Like if a roof of a warehouse had collapsed.
In Europe, a lot of supermarkets were hit by a remote exploit which allowed attackers to switch off cooling of food. A blood bank in France was attacked the same way.
So how would building software for important or even safety-relvant systems not be considered "engineering"?
Especially, as faulty software might not only cause a product or device to fail in a dangerous manner, faulty software in this day and age often makes it possibly to remotely attack the faulty product.
I agree with you but I would extend that observation to include the age of the industries. We have been making structures for thousands of years. Software is an infant compared to that.
I think that has more to do with than some unverifiable sentiment like "software people are simply inherently less serious than other engineers".
competing with others doing the same thing in a zero sum game. We all just have to simultaneously coordinate to agree not to set unrealistic expectations or deadlines! Sounds easy, right?
sorry, but you are really naive. php was peak engineering compared to the contrived layers of llm generated executable pseudocode we are about to build upon for the foreseeable future. php is opcode running in a C/C++ driven virtual machine. what llms are spitting out is statistically inspired plagiarisations void of sense that linguistically abstract non-linguistical concepts chaining all that crap then build towers of it and nobody will be able to even reason about what's going on without adding more llm to the mix. think apollo guidance computer but 1TB of code.
The amount of begging I've had to do as a Ruby on Rails dev to be given time to refactor debt was unreal. This was pre-AI, around 2018.
I basically just worked extra unpaid hours with a colleague to do it since it was frustrating.
Not even from a security standpoint as it is now, but just plain developer happiness.
But while we were cleaning the Swamps of Dagobah the other team was extending them.
Our deliverance came when the other team got woo-ed by React and started coding less in Ruby.
For my mental sanity I treat the React project as a black box.
Just heard they had to update the Redis connection configuration in 6 places, after we had switched to Sentinel based connections.
Haha, so how do I become a palace clown? Just kidding. I like and trust AI, but I don't think AI can solve the debt, because AI code creates a different type of debt than code written by humans.
The thing that pisses me off about people who complain about PHP is that all these smarty pants people have pointed out the flaws in PHP, but never really understood why it was successful, and because of that they never created a language that could succeed it. The things that made PHP successful were:
1. It just werked. You could write incredibly shitty code and it, like HTML, would work as long as there wasn't a fatal error. And sure you could just say "git gud", but that's not going to happen. People will just use the best language that works for them, and in this case, it was PHP.
2. It required very few resources to run low to medium traffic websites. Because of the Apache mod_php module, PHP sites wouldn't use any resources if they weren't being served, unlike every other language at the time. So it meant places could host thousands of websites on the same server no proble.
The guy who created PHP, Rasmus Leerdorf, never wanted and never expected that PHP would become as popular as it has. He has mentioned that he thought that at any moment, someone was going to come around and create a language that would succeed PHP. But it never happened. People are just better at pointing and complaining instead of solving the issues that people want solved.
On the RISC stuff specifically: It sounds like you're saying CISC is just RISC with a microcode translation layer. It's not wrong, but then RISC is also RISC with a microcode translation layer.
The CISC vs RISC debate hasn't been interesting in a quarter century at least. The only real difference is that the instruction decoding (which CISC and RISC both have) is likely going to need more transistors on x86 than other contemporaries.
But I'm not sure what you mean by "stop doing things like that". The ISA is "the API". Sometimes the best CPU implementation (for whatever definition of "best") will need to change the ISA-to-microcode translation.
It's not reasonable to assume that a decades old ISA will have a 1:1 instruction to microcode mapping. Hell, it's not even 1:N. Macro-op fusion makes the mapping N:M. So you could say that RISC also has variable length instructions, in a way.
And RISC-V has two sizes of instructions, with RVC. So it's not even "super transistor efficient because all instructions are 32bit".
>frustrated by the tendency of software devs, and in particular web devs
Are you sure that's not the typical cost optimisation of management/c-levels rather than a developer problem?
What you wrote reads a bit like ye olde typical "nyeeeh javascript! you're only a dev if you write everything in assembly! kids these days!"
There is no upper limit on the definition of "clown." It all depends on how much money you have to play with and how many nines you're willing to accept.
I think we need to start over with safer languages and runtimes.
That’s what I started to do 10 months ago.
You want a safer language AND transpilers from PHP, JS, Python etc. into it? So you can find issues in your original code using source maps, or just speed up your PHP by 10x and your Python by 100x? Here you go:
Are you sure you are senior? Because in my 22 years of experience in 3 countries and host of employers (banking, telco, insurance, military, municipality, energy distribution, retail etc) it was always management setting the tone and only fools ignore the hand feeding you and go against it due to some 'higher principles'.
No we don't need to have documentation and keep updating it what you can't read code? No we don't need to rewrite system that was patched ad absurdum so codebase became fragile and its hard to navigate layers of abstractions. We need to deliver this project yesterday at all costs since somebody up there slept on requirements for 6 months and didn't do their basic job, and we will never pick up half-assed pieces we were forced to deliver. No we don't need to update those 12 years old libraries, too much work and testing. I could go on and on.
It seems like you consider engineering to be delivery of perfect things, or utter failure. Thats not how things are anywhere, sw dev is more unstructured but you also don't have 5 million ways to build a good wall using every possible substance in the universe, do you.
We are not a clown industry - we are an evolved industry - both parts of that matter. We evolved in an environment where these kind of attacks were not possible or were freak, state sponsored events. Kind of like moving from a sheltered lagoon to the Pacific Ocean. And we are an industry - where profit matters. Open source was lead by people like you who cared and did not have profit to constrain them. Which is why it’s better engineered (and frankly if open source like Linux or FreeBSD had not existed in our lagoon, the profit would have failed earlier and commercial Linux would have had to been built and built to same standard (god knows how)
But we are out in the pacific now, and boats that sink make no profit, so we will evolve again, and again.
But it’s hard to blame Moana standing on a pacific island for not inventing a nuclear powered battleship.
These attacks aren’t freak, and nor did they take state money. It’s more so that security by obscurity really did work because it didn’t cost a few dollars to attack people. Now we’re having to reckon with security debt, not code debt. It’s still quite fashionable to increase code debt to buy velocity and efficiency.
So I was saying that prior to AI say 2025, complex multi layered attacks were so hard to do that the resources kept it at a low frequency. Now layering ten different vulnerabilities to capture a flag is just five prompts away. This used to be so hard it could be ignored as a “likely” security risk.
That’s changed - we are in stormier weather and need better boats, but it would have been unlikely to have built battleships to sail the lagoon just in case…
I hope some of these backdoors and/or 0-days being kept under wraps by nation states or corporate espionage companies (Pegasus et al) are being found incidentally through all this.
It’s frustrating to have all these 0days and CVEs to patch for now, but in the long run perhaps we’ll leave with more robust software.
The logical extrapolation of AI capabilities stress-testing human software is all bugs being discoverable. Hence, you have to aim for actually bug-free software.
The only way to do that is to make your code provable. That again is only realistically doable using AI.
In the process, people will have to turn the pretense of "software engineering" into reality, making the engineering part explicit.
That only works when humans actually understand what they're doing.
> "I have only proven [my code] correct, not bug free."
> -- Donald Knuth (if I recall that exact quote correctly)
Just because you have proven the correctness of your code, that does not mean that it is infallible. Especially -- as a lot of HN users point out -- there's intricate complexity that is likely to cause erroneous behavior if several interfaces/complexities get combined. And those might be caused, for example by a 'user' setting the driver to 'db.backend.sqlite' instead of 'db.backend.sqlite3'; and then you have suddenly an unexpected configuration.
Engineering is the discipline of designing and implementing solutions that achieve desired outcomes, using limited resources, while satisfying a defined set of constraints and minimum acceptable standards.
We have way more resources now to achieve way higher standards.
People complain about LLMs not respecting KISS, but fail to address why = LLMs being defensive and coding for situations that either do not happen or are unlikely to happen. That doesn't absolve you from deciding using your human brain if given change makes sense or doesn't. You can also tell LLMs to not program defensively.
Same with any other acronyms - if you don't set up guardrails on when given principle should apply you'll get code that you can only complain about.
> coding for situations that either do not happen or are unlikely to happen.
Not coding for situations that “do not happen” is exactly what creates vulnerabilities. But I also don’t think that such code is the main source of complexity in LLM-generated code.
An example to what I'm talking about: I have application that takes two inputs from request. I've put in validation on request values to deny values that are greater than 100. In my code I'm adding these values. LLM can say "cater for addition of these two numbers, because they might go over MAX_INT and result in overflow". This is a situation that won't happen. LLM can recommend - add assertions. That's unnecessary.
Arguably it’s only unnecessary when the value range is enforced by the programming language (types). The structure of who calls what in the code can change, and suddenly larger values can appear. You don’t want to have to perform whole-program analysis on every change to check whether all assumptions made in the past still hold. That’s also a source of vulnerabilities: assumptions that held when the code was written, but stopped holding sometime later.
That’s why I think code needs to document all its assumptions, and in a way that is checked by the compiler to the extent possible. If you document that the values have restricted range, then the AI should be taking it into account.
I vibe-slopped a small and local forms application for my family. I explicitly mentioned that fact to the LLM.
Yet, I removed 2/3s of the code, because it triple-checked that every file really existed and was valid, that the input form was less than a million bytes in size, that there were propper HTTP status codes for everything, that every possible error from reading data was eagerly checked and caught, and so on.
Like come on, three people will ever look at it. Iwant to keep it small and tidy!
Depends on your incentives, most people and companies are measuring Lines of codes and features as the metric so ofc it will increase it, but AI can create small KISS applications. It might have a little difficulties in doing so sometimes because it sometimes likes to overengineer things but I have to wonder how much of it is because it is RLHF'd to solve questions at any costs in terms of lines of code rather than training it in solving it in KISS principles. Also I wonder how AI will perform if we explicitly treat KISS as the only principle and have checks running on it and have it discard all the code which wouldn't follow KISS principle if it doesn't follow the principle.
Yeah, so far coding agents haven't been good at reducing entropy at a large scale. That's the area where we need to push hardest in my opinion. Writing code is cheap now, but that makes it easier than ever to inflate codebases to millions of lines of unnecessary complexity that are impossible to work with and maintain. I want to see an LLM reduce a complex multi-million line codebase to 1/10th of its size or less without breaking functionality. That would be impressive!
I may be ignorant, but what do you mean with this and why is it upvoted so much?
To me KISS is basically about how you’d write the code, the architecture, which is something that - at least currently - humans need to oversee when writing new code with LLMs.
But what does it have to do with AI discovering a ton of bugs in a lot of (open-source) software?
Software that does less is easier to understand and reason about, and typically requires less code. Less opportunity for bugs to appear.
Maybe, when they build a pomodoro timer, people will consider the possibility that the entirety of a browser engine as well as 30 000 javascript dependencies from random unvetted sources introduces unnecessary complexity and a practically infinitely fractal attack surface.
It's interesting that no-one talks about writing new systems and base languages that don't inherit anything from the current toolchain. That's the first step, then new architectures / fully open auditable hardware basis. With html you don't need any of this dependency chain. As long as you can write a browser you can be running on anything underneath.
While it's hard to point to a fully top bottom initiative to create new platforms from the ground up, the Chinese appeared to be making an effort to reduce their non-native surfaces with things like Harmony OS.
A complete plan to reduce vulnerability from untoward influences is more feasible now with agent assisted engineering. You have to be carefully selective about what matters and what doesn't, or the cost and time balloon out of control.
That's also weird, in this reality, isn't it? You've got russians, chinese, etc, supposedly antagonistic to the western cultural hegemony, but then they just rely on western technology tool-chains. If I was guiding any of these countries a close to number 1 priority, technologically speaking, would be to create a completely independent software tool-chain. And talk through adaptors.
At this point, a browser is a significant part of the way to being an OS virtualised inside the OS it's really running on. Complete with occasional leaks through the virtualisation to the real host OS/machine.
Yes, chrome for instance is more lines of code than the entirety of Linux, I think this just makes the case stronger for what I said. Although I understand why it might be so.
What do you mean with "don't inherit anything"? Using the existing binary ABI is mandatory for interoperability so yes, in that sense every new programming language inherits something. Other than that, there's plenty of languages that have fully self-contained toolchains and runtimes, e.g. Erlang and Rust come to mind. Guix bootstraps its entire environment from a minimal Lisp implementation. There's also Microsoft's CLR and its entire ecosystem of programming languages, but I don't know if the runtime exists next to the Win64 C/C++ base or on top of it.
HTML is entirely the wrong comparison as it's a document format and not a programming language, and "as long as you can write a browser" is not a simple condition. Do we have any browser (even in development) that isn't written with current toolchains? Or a headless javascript runtime perhaps?
HTML as the "transport"/"dialect" to keep compatibility with the existing computational world. What I mean is from the ground up, no C, no erlang (which Im a big fan of in terms of application organisation), no Rust, no Javascript. Start from first principles, OS'es closer to uni-kernels, sane sharing/privacy policies, ability for instance to start an "executable" (already an abstraction tied to the current mode of software production, albeit a perhaps useful one) with a narrow set of scoped access. Then it only has to implement a browser/subset of it to parse HTML and it can "access" most of the relevant parts of the existing software world (internet). Ditch anything complex, if necessary make a browser that just uses flexbox, no other things, no backwards, compatibility, if you need compatibility buy a normal laptop with a normal OS, that comes with all the cruft, but design this new one from the ground up.
But I also don't understand why (without compatibility layers) a browser should be as complex, or remotely as complex, as currently, specially with all the knowledge in hindsight.
I'm not saying this is easy, doable, or whatever, but that was what I meant.
I'm more annoyed by the fact the fixes and exploits themselves are being artificially delayed in misguided attempts to coordinate disclosure, in world where anyone can just point AI at vague direction of the bug and just find it
This is the real reason for the vulnpocalypse, not "technical debt".
NSA spent 20 years stockpiling vulns and pushing the industry towards half-assed solutions like address sanitization and pointer tagging when they could have put the industry on memory-safe languages instead.
They managed to get the IME/PSP/TrustZone into 99% of the CPUs out there by mandating it for government purchases; they could have done the same thing with memory-safe languages. But instead they chose to stockpile vulns. Hope they burn in hell for this.
Why do you think the NSA could have put the industry on memory-safe languages?
Even if they wanted to, I highly doubt they could push the industry to do that. The industry does what it wants to do, and rewriting tons of software was far from its priorities. There were no LLMs back then to help with such a massive migration.
There's also the fact that rewriting software tends to introduce a lot of new bugs.
The U.S. government could have required all new software for any government-procured system to be written memory-safe languages, thus making it ubiquitous. This could have been phased in slowly with a few years of on-ramp time to allow for industry to acquire the relevant skills.
The DoD tried that with Ada and largely failed. That was with defense contractors whose primary customer mandated it. That was despite Ada being proven to work in its first projects.
The U.S. government had pushed Ada for years and it never worked out. The government was forced to accept C++ because industry was rebelling against ADA, even though ADA was memory safe. Well, Ada did have the ability to be memory unsafe. It was much better by default.
But even in memory-safe languages, compiler bugs are still an issue. The theory is perfect but the implementation is flawed. In such case once the compiler bugs are found, the software would have to be rewritten to compile. For example an 11 year old memory bug was discovered recently in the rust compiler: https://www.penligent.ai/hackinglabs/rust-borrow-checker-bug....
Memory safe languages are not a silver bullet either.
The DoD have even created their own language: ADA. Massive contracts power, but different markets to incentivize.
The distance between the usual consumer/b2b tech startup and the kind of company that sells software to the air force is even bigger than the distance between Google and the kind of company who hires Accenture.
Sometime the profit made by the companies for inserting backdoors can be quantified:
"
In 2013, The New York Times reported that documents in their possession but never released to the public "appear to confirm" that the backdoor was real, and had been deliberately inserted by the NSA as part of its Bullrun decryption program. In December 2013, a Reuters news article alleged that in 2004, before NIST standardized Dual_EC_DRBG, NSA paid RSA Security $10 million in a secret deal to use Dual_EC_DRBG as the default in the RSA BSAFE cryptography library, which resulted in RSA Security becoming the most important distributor of the insecure algorithm.
"
People seem to be fine with it as long as their own team seems to be profiting from it - but for those of us who are not subject citizens of the NSA's government, it is a truly heinous state of affairs.
Is it forcing us to "pay off" technical debt or is it starting us on a compulsory endless treadmill of feature-neutral fix-work? Collectively, we just won't know for a while.
It totally feels like the former if you watch it find and fix vulnerabilities or other debt-tasks one after another.
But only so many of these "technical debt" issue are little off-by-one errors that get remedied by a surgically narrow patch.
Many enough require some kind of restructuring or redevelopment of their own and it's going to take time to figure out if AI faces the same dilemma as human developers: where each non-trivial change carries the risk of some new issue, ad infinitum.
If that happens to be the case, and AI isn't able to magically produce perfect software in finite time, then what's really happened is that the threat of hostile AI exploiting our technical debt will force us to always be burning and churning code just to remain a moving target.
the equilibrium state would be having found a good pattern for making patterns good. we probably aren't too far from that, so i think your worry may show up in the short term but not the long one
The original technical debt, which cannot be paid off, was the decision to use a Von Neumann architectures instead of a Harvard architectures for CPUs.
Basically, have an explicit distinction between data and code at the architectural level, to enforce "Write xor Execute" in hardware. In this way, you would prevent e.g. a buffer overflow letting an attacker injecting shellcode that gets executed later by somehow pointing at it. AFAIK the issue would still remain with some programming languages though.
and it's not sufficient anyways. even with NX you could have the attacker control a function pointer you call. in any sufficiently complex program you'll have enough widgets to build anything you want just out of data.
code and data are the same thing. whatever inputs your system receives is "code" that your application interprets, just like your application is the code that the CPU interprets. turtles all the way down.
All data is potentially code only in a Von Neumann architecture, but not in a Harvard architecture, where there's a separation of data and code with different memory access to each.
Code and data being equivalent is a consequence of Turing completeness; you can always write a Python interpreter, point it at "data" and have it execute that via interpretation.
Max AI-glazing perspective in the title, as expected. We need to fix bugs that no mere humans could successfully find and exploit. Thankfully we have AI that can fix those bugs that wouldn’t be a problem without superhuman code agents.
But there are potential upsides like the already mentioned possible nation state exploits (sleeper exploits).
I was down voted a lot months ago for saying that a lot of open source software had a false sense of being secure with the assumption that someone else would have audited the code. And this AI auditing is going to make the promise of open source software getting audited by others actually real. Nice to see others waking up to this reality.
There was always, in my mind at least, a tension with Linus's Law ("given enough eyeballs, all bugs are shallow").
It's true but the problem is assuming, just because something is open source, it has received sufficient eyeballs. AI now gives us near unlimited eyeballs so, if we survive the bumpy transition, open source should indeed become very secure compared to closed source.
We were getting routine audits from security companies as well as public universities around the world on our OSS healthcare project. I would say it did give us in some way a false sense of security as we had the belief that a lot of the major bugs were addressed. The last 6 months have been very eye opening as the slew of reports have been difficult due to how many there have been, even with all of the false positives there's been a lot of legitimate vulnerabilities. This has been taxing for us to go through (and humbling as well).
That said, if we were a closed source project, I don't know that our own tooling would have discovered all the issues using LLMs as we are seeing more and more creative ways of people exposing exploits that I never would have thought to put into the LLM prompts.
I do not have an example for this, but the most ridiculous argument for open source software (at lease for most people) has always been that if the software has a bug you could simply fix it yourself. Funny enough this has actually become kind of true with new LLMs.
Did you not fix bugs in the oss you run, pre-LLM? Or not bugs, just your own changes? Being able to just grab the source and tweak it without needing to try to RE or wait around or convince the owners/developers to do something I wanted to happen was one of the biggest selling points.
I don't agree that it was an assumption as part of open source, but that it was a possibility with open source. However, there are lots of assumptions made about computer software in general - part of the problem is having cognitive models of software that aren't necessarily reflected in how the hardware runs code.
Also, closed source software can similarly be analysed with AI, but there's no guarantee that the company involved will deal responsibly with disclosures.
I don't think they're suggesting that, rather that the "more eyeballs" quote is a bit flawed (in that not every project gets enough eyeballs). A thing can still be better then another thing and not be perfect.
The article takes PHP2Shell as the worst offender of the present wave of vulnerabilities but HTTP2Shell/Brotli2Shell was arguably worse. The consequence over at Brotli may very well be the same, but the timeline shows, if anything, that at least part of reality is actually still very much "humans just sitting on vulnerabilities for months or even years". From the timeline: 8 years in the code, 8 months unreleased (but fix in Git) and at least 4 independent researchers finding the problem and pointing it out.
Google also authored libwebp which contained the high severity buffer-overflow vulnerability used for the zero-click hack that made the Pegasus weaponized spyware famous worldwide for targeting journalists, human rights activists, etc.
ironically, AI is also making us create a new whole new level of technical debt - where _no one_ has actual understanding of the code being written and we're just trusting the machine
Indeed, and it's just going to end up as a zero-sum game where the winner is the one who can most adeptly manipulate the machine to cause harm to the other.
Is a nuclear power plant dangerous? Or an airplane? Both are examples of an advanced form of what other entities in their category do.
Of course we should proceed with even more powerful tools. We also need even stronger governance of said tools. We don't want an AI-version of the Chernobyl incident but we do want the AI-version of the benefits that nuclear power gives.
I like to think of it as a new abstraction layer on top of something we've been comfortable with for years. The developers of the past had to trust that human-readable code would compile to the machine-level bytecode they were used to write, and that even though it wasn't as efficient as they could make it, one day the benefits would outweigh the negatives. Today most developers don't understand compilers well enough to even begin questioning if the code doesn't work because the compiler has a bug or because their code has a bug. They have to trust the abstraction layer beneath their current domain, and they have to find ways to prove that their work is correct in that domain (e.g., writing a sufficient number of unit- and integration tests, compiling with different compilers to different targets, etc.).
We, too, have to adjust to this change, this new abstraction layer, because whether we like it or not, the code an LLM will produce in no more than five years will arguably be much, much better than the code any 10x developer could produce even if given months of time and an infinite supply of caffeine.
We "just" need to find a way to confirm that our work in this new abstraction layer - primarily prompt engineering - results in the code functionality that we had in mind, not necessarily the code implementation that we had in mind.
I've spend the past month-or-two on developing a platform scroller game for smartphones using nothing but AI. It has created everything given my instructions, to my liking, from the way the game is played to graphical assets to sound effects. It looks and feels like any other typical studio-developed game you could find in the store, the difference is that I didn't have a studio of professionals working fulltime for months or years with various levels of project management and what not. It's just me. Me and my agentic coding subscription.
Vibe coding originally meant giving an LLM an instruction, having it regurgitate something potentially wholesome, testing it and feeding back the errors for it to fix it. What I've done in the past couple of months is so, so much more than that. I'm a puppet master and my coding agent is my puppet. I don't need to understand the code when I can describe the problem I want solved and it will do it 100x faster than I ever could.
I didn't use code to describe this level of abstration. I used English prose - and a heck of a lot of software engineering theory, mind you. If you know the solution requires a quad-tree and binary search because in this case, that is the best option, then that's an instruction, not a block of code.
Is it a challenge to Agile methodologies? I mean is most software today designed at all? If we want a pm to be able to write half baked feature ideas and expect the devs to sort it out, rather than just paste the ticket into Claude, don't we make this chaos inevitable. Maybe there is a missing formal engineering layer missing between feature request and prompt. Llms seem to do much better when they are told exactly what to do, vs when they are given room to...express themselves
I note you're downvoted but I strongly agree. Forcing humans to speak machine language is inherently inefficient. Having them speak a language we're already comfortable with is an obvious evolution in abstraction and control. I suspect you've ruffled some feathers because speaking machine language has been a knowledge and skill gate which is rapidly becoming redundant. It doesn't feel good when one's career and skillset become much less valuable. Never-the-less, this technology is not going anywhere. Opus 5.5 already codes better than most of my developers at about 100x the speed. Architecture is still valuable, but I have no doubt that this is also going to be done better by AI soon.
Some people react to harsh realities and truth with negativity and the only the only things they have control of here on HN: a downvote. :)
I, personally, never downvote people I disagree with. Who am I if I don't use another perspective as an opportunity to learn and grow? I can tell that many people agree, too, because my "comment score" is still mostly neutral at the time of writing.
Human speech is inherently inefficient and ambiguous. Humans rely on non-verbal clues and context to distill the exact meaning of phrases, and even then the potential for miscommunication is non-negligible. It is a huge leap to assume that artificial intelligence can succeed in flawlessly divining intent from regular human speech to the point where it can generate debt-free code. And if your solution to that is to say "no, you need to issue specific instructions to guide the machine to the correct solution" then you have not removed the skill requirement, you have merely redefined the skillset.
the worst case for this is if that doesnt cause sufficient problems to force a reckoning. it has to hurt badly enough that we put significant effort into training legibility into the process.
Yup. Feels very much it's creating a mess on purpose IMHO.
It's like an over-eager junior engineer that will implement whatever pattern they read about last week. It just doesn't feel trained on high-quality enterprise, battle-hardened codebases.
Even Opus 5.5 on High thinking still littered a root directory of a JS project with source files without thinking to put it in a 'src' directory. It had to be told to use a testing framework. Had to be told to also test with Firefox (the project already had established Chrome /and/ Firefox targets).
I have to continuously burn tokens and effort correcting it.
I imagine it performs a bit better with a huge corpus of architecture and style guides. But I did expect to get some that for free with the "leading" model.
I think this is great. Reminds me of Y2K. I remember sometime around 1993 having a discussion with my boss why we store dates on our mainframe as YYMMDD instead of YYYYMMDD since we are approaching year 2000. He ignored the issue totally. I left the company but people told me later that in 1999 they suddenly started a huge effort to change the date format. Same with all the technical debt. It got ignored for a long time but finally we are forced to address it.
Having worked on both sides of the table, the reality is that it is far too easy to game certs like ISO27001. The risk calculation by companies taking that route is changing right out from under them thanks to Ai tools.
These certs only exist for compliance, not for security. Nobody cares they don't add any extra value, because they allow every business to say "my supplier was ISO certified, so I did my due diligence".
And nobody really ever gets prosecuted for lying during their audit.
It seems like you've never tried to get it. ISO27001 is a security certification. You will not pass the independent audit if you're bad at security. You will not be recertified if you're bad at security. You can say this for other, non-prescriptive certs, but not ISO27001.
I worked at a place which got ISO27001 yet had its proprietary source code available unauthenticated from an old CVS server, including over HTTP. You just needed to connect to the wifi or plug in any Ethernet cable into any device. The company just did the magic “accept the risk” and moved on. Anecdotal but I can’t help but feel it would be common for other orgs which are bad at security getting certified anyway. https://youtube.com/watch?v=9IG3zqvUqJY
> You will not pass the independent audit if you're bad at security.
I wouldn't agree with that. What I would say is that to pass the audit you must appear to be good at security. More to the point, you must appear to be doing many things that most companies don't actually want to do.
I have. What I wrote was based on personal experience working for an ISO 27001 certified company and being very involved in the (successful) audit and recertification.
> You will not pass the independent audit if you're bad at security.
Incorrect. You will pass if you have all required processes documented and have documentation that show you follow those processes. Whether you actually do follow the processes is irrelevant, the auditor just needs to think you do.
Also, you can be incredibly bad at security and still be ISO 27001 certified. For example:
Process: Describes that employees use an encrypted password vault for secret management. Keys in the vault are rotated each year and when employees leave.
Reality: Keepass database is sent through email, the password is "CompanyNameVault2023!", which is shared in the same email. Keys are never rotated because it's annoying.
This will 100% get you ISO certified, in my experience at least.
I honestly think there are some kind of laws of physics at play here... in statistical limit of the massively participatory interaction of engineers, there is some kind of least action principle in play where the system is seeking lower energy (i.e. less code complexity, better foundations, etc), but only locally. The path towards a radically better foundation for the entire industry is outside of the "energy well" that it is currently in---at least that's how I see it. I feel like that's why we see more things like elegant scripting languages rather than ground-up reimaginings of computing itself.
There is a concept of the hourglass model [0] of internet protocols, where IP sits at the waist. I believe that similar things are probably true in any "stack" based structure, such as computing, where the protocol at the waist has the most staying power (which at the current moment could be e.g. x86, or something) because it's essentially the universal translation layer that connects all the language protocols built above it and all the transport protocols below it. So, I see it as an open question as to what is the best way to affect change in a situation like. Interested in if anyone else has any thoughts along these lines.
We could rephrase it like this: “AI has removed all the excuses we had not to remove technical debt”
Yes, AI developed code might have vulnerabilities or bugs, but so already has your JSP based web server that has Oracle and God knows what else among dependencies.
> As far as anyone is aware, disaster has been averted: The hack was discovered by cybersecurity researchers who reported it to the PHP Foundation
Thanks to The Lord everytime someone discovers the vulnerability he reports it right to the owners/maintainers and there are no bad actors out there keeping it as secret and using for years.
we're seeing easier PR approvals when AI is involved. Since changing the code in the future is a lot easier.
Instead of a highly structured engineering process it's more like a gardening process of figuring out what works, what doesn't, what the Business actually wants vs what their requirements were
So more debt because there's more code but it's easier and simpler to change that debt. And in 3 years the product is EOL so shrugs
Not necessarily and most likely not. I think a lot of people's definition of "fixed" is "stop hiccuping in the previous way so that my butt is covered" and not "yes, it actually works and was given the proper time and testing to ensure that remains true."
Developers would do well to remove the word fast from their vocabulary. It has done tremendous damage to human systems (and the mental well-being of the people dependent on those systems). The whole reason the "technical debt" exists is because there's an addiction to speed. The sad part is that when you poke at that with most people, they couldn't give you a clear reason as to why they need to move fast; just that they have a sense that it's "how everyone does it."
i dislike the term "technical debt." we don't know the trade offs someone made while building a system. often times, it's too few people to do the perfect job, so we decide to do the best we can over the whole solution. for instance, we could all probably do a better job with accessibility, but often times we can't afford the time with stakeholders wanting other things. i don't see it as "debt" but more as the typical trade offs we have make when prioritizing work.
i hope we get to a place where we keep the same number of developers employed as today, but leverage ai to make all software better across the board. hopefully the people in power realize that we've been understaffed this whole time.
I sometimes hear "We have so much technical debt! We're using Mongo when we really should be using Postgres for this data structure."
Not technical debt, just a preference for doing things a different way (which admittedly might be a better way, but just because there's a better way doesn't mean the current way is bad)
What do you think the chance of nonzero budget and time being allocated for this is, given that almost no company has seen real consequences to the business?
This is the same cycle we always go through: big spending on a new wave of tech, something breaks it, and spending shifts to the ones doing the cleanup in the years after as the funding moves to the other side. Y2K created huge growth to the cleanup firms overseas. Y2K didn't break, but it had a clear macro deadline. More recently, cloud cost shock and cyber/ransomware accelerated FinOps and further grew zero-trust security industries respectively. But in the current case, we are waiting for the macro break to happen because AI-found bugs are not creating a visible deadline. And until that happens the spend at the front of the wave won't move to the other side of the wave.
This reminds me of a slightly different take. AI will allow us to deliver on promises made over the past 20 years. For instance, CI/CD is actually happening now like evangelists claimed before and it really does unlock tremendous value, mostly through efficiency.
The strain from the amount of bugs is visible in bug bounty programs. A run on many targets will turn up exploits, but if you report them on any of the platforms a majority are instantly marked duplicate. It's so overloaded that companies are shutting down their programs from the volume of reports.
Anthropic is arguing for formal verification [0]. This is an excellent idea on the edge of feasibility, but it's hard to see how this can work for the majority of software that has to adapt rapidly and are so open ended that it's difficult to even conceptualize all the input modes. It's an easy prediction that we will see verification on large trunks of fundamental software in the next few years, and a sub-verification confidence scheme for the software on top of it.
Earlier this year, the cybersecurity firm Calif offered to independently audit PHP, sponsored by OpenAI. Within two weeks, a researcher at Calif, aided by AI tools, found a way to use the out-of-memory bug to run arbitrary code on the host server, allowing a malicious actor to install malware or read critical data. Now, it was no longer a minor bug—it was a critical vulnerability, and the Calif team alerted the PHP foundation to start working on a patch immediately.
So, the headline should read,
"AI is helping us eliminate 40 years of technical debt."
Since AI found the bug, and probably also generated the patch at this point.
An abundance of solutions is a problem for people who sell solutions.
Two things are true here. Our decades of rapid-release mentality is now fuel for vulns. Those chosen mistakes we decided can live in the code have directly created holes in the Swiss cheese model. The headline eloquently stated this fact. However the scary part is the inhuman speed of chaining. This is a much bigger problem. The holes in our Swiss cheese now take hours to find instead of weeks.
What's hillarious is people vibe coding massive AI apps thinking its not creating tech debt and security holes. If anything, AI is discovering existing holes, and creating them faster than ever before in history.
All those "paying down" technical debt with AI, I would advise reading the code _very_ carefully. Sometimes the "solution" which passes some test or adheres to some described functionality is incredibly narrow / brittle, and/or has failure cases that are non-obvious.
Yes I'm using $latest_model on high, its still not there. Unless your threshold for "fixed" is "the 1M line lean proof runs, we don't know how it works", it still requires a lot of attention, hand-holding, and scrutiny, especially when fixing issues / working around failures (where it tends to shortcut or invent workarounds).
The same can be said with human-written code. LLM code is by far better than the average developer’s code at this point, and there’s not enough top percentile developers to go around, so it’s a wonderful tool.
Also, those very average developers are also the ones doing the code review.
Below-average developers generating bugs now will be submitting AI created security holes at 10x the rate going forward. Hah, people are literally on this forum debating whether to use openSSL because they can vibe-code it with a smaller surface area (just have AI only create what you need).
Anthropic is literally creating their own git alternative because they are slopping so much code. You think its 100% secure? Even if it has bugs at 10% the rate, there is 10x more of it to go around.
Do you think Anthropic's git alternative tool is more secure and better written than git? Hah, I bet it was just some vibe-coded thing they did over a couple of days, when it starts bogging down, dropping commits, or getting unstable, they just have to prompt harder! I wonder why they won't open source or release to the public, its probably too dangerous to release!
A developer on my team introduced new features behind feature flags despite concerns about whether we should have those features and how they are going to be maintained. Changes touched 200+ files which is half of the files.
Turns out nobody wants to use them, they caused many subtle bugs in existing features and is a distraction for many things we do.
The developer left the team, and I am left with purging all of this.
That's so true. Nobody gave a damn about those bugs because they were too hard to exploit, and companies had a mindset of "move fast and break things." Bugs were given low priority, and developers had no time to fix them since they were buried in higher-priority feature work as part of a cost-optimization effort. Almost all of the smart people who could actually exploit them were afraid of criminal charges. Now, lots of script kiddies are having fun with AI, and state-sponsored actors in different countries are using it to accelerate the discovery and exploitation of vulnerabilities. But instead of extending validation campaigns and allocating larger budgets for hiring and funding security audits, software vendors are mostly trying to lobby for limitations on models' capabilities and regulation of the field, like Amazon reportedly did[1], despite even OpenAI and Anthropic offering subsidized[2,3] access to their frontier cybersecurity models, which are significantly better than those malicious actors have.
[2] https://openai.com/index/coordinated-disclosure-of-critical-... - "To help more defenders use these capabilities, we’ve committed $1 billion in subsidized Daybreak access through Daybreak for Frontline Defenders, focused on organizations with limited security resources protecting essential services."
[3] https://www.anthropic.com/glasswing - "Anthropic is committing up to $100M in usage credits for Mythos Preview across these efforts, as well as $4M in direct donations to open-source security organizations."
In my opinion, the whole paradigm how we use computers needs to be replaced. It is like the 80s, but now with internet and a thread larger then anything in computer history before. I remember boot sector viruses and stuff.
My approach is https://tix.im/ - not launched yet. But from expedience: modeling everything as workflows of composeable nix flakes (expert systems from programs, skills, agents, workflows and their snippets, DBs blobs, service descriptions, ...) and then run everything in highly isolated environments. It is not only so much more efficient, reduces errors, increases quality, reduces unnecessary cognitive load, ...
I start to move more and more daily tasks into the systems. Even UI programs become interactive workflow steps, which allow me to attach from anywhere back to a task in an environment optimized for the task.
Dependency updates for example, a workflow. A subgraph from a security scanner expert checks each change in the dependency tree.
you can build workflows without agents. Giving them highly isolated environments where they can't break stuff and having human gates where it makes sense - game changer.
And you can use local LLMs - stata is awesome.
I have a strata tix flake, I start it, it registers the model locally, and it becomes useable everywhere.
I don't mean to be that guy, but your website feels inscrutable to me. I know that a lot of that might be because it's written by an LLM, but the page seems like it's full of private language and is the product of a deep context conversation with your agent that I don't have enough context to understand.
Yeah. The concept is quite large and hard to understand - beeing the inventor does not make me the best explainer of the system, and english is not my native language. People grasp it more in a personal conversation and seeing it in action.
tix.im combines conecepts of expert systems with LLMs and other AI systems. Everything is composable via nix flakes. Any change is modeled via workflows that run in isolation. Each step type, is composed from the nix flakes defined and installed in the environment. Not only the projects nix flake (devshell), but also the tix project enabled experts.
vx-maintainer is my software development expert - does only know about conecept of software development. Each workflow implemented is steps and workflows.
For example, each change lands via land-feature workflow, it has ~40 steps. Workflows have complex parameters that define the flow inside the workflow DAG. In this case, rebase is mechanical, if it fails, medium smart rebase fixer is spawned, then mechanical step checks if all commits arrive in the rebase. Then it builds a collections, spawn a review swarm, open-code-review, etc... everything is tracked in an own issue tracking system and workflows can be restarted with minimal overhead.
Then I have an optimized queue-manager, an own agent prompt with an goal that can never be fulfilled. He manages that items from the tracker get done and land, extra workflows mechanically later check the landing.
rust expert, knows about rust specifics, has snippets, agents, skills etc.
security expert has workflows with red-teaming, cyber models that get registered at the internal LLM gateway for usage, ...
I start to model everything in my daily live as an expert system now, with workflows that can be used by other expert flakes.
Workflow steps can be shared and also run wayland and x11 apps, rmux multiuser sessions etc. So, my goal is to move most of my tasks into some specialized environment.
And this is just a small part of the architecture - it is fully decentralized and user owned.
I think what's fascinating is that the mentality of "It's too painful to attack" as a security strategy isn't working anymore in the era of AI. A lot of open issues and bugs were kept because folks assumed as long as they were less vulnerable than other folks they would be fine. However I think that paradigm is being phased out since AI can take the pain of sifting through decades of old code for us to find these vulnerabilities.
I can't help but feel a lack of investment in new product and feature work.
Instead we're spending the time churning out busy work fixing bugs that were too low value to care about a year ago. We have a new street lamp so we're working on anything it illuminates.
I haven't really seen the same kind of push towards verifiable software. It's mostly around solutions that will perpetually burn tokens and justify usage of the new toys.
Mine is a cynical take for sure but I honestly really miss meaningful feature work but that's not what the market's interested in right now, I guess
I'm personally not sharing the connotations of negativity towards software development and the term technical debt. I keep reading implications that most of this has always been in some way preventable, but it really is not that simple. How did nobody find these types of exploits 40 years ago? Why are we suddenly shocked and blame the field for this? I think the majority of people severely underestimate the complexity and seriousness of software. Once that perception stops and the economic incentives are right, we can start to look closer.
Just consider how laughable some working conditions in software are and then come to realize how architecture is shaped by the organization communication patterns and not reality. You will see it in a different light then.
> Just consider how laughable some working conditions in software are and then come to realize how architecture is shaped by the organization communication patterns and not reality.
I've never considered this problem from this perspective, but damn, I think you're dead on.
Time and desire are derivatives of money. Skill, too, largely, though less directly.
Should be something like:
> nobody is paying to find and fix
AI lowers the cost, but certainly doesn't eliminate it. I think we can hope significantly more technical debt will be paid off, but don't expect too much.
> As far as anyone is aware, disaster has been averted: The hack was discovered by cybersecurity researchers who reported it to the PHP Foundation, and a patch was released before any bad actors got their hands on the exploit.
Aren't there still vulnerable services right now being hacked?
Yeah... sorry but that's not a technical problem, that's a business problem.
Everybody wants a $1 Website, avoid security updates, pay nothing for maintenance, and done yesterday.
It has nothing to do with AI or a specific language or stack. As long as cost cutting will be the culture, driven by the economical model of competition, then we will accumulate technical debt BECAUSE it is the strategy.
And that's the biggest win with AI. With old-fashioned development, it was considered acceptable to defer addressing valid feedback ad infinitum, hiding behind whatever lousy excuse you could come up with. No more.
Yep, the takeaway from this should be that we move to leaner applications that can be actually be formally verified. But what I imagine will actually happen is that we'll patch over these vulns with AI that produces 10x the amount of code, just for the next generation of AI to find vulns in that so we can patch that with more code, repeat ad infinitum.
For my part, I have my pet neglects based on observing the parade of hacks: private companies neglecting to fund open source projects upon which they rely; private companies neglecting to fund product security staffing and remediation sufficiently.
You're joking right? I work on a place public software product and over its ~15 year life we've gotten over half of validated vulnerability reports that we have ever had on it within the last year. We basically had to stop feature development for 6 months to burn that down, even with AI providing correct fixes for 80% of the vulnerabilities that were reported.
The amount of e-mails I get of the form "Important information regarding your xxxxx account" (which essentially is just code for "we've been hacked and your data has been stolen") is quite concerning, but not surprising. Security by obscurity was always big in most companies, as long as the bar to carrying out sophisticated attacks was putting a costly IT professional to the task you could be relatively relaxed as no one would bother to hack your stupid little e-shop, but now carrying out such an attack costs a few cents to a few dollars at most, that changes the game entirely and everyone is a target.
This summer I had my Docker registry poisoned with malware artefacts, which again is something that no sane attacker would do before as it required downloading my images, carefully modifying them and then overwriting them, ensuring they work as before. Now it's just a simple prompt away. I am definitely ramping up my defenses, everything that doesn't need to be Internet connected goes behind double VPN and port knocking schemes, essentially making my infrastructure invisible from the outside, all unknown packet types get hard dropped, end-to-end encryption of all internal traffic, web endpoints behind CDN proxies and WAF providers (as much as I hate doing that), double and tripe security mechanisms everywhere, maximum restriction of privileges, ultrafast automated patching and AI based continuous monitoring, audits and interventions. You should also get used to that, this will surely still get much worse as attacker tooling gets better.
I'm not going to lie, I'm having a great time thinking at the endless discussions around unsafe languages and the relentless smugness of many practitioners claiming everything was fine as long as the responsible and the skilled (them) were in charge; and let's not forget the formulaic "with great power comes great responsibility" closers.
Well now, Great Responsibles, it's clear you too were out of your collective depth and were all paying for your smug hubris. Perhaps take a bite out of that humble pie you've obviously never tasted?
Maybe now developers will stop fighting tooth and nail to not update libraries and programming language runtimes and so on.
At my current day job, if I mention “hey, how about you update PHP to at least a supported version” people start whining about how that takes a lot of time and if really anyone would try to attack our public facing services written in… PHP.
Next time we get hit I can sit back, eat some popcorn and say “told ya’”.
These threads with doom and gloom about the modern internet seem full of people who either never experienced or forgot what it was like at the beginning of the century. Back when the internet was fair game to anyone who kinda understood it.
Back then, you could log in as admin to any phpBB forum by copying a generic admin cookie from a shady web site. You could often then also compromise the hosting company that was running the forum, because nothing was really separated.
You would try to trick your friends into installing Sub7 so you could open their CD drive.
You could easily capture other people's data on public wifi networks in restaurants and hotels.
You could change the price of the pizza you were ordering through devtools in your browser.
You could infect half the world by emailing a picture of a blonde tennis player.
Sure, there have been quite a lot of pretty serious zero days recently. But many of them have been pretty hard to actually abuse, in part thanks to all these layers we've added over time. So I guess I'm not as pessimistic as many of you are. Especially because we all seem to be incredibly aware of what's happening and are acting on it.
It also inflated almost all of that debt away, though. So in a way people who built "just ship it" buggy things in the last few years, made the right bet.
I think we'll look back at this moment as peak C/C++ before they begin a long, slow decline into irrelevance.
I've been bullish on Rust for years because memory safety is simply too important and Rust can essentially prove an implementation correct and solve a certain class of very important bugs. It doesn't solve every problem and there is a complexity cost.
I've also said that writing multithreaded code is simply too complex. In an era of out-of-order execution, different levels of caching, asymmetric cores, hyperthreading (although this is largely dead now?), branch prediction and having to support multiple architectures it's simply too hard for most people to write correct multithreaded code. Period. If you find yourself as a non-library developer creating a mutex or spawning a thread, somebody has screwed up.
This is also why I think the single-threaded async/await model with post-request teardown of PHP is the correct choice for most people.
We're going to go through a dark period of a lot of 0days. As the article notes, this is paying 40 years of technical debt. It will result in a more secure ecosystem however. I believe this will ultimately also hamper black markets, governments and 3 letter agencies who trade in those 0days.
As painful as this all is, it will ultimately be a good thing, one of the few to come out of AI (IMHO).
> PHP, which originally stood for “personal home page,” is a programming language created back in 1994 and largely used by legacy sites.
Wow. Love it or hate it, but tell me you have no idea what PHP's place in the web ecosystem is without telling me you have no idea what PHP's place in the web ecosystem is.
As someone who has been programming for about 25 years now and has always been frustrated by the tendency of software devs, and in particular web devs, to not address the root issues but just scaffold on top of them and try to hide the ugly bits under the carpet, I feel a bit vindicated.
Everybody in the industry knows that we've been building on quicksand. Moore's law meant that we could just sacrifice performance and add a dozen layer on top of technology from the 90s (if not older) and keep the thing chugging along.
Look at the PHP situation:
- HTTP is an old and quirky protocol with a lot of surface open for attackers that are rarely useful nowadays and might be better left off to higher layers. But of course, we can't break compat, so everybody still implements all the naughty parts, just in case.
- PHP was a joke language from the start, we were making fun of it in the early 2000s, the fact that over 20 years later it still powers a huge chunk of the web is enough to demonstrate that we're not serious people. Cue the PHP fans telling me that "it's good now". Maybe, I don't really care, the effort that went into making it good should have gone into ditching PHP for a better language 20 years ago. The bandaid mentality is what got us in this situation.
- And of course to add insult to injury, PHP, this security-critical language, is still implemented in garbo C using things like setjmp/longjmp. Just to make sure to absolutely maximize the damage if a vuln is discovered, I suppose. Brilliant.
- Oh and all of this is still running overwhelmingly on top of x86 which is its own bag of legacy garbage. "No but you don't get it, modern CPUs are really more like RISC CPUs, the RISC ISA is translated internally" yeah exactly that's my point let's stop doing things like that.
We're a clown industry. We only made it this far because, usually, buggy code doesn't kill people and we can iterate and patch things quickly. We never had to do things correctly, we could flourish with abysmal levels of quality acceptance. This may not be true anymore.
Of course the reason things are done this way is generally to maintain backward compatibility and make transition easier. At least now that we have LLMs this excuse will hopefully vanish: porting even huge codebases to a new language/framework, something that was a tremendous undertaking mere months ago, is now vastly easier and faster. We can leave the 1990s behind us.
> We're a clown industry. We only made it this far because, usually, buggy code doesn't kill people and we can iterate and patch things quickly
I think you have things backwards. Devs aren't clowns who make it this far. But in industries where buggy code doesn't kill people, devs are expected to ship fast and iterate, because they can and more importantly, it serves the business.
Personally, I'm all about good software engineering principles, unfortunately I don't think you can last long in most companies if you're too opinionated about this and can't compromise (and it's getting even worse with AI, reading the code is no longer a requirement, go explain your teammate that there's an abstraction leak in their code...).
Yes... there are statisticians on my team, for example. They're capable, thoughtful individuals however have little exposure to the oblique and (outwardly) contradictory ways in which production software fails.
But explaining that openly, as is your duty, means surfacing something which could be read as 'bad work' by a non-technical manager unable to grasp the complexity. So in low-trust teams it very quickly becomes a game of brinkmanship, or a prisoner's dilemma for technical diligence
I am currently in a stalemate where I have written a proposal that is very technical. The only “business” outcome is that we clean up a massive security mess and rebase on a new consistent architecture.
My manager can’t understand the RFC, and knows that clean up projects aren’t palatable to his senior eng leadership so he keeps asking me to simplify or derive some business justification. I’ve proposed superficial ones like improving security posture etc but he wants a hard number that can be measured (yet another senior leadership mandate).
I’m kind of exasperated and honestly think it’s his job to figure this out.
Write them if they do not mandate basic security right their brandy or vodkas or whatever will be served with opposite temperature they expect...
You've uncovered the kernel of the software industry- if it works well enough, don't touch it. This is why legacy software hangs around for longer than it should.
My feeling is it needs to be communicated non-technically, execs need to think 'what goes wrong if we dont do this', 'how much does it cost'.
THIS is your answer, leoqa. The business value is the $$ the company can lose if it goes wrong.
If higher-ups have no technical insight, round up and give them two numbers: $$ if a bad thing happens, and $$$$$ if the worst thing happens.
The problem is the "interface" of software engineering being oblique to outsiders. It's alchemy in essence.
The logical extrapolation of AI capabilities stress-testing human software is all bugs being discoverable. Hence, you have to aim for actually bug-free software.
The only way to do that is to make your code provable. That again is only realistically doable using AI.
In the process, people will have to turn the current mere pretense of software engineering into reality, making the engineering part explicit.
That in turn only works when humans actually understand what they're doing and can communicate it to outsiders.
This is why open source eventually wins out, it doenst have this pressure.
Thank you! I entered the industry a lot more meticulous, test driven development, integration tests, end-to-end.
But shipping faster was pushed at almost every company until, if it's not revenue generating, stop putting resources into it. Not all are like this but it's not all or nothing, it's always a sliding scale how much you can put into making the software correct.
I'm a software artisan deep down but I could never justify putting too much time into making the stuff I used to build "clean and fully maintainable". I tried, but eventually I realized that if I didn't get things out of the door, my company would start losing money and I'd lose my job. Who cares about perfect software in a bankruptcy auction?
There are things you buy out there that don't need Swiss quality because most people will simply not need the quality or won't have the money to pay for it.
I think the biggest problem isn't that a random webpage is sloppy, but when a critical system that could kill people is built the same way as the random webpage.
I hear you, but humans are incredibly bad at context switching like that.
Near the point where things become minorly safety critical, people will blur the line. The point where safety kicks in moves a little further out, and we start blurring the lines again.
There’s a reason the FAA is anal-retentive about things with only very minor safety implications, like the in-flight entertainment system or turning on airplane mode. It helps prevent complacency where it actually really does matter.
You either do it the right way 100% of the time, or I’m not taking bets that you’ll do it right on a particular occasion.
> eventually I realized that if I didn't get things out of the door, my company would start losing money and I'd lose my job.
This is like 90% because most tech is different enough that civil torts don’t exist for them yet, so they don’t have to care.
Eg if Google deletes all your photos they kind of just shrug and you’re out of luck. If I deposited photos at a bank who burned them without notice or approval, they’re on the hook for that.
The law will eventually catch up and acknowledge that bits can have value. Then everyone will have to care again.
You are describing my field - Systems Engineering.
We track EVERY requirement to ensure it is met. Maybe it's a safety issue; maybe it's landscaping approvals (I work in Rail). Regardless, it's bigger $ if not caught up front, and if you start grading requirements on perceived risk, you start the slippery slope to not caring. Example: mark all landscaping requirements as "Not Critical". Then scheduled clearing of the right-of-way is missed. Then pedestrians are at risk with blocked line-of-sight, and trees might drop across the rail.
So what I'm hearing is that software quality will not improve without government regulation.
I can't say I disagree. How it is with engineers they get certified as PEs due to the responsibility they have. In my mind it be similar, you don't need everyone engineer certified, but if you over X revenue or employees side it should apply, and be required to have Y numbers of certified based on company size. Then the companies like with their lawyers, will have to figure out how to follow the regulations and push forward.
I think this is good thinking. I work for a state agency that deals with construction codes and licensing of building contractors, electricians, etc. If the safety of the web is in such a critical state of vulnerability as to potentially impact what the article author terms "normal" non-tech people, maybe there should be some certification that is government-regulated like you suggest. Or maybe that'll happen after real (not potential) devastation occurs - that's how building codes came around.
"Forgive yourself for not knowing earlier what only Time could teach" This quote holds for both individuals and groups alike.
If only it were that simple!
Look at the solo projects from professional devs with nobody overseeing them. Look at what so many of your colleagues submit despite the frustration of your thoughtful team lead and manager. Look at what your so many of your team leads asks for even when they've been granted full discretion. Some select few are great, but most are disturbing if you have any sense of quality or preparedness yourself.
Even for decades before AI, there was lazy naive misguided slop everywhere. During the social coding era of the last 15 years this even amplified itself, streamers and influencers and conference presenters -- professional developers themselves -- would share horrid practices to wide applause. Moving fast and breaking things was what developers were excited about. Rigor was dead. Correctness was a problem for later. Code was presumed best written by a rando on github who'd accumulated a lot of stars rather than by a known responsible hand. Security was a copy and paste job from Stack Overflow, not something to be comprehended and considered.
If only it were a top down problem from outsiders!
But the truth is that the call has been coming from inside the house all along, and the outsiders giving direction have had no problem finding celebrated industry "experts" and "thought leaders" affirming and encouraging all the clowning they could imagine.
Developers could always move fast and do things right but most just didn't have any interest in learning how, and many of those who might have just gave up on bothering.
Thanks for the counterpoint. It's true that being sloppy and taking shortcuts isn't always a calculated business decision and it can be a lack of skills.
Shipping bad software does not serve the business indefinitely. Application/product security was expensive relative to its perceived value, so it was underfunded nearly everywhere.
2026 is saying "here is the consequence."
Completely agree, but the problem is that the execs don’t understand that. People at the leadership level don’t truly understand or prioritize technical debt. Paying down the debt can be really hard to sell to leadership.
Not sure they don't understand. They're operating in a system where they'd be replaced if they decided to repay all the technical debt.
I agree... many people seem very purist. But I think it depends on what you're doing. Some things make sense to do fast and cheap. I work helping fundraising, and it's often better to have 95% solution that is delivered on time than a 100% solution that comes out after the campaign has ended for example. Management should warn us ahead of time and give us the time and the space to do it right, sure, but how often is that reality? As long as it's a conscious trade off I think it's fine.
This - 100%.
Just take a look at some of the opensource academic, infrastructure or "passion-projects", where there is no management pressures to "move fast & break-things" and ship-ship-ship. They tend to be very stable, very predictable - and very high quality.
Care to name any?
I've seen software that academics write. It's no better than average. It's often cut-and-paste code, or these days AI slop. Software is a means to an end in academia, rarely a product in itself.
Anki
TeX
You are assuming that garbage code makes us more productive.
That might be true on the margin, but highly doubt it was ever true once you escape a very shitty local optimum.
you mean industries where software can kill people like pacemakers?
https://ijcionline.com/paper/13/13224ijci12.pdf
Wow, it’s almost like it’s really hard to get everything perfectly right and this is endemic to software, particularly when the language accepts incorrect code.
The only two things we know mitigate this are proofs (eg rust borrow checker, lean, etc) and DST which is basically the equivalent of accelerated time testing which is done in other industries too. Most people don’t even bother with property testing
> Devs aren't clowns who make it this far.
simias referred to the industry and you took it personally.
Why is it whenever someone mentions the shortcomings of software industry, there is always a comment saying "no no no, developers were just following orders!"
Because by that rationale all industries are circuses filled with clowns. It's incentives not ineptitude. It's a clumsy take.
> “always been frustrated by the tendency of software devs, and in particular web devs”
Sounds like they’re talking about devs
He spoke of a clown industry. That means the industry as a whole. That includes, but by far isn't limited to, the devs. Which of course have to operate in an environment, most of them set by their employers. And of course, responsibility scales with the position in the hierarchy. So yes, to a large part it is the management setting deadlines, budgets, staffing and planning allowing for technical soundness and of course safety and security.
But also every developer has a responsibility. At least not to promote any technology which is part of the problem.
> But also every developer has a responsibility. At least not to promote any technology which is part of the problem.
Yeah, but money.
Don't all industries work this way? Construction has "old work" and "new work" versions of many parts. For instance, replacing windows on a finished house is a different job from installing windows on a house that's still under construction, so they build "replacement windows" and "new windows." We don't demolish functional homes unless they are unsalvageable; we cut into drywall and patch over the hole. The drywall would look bad if you looked at the backside of it, but the homeowners can't see the inside of the drywall and don't care.
It's coordination problems and large scale distributed action, not some moral character of how serious the people are. Effort is not fungible. To make php good, you only have to act at one point, in a localized way, at the php foundation. To ditch php, you have to act in a coordinated way across any resource strapped companies and individuals. Just see how hard it was to ditch Python 2 or how ipv4 is still not ditched.
Trying to understand underlying reasons and incentive structures is much more productive and useful than simply venting about the worse moral character and seriousness of people in one industry vs the next. Curiously, the grass seems always greener - when you ask people in other industries, you'll often hear endless complaints about the state of things there too.
There's a PHP implementation written in Rust.
This is incredibly interesting. Thanks for mentioning it. Unfortunately it’s not yet ready:
https://phprust.com/status/
I’ll keep checking
It runs everything that any software I've ever written needs - and I've been doing PHP since dates began with `19`.
But since php isn’t complied, how would I know if something is broken until every code path is exercised? Genuine question
You exercise every code path with a unit or integration test.
I tend to write integration tests for the paths users take through the application (website), and fill in the holes with unit tests. I'll also write unit tests for methods that change often or are critical, such as business logic.
Fully agree.
> We're a clown industry. We only made it this far because, usually, buggy code doesn't kill people and we can iterate and patch things quickly. We never had to do things correctly, we could flourish with abysmal levels of quality acceptance.
What industry do you think is different?
I've had a decent amount of construction work done on my house, and if I had a pound for every shortcut that the guys doing the work took, it would pay for the work they did. And these are the _good_ ones. The bad ones don't even bother following the legal requirements. Somewhat recently [0] it was found that less than half of healthcare workers followed recommendations on _hand washing_.
[0] https://www.cambridge.org/core/journals/infection-control-an...
Residential construction isn’t much better. But the people who build the really tall stuff, the structures that would kill people if they collapse, that’s real engineering. The odd bridge that collapses is usually a political problem (lack of funds for maintenance).
Have you heard of 432 Park Avenue?
I use to joke about PHP in the early 2000s, but now that I see the "better languages", I am starting to like PHP.
If you want a web page that works with a database (aka. CRUD), presents it in HTML form, and with a bit of business logic, like 90% of websites, then PHP does it simply. None of these astronautic patterns like you see in Spring, the dependency hell that comes with node, or whatever the cool kids are using right now. There is a reason PHP became so successful despite the hate it gets.
PHP is not great for security, it was terrible when it started, but now it is decent. And sure, a vulnerability was found, it is now fixed, every time a vulnerability is found and fixed, PHP becomes better. New technology may have an advantage due to better design, safer languages, etc... but you shouldn't dismiss the qualities that 20 years of bugfixes get you.
As for x86, yep, it is legacy, but it is not completely stupid either. The "RISC core" is not right, it is not like x86 become ARM or RISC V code internally. It is translated into long microcode-style instructions that wouldn't make sense as an ISA, where a compact representation is important for memory/cache reasons. RISC code is also translated just like x86 code, and the advantage of CISC vs RISC has gone back and forth. Now it seems we are going back towards RISC again, but before that, it was CISC, and before that, RISC again. The quirk about x86 that complicates things seems to be the variable length instructions. But the real problem is not really about which ISA is the best (it is a very small part of modern CPUs), it is more about licensing and backwards compatibility.
Yeah PHP was the first time web applications really "clicked" for me because there were not a hundred layers of abstractions between the html page and the application code. I was new to programming, and I took a look at J2EE and its literal million lines of code pet store that was supposed to be the shining example of how to do J2EE right, and I was like wtf is all of this... PHP though it was so easy to just make a page that gets some stuff from a DB, does some stuff with it, and outputs the result. I didn't need to read a 500 page book to get started with it.
In the end, PHP wasn't great, but around 2000 it was a great intro to building things on the web.
PHP's other advantage is deployment: it's simple. In the 2000's, I used to work at an enterprise Java shop but also did PHP freelance work. The amount of bullshit you had to go through to deploy a Java app on JBoss was insane.
I have a soft spot for PHP but these days I would reach for https://pocketbase.io/ by default for a crud app. It’s really great. :)
> PHP was a joke language from the start.... Cue the PHP fans telling me that "it's good now".
First, I am not a PHP fan, but I will absolutely stick up for the "its good now".
Yes, absolutely no debate the old PHP 4.x/5.x was shocking. However to give PHP their due, they absolutely did make serious efforts in 7.x/8.x. They deserve due recognition for that.
Unfortunately lots of people – I'm guessing you're one of them – still have battle-scars from 4.x/5.x and they think (incorrectly) that 7.x/8.x is "more of the same".
Second "joke language", well, cast your mind back to what else was available at the time... ColdFusion, CGI, ASPX ... it was not exactly a beautiful world back then.
Sure, to borrow your terminology, the Java fans will be along soon to tell us all how awesome Java is for the web. But many of us still bear battle-scars of the horrors of Java stacktraces, messing around with incomprehensible XML config files, Java's penchant for eating RAM for breakfast, and generally trying to figure out why the hell Tomcat is not working (again !).
> ColdFusion, CGI, ASPX ... it was not exactly a beautiful world back then.
You’re missing the point. Those are all dead. The implication is that PHP should have had the fate.
> ColdFusion, CGI, ASPX ... it was not exactly a beautiful world back then.
Pffft. VRML is the whole game, baby! Once everyone runs out and gets an SGI oxygen, Nobody is going to use freaking web browsers ever again. I mean, HTML, what a joke.
Also, ASPX (so ASP.Net) was a vastly superior technology to PHP. It was my first love, and I ditched it for Ruby on Rails, but ASP.Net was really good. Especially when you ran it on Linux using Mono.
The previous post probably should have said classic ASP, not ASPX.
Classic ASP was the more direct competitor to PHP, while ASP.net came along later, as part of a next generation of web server languages/frameworks/platforms.
I remember VRML being a possible PhD topic for me in 1997, I think that was about the last I heard of it!
The other option I was actually offered was in machine learning and categorisation, but I avoid it as it was obviously a dead end lol.
I remember when that exact line of argument was made about '3/4 was silly, but they're putting a real effort into 5'
Also "3 was silly, they got 4 done right".
Although that was more connected to the performance improvements through Zend Engine than language sanity or robustness, at the time.
Wait a second, in very recent years the major Java projects I touched were still messing around with incomprehensible XML config files. Has that actually changed in some part of the industry?
Yes, when I started getting into Spring(Boot?) in 2013-14 I was complaining about the annotation magic that you needed to sprinkle around the code, so that you could have a Java project take a long time to start up and fall over. The response at the time was that it was so much better than the old XML way that you "had" to do. So that kind of XML hasn't been needed for 10+ years.
Unless you count the XML dependency management with Maven, which isn't too bad.
You can use annotations to get rid of a lot of XML in server side Java. See Spring Boot for example.
> Has that actually changed in some part of the industry?
I suspect the only thing that's changed is that Oracle now charge you for the pleasure. ;)
More seriously though, its been a long time since I've touched Java, but I suspect the only thing that's changed is that its all hidden in magical kubernetes containers these days.
Not sure if you know what you are talking about? Most users of Java don't pay anything to Oracle. Many things have changed in the Java world. Kubernetes doesn't have any special relation to Java.
> Not sure if you know what you are talking about? Most users of Java don't pay anything to Oracle.
Congratulations Java Fan on missing BOTH the smily-face at the end of the first phrase AND the "More seriously though" at the start of the second.
I'm glad someone still loves Java though. ;)
P.S. The kubernetes reference was – since that one appears to have gone over the top of your head too – that in todays world Kubernetes is extraordinarily popular and therefore it is likely most people now hide the complexities of Java deployment into a container that is magically generated and deployed through CI/CD. Hence I was inferring that life is probably "easier" today with Java because you just deploy the magical container.
CVE-2026-109618 is evidence that it is absolutely not "good now". To make a pro-PHP argument the week that PHP's shortcomings just cost half the internet millions of dollars of lost time panic-patching an RCE is... an interesting choice.
>CVE-2026-109618 is evidence that it is absolutely not "good now"
That's a C language error, not a PHP language error. I don't see that CVE as particularly different from when they showed python's dictionaries could be attacked using dictionary hash-collision (something that also affected PHP). It's worse in being remotely executable, rather than merely a denial of service, but it's ultimately a facet of the C implementation rather than something wrong with the language itself. CVEs, even remote ones, will happen. Even java had its logging execution attack.
I've made fun of plenty of things in PHP over time, but the language hit the mark it was aiming for initially. It was easy. A 12 year old could sit down and write an ugly little forum and it would work. Because it was easy for amateurs, a lot of amateurs wrote in it, and there's a ton of clumsy code out there. Because it was easy to setup and run with minimal setup, popular packages were very popular. Wordpress vulnerabilities matter because it was very easy for programming chop shops to hack out tons of websites for all the millions of little businesses out there that didn't often follow up on patching etc once that was done. PHP was bad largely for the same reason BASIC was bad. It was easy.
PHP being easy gives it a huge blast radius for anything that goes wrong with its implementation or popular frameworks and libraries.
No fan of php either but that bug was in C code.
I have actually gotten a tremendous amount of value from PHP and WordPress: the via negativa! They showed me, in remarkable detail, how things should not be designed.
(I'm not kidding. If you take each element of their designs and invert it, you end up with a very solid design.)
On that note, I misspoke somewhat: I assert that PHP and JavaScript were not "badly designed", because that would imply that someone sat down, carefully considered how the different parts of the system interact, second order consequences etc. — and then somehow came to all the incorrect decisions. Rather, it's quite clear a serious design process has simply not occurred to begin with.
Once I recognized this phenomenon, I began to see it in all areas of life. Things are much worse than they could be, simply because nobody has designed them to be good. They just ended up the way they are now, by accident of history.
--
Polemic aside, I am fond of JS and PHP in many respects. I just think we should clean them up! "This mess has always been here, so it's too late to clean it now" would be laughed at in any other context.
We already broke compat with "use strict". Now we just need a "use sane" :)
>We're a clown industry. We only made it this far because, usually, buggy code doesn't kill people
Another industry does even better: the medical/health industry. It's both a clown industry AND kills people AND they have made it way beyond what software can only dream.
Having 25+ years experience straddling both disciplines, i.e. in both CS (Dev) and Medicine (as a licensed provider) -- and who currently works in frontier drug discovery, can wholeheartedly confirm both industries are a joke.
The big fun factor is the place in the Venn diagram where they both intersect. I used to work for a medical device manufacturer who's biggest and most popular product routinely had stack traces at inopportune times.
Oh I assure you, all industries are clown-driven, clown-built, and clown-maintained. Nobody has time to do things according to a retrospective analysis of "best" which will just be re-evaluated next generation. We build with what we have and fix when we must.
It's simply not realistic to expect the entire world rewrite its entire technology stack from scratch, starting at the transistor level on up every time there's a new industry innovation in security or performance.
LLMs might make this somewhat easier, but you're still going to have to deal with backwards compatibility and legacy systems. Completely eliminating the use of architectural cornerstones like x86 or HTTP or even PHP across the entire industry isn't going to happen anytime soon, let alone overnight, especially if the only argument for doing so is "we could design this better if we implemented it from scratch".
Another thing that has bothered me for a long time: we have far too many data isolation mechanisms, each with their own idiosyncrasies and trying to cover up for each other's gaps. Very very roughly, from source code up:
- Variable naming conventions (_field in Python).
- Lexical scopes.
- Visibility annotations (public, private, protected).
- Coroutines, threads.
- Packages/modules.
- Sandboxes.
- Processes.
- OS capabilities (pledge/unveil, SELinux, etc).
- Local user accounts.
- File permissions.
- Containers/chroot.
- User mode vs kernel (Ring 0 vs ring 3).
- Virtual machines.
- Cryptographic measures (secureboot, attestation, memory encryption, etc).
On the other hand we have few mechanisms to share data: the filesystem, clipboard, sockets, maybe dbus. Shared memory if you're feeling brave.
If a script wants to know what file is currently open on my editor or what email attachments I recently uploaded, the editor or email client has to explicitly implement this feature via one of those limited mechanisms. Almost nobody does this, so we're stuck with black box applications that are hostile to customization.
You have a point that there are a lot of separation mechanisms and that, if things were designed better, fewer would be needed but by the same argument it also seems unwise to increase the number of mechanisms to share data. Sockets by themselves are quite big enough on their own to quite literally drive the whole internet through.
A socket is just a raw byte stream. It's a solid base layer, but you'll have to implement your own communication protocol on top, and it'll require copying the data from one process to another. A "stream" is the wrong metaphor for local data sharing.
The data is already in memory and the source program knows its "shape"; there should be an easy mechanism to provide access to that by default, like /proc or gdb but for arbitrary data structures and with better UI.
Non-technical managers don't want to wait for the 'nerds' to 'do it right' because that takes a long time and the nerds don't agree on how best to solve the problem because most capable nerds (who sort of know what they are doing) are working on lower-level problems and making the big bucks (they are not running WordPress for the local News Paper).
So that leaves non-technical managers telling non-technical nerds to just install WordPress. Then, AI comes along and wipes them out. And everyone is like... how did this happen?
It's pretty obvious.
And, we know how to write code properly if that's what is required. There are methodologies from avionics and other critical code where every line of code has an audit trail back to a requirement. Where malloc is disallowed. If you want to compare it to other engineering, there are skyscrapers and there are doghouses. Most software is doghouses.
>Non-technical managers don't want to wait for the 'nerds' to 'do it right' because that takes a long time and the nerds don't agree on how best to solve the problem because most capable nerds (who sort of know what they are doing) are working on lower-level problems and making the big bucks (they are not running WordPress for the local News Paper).
>So that leaves non-technical managers telling non-technical nerds to just install WordPress.
Good summary of how the world operates generally everywhere. It's a clown world.
FYI For all your smurky jabs at human's coding abilities, AI would not know how to program or even exist if weren't for humans.
> Oh and all of this is still running overwhelmingly on top of x86 which is its own bag of legacy garbage. "No but you don't get it, modern CPUs are really more like RISC CPUs, the RISC ISA is translated internally" yeah exactly that's my point let's stop doing things like that.
The interesting thing is that memory bandwidth has become a big issue. CISC instructions take up less space than the equivalent RISC instructions, so you can effectively get more instructions per cache line. Effectively the CISC to RISC conversion acts as a type of decompression. Because if that, stopping the CISC messiness without moving to a compressed instruction stream would actually hurt performance.
> CISC instructions take up less space than the equivalent RISC instructions
In theory CISC instructions take less space than the equivalent RISC instructions, but x86 has lots of legacy features which makes it far less efficient than a CISC could be.
> We're a clown industry.
I'll generally agree, and I include myself in this industry, but we've simply have been bound by compatibility. I don't think anyone chose intentionally to keep the crap around; it was simply never worth it to pay the "break compatibility" cost, until now.
> to not address the root issues but just scaffold on top of them and try to hide the ugly bits under the carpet, I feel a bit vindicated.
There's only one area I sorta give a pass, and that's mainframes. It takes an insane amount of physical servers to replace a mainframe. Why IBM didn't invest more into making mainframes a drastically better platform for devs is beyond me. I don't know that any other server platform has ever achieved the level of uptime a mainframe has.
Still, it is no excuse to leave them with ultra legacy code that remains unmaintained for decades.
...because Mainframes were not thought for Devs & Tech People, but Business and Compliance Clowns enabled to do some stuff without CS degrees :-D
> we're not serious people
Absolutely. The industry could have moved towards safer languages, better coding methodology and formal verification years ago (see for example MISRA C as at least a partial movement in this direction). It didn't, because it was cheaper not to.
What language was a better choice than PHP in 2006? Or in 2001? Some times what we see (now) is a choice that looked like the best option (then) and only became less good over time. Humans do that pretty often?
Maybe he was a fan of cold fusion?
> PHP was a joke language from the start
I am no fan of PHP but it wasn't really a joke language. Its goal I think was to add some dynamic snippets to your homepage for which I guess it served its purpose pretty good. PHP even originally stood for Personal Home Page iirc. The problem seems to be that the rest of the language was built on top of that. I haven't used PHP in over a decade, so I don't know if it's still the case, but you used to start a PHP file with a PHP opening tag, which is such a weird "feature", but I guess kinda makes sense in a world where everything outside of PHP tags used to be HTML.I remember seeing PHP files that were impossible to work with: thousands of lines with HTML mixed in with PHP classes etc.
(SRE here)
Exactly. There was even a whole domain of expertise (SRE) that exploded because of the lack of engineering rigor. That's not to say if everyone did all the right things all the time there would be NO need for SREs, but there would be fewer of us - something that I've tried to communicate to everyone I've worked for in the past ~14 years of being one.
But we had to deliver. We had to increase shareholder value.
SREs became a thing because management realized the DevOps mindset of making your programmers DBAs and sys admins wasn't really working but management were too ashamed to admit they were wrong so they invented a new term.
Well, to be fair, having separate DBAs and sysadmins wasn’t working either.
Any effort towards a perceived best practice or bug fix that doesn’t have a measurable impact on the business is a wasted opportunity cost. Engineers only have jobs because the software they build makes money. It’s not art work.
There quality should be there, but it should only ever be “good enough”
Just goes to show how quality never is and never was a key to success. Same with JS. That trash only became successful (widely used and popular) because it was conveniently available in the browser and hit a user need.
Your desire is not to build things on quicksand but your solution is to just throw LLMs at everything and rewrite it all? That's not the solution and causing even more rapid churn by ditching backwards compatibility is just going to exacerbate the problem.
This goes double when you add in the same non-technical-sourced pressures that caused developers to take shortcuts are still there, and now even worse with their unrealistic expectations for LLMs.
With AI you can actually start fresh, don't know if its that easy in CPU design, but you can literally rewrite something from the ground up with rust or whatever you want now, and make it reproduce the behavior of your old program
The reason PHP and other, "joke languages" are still in use is because business needs power businesses, not engineering wants. Plenty of businesses are still run on pen, paper, and custom spreadsheets because those things just work or work well enough. Could they do a better job or scale up more with a SaaS offering or two? Possibly, but why?
SaaS... the thing where you have to shutdown your business for the day because AWS us-east is down even though your application runs on Azure?
If you think we are a clown industry, I would like to introduce you to.......gestures broadly across the horizon.
> PHP was a joke language from the start, we were making fun of it in the early 2000s, the fact that over 20 years later it still powers a huge chunk of the web is enough to demonstrate that we're not serious people.
Don't forget the other half of the web development stack: Javascript. The absolute worst scripting language ever desi--well no, it wasn't designed, it just kind of happened accidentally. At least PHP solved a problem of the day, Javascript was nonsense from the start, and somehow managed to become critical infrastructure.
I'm seeing this claim all over this sub-thread and I will stick up for JS here.
While yes, PHP begun as a collection of macros and was never intended to be a programming language, JS was made by someone with intention. To quote from wiki,
> [Eich] originally joined intending to put Scheme "in the browser", but his Netscape managers insisted that the language's syntax resemble that of Java. As a result, Eich devised a language that had much of the functionality of Scheme, the object-orientation of Self, and the syntax of Java.
I've seen quotes before from Eich himself I believe that he was combining these influences at the time - Scheme's closures, Self's prototypes. It didn't "just happen".
To me this is just yelling at clouds.
Things have moved on from PHP, but at the time, the alternatives had many more tradeoffs in a wide range of cases. Without PHP the internet would have unfolded much differently, much more slowly.
The "bandaid" mentality you decry exists of course, and is outright bad in some cases, but is just good business in many others.
Rewriting everything makes no sense. And, of course, in the vast majority of cases is never going to happen, so advocating for that is effectively advocating doing nothing at all for 90%+ of sites. A much more efficient and effective approach to using AI here would be to find and fix issues in the PHP runtime, and to assist in automating the deployment of the runtime. Time spent on this fixes thousands and millions of sites at a time, in a consistent, improvable way, rather than one at a time, in a piecemeal way.
> We're a clown industry
I think if we want to bring more engineering discipline to software development, we need sober analysis, not outraged rants.
> As someone who has been programming for about 25 years now and has always been frustrated by the tendency of software devs, and in particular web devs, to not address the root issues but just scaffold on top of them and try to hide the ugly bits under the carpet, I feel a bit vindicated.
Not sure why you would. It seems like the people who made these compromises were roughly right and the problem only escalated when it also came with a solution.
Maybe… it’s about money? As long as companies get away relatively small fines for massive private data leaks, who cares? Equifax anyone?
Still, I pray you’re right.
I get your drift but... This sounds a bit like advocating "why not ditch all progamming languages and build some super language that makes no exploits possible". While we are at it, ditch the Von Neumann architecture. Or saying "why not ditch all natural languages in favor of Esperanto".
No, we don't need the "perfect language". But we definitely need to switch to better methods - which were available for decades already - more quickly. There are plenty of memory-safe languages. They have been available for decades. And here we are, a huge amount of servers affected by a memory bug, in especially badly written C. There are probably many more fundamental design bugs in PHP.
Not sure if I disagree with all your points, but this one caught my attention:
> HTTP is an old and quirky protocol with a lot of surface open for attackers that are rarely useful nowadays
HTTP 1.x is that, perhaps. But I was in the trenches when HTTP/2 came out, brand new and running on binary. It was so new that there were very few implementations around, and my team had to code one. The people who worked on the spec had a lot of learning to apply from HTTP 1.1. That resulted in many nice bits in HTTP/2, but HTTP/2 also had serious issues at a spec level. Which is my way of saying that "modern" doesn't necessarily mean "bug free".
Was it software devs? I've always had the impression it was management that didn't want to give us time to address technical debt, but just focus on shipping more features.
I've certainly taken time to address tech debt whenever I could. Which was not as often as I'd like.
> the tendency of software devs, and in particular web devs
Software devs absolutely love to create a mess, and are never challenged by business, product, management, or you name it, to increase speed to market, cut down cost estimates and, to say it crudely, deliver half-assed work.
Systemic issues have systemic consequences.
> HTTP, naughty bits
It's especially fun when not implementing the naughty bits is its own source of vulns. Your code is simpler and less prone to RCE, but your proxy mishandling or whatever allows for credential smuggling attacks, identity spoofing, request smuggling, cache poisoning, and all the normal issues at the application layer.
I hope that the current enclosure of hardware + the help of AI means that we might finally, finally have an era of optimization in which software is made to run much better on existing and older hardware. How nice it would be to have an OS and basic software that opened instantly, responded as soon as I clicked, etc.
Quality software is out there, but you have to pay for it.
> the effort that went into making it good should have gone into ditching PHP
What effort? PHP foundation has one employee!
> The bandaid mentality is what got us in this situation.
> We're a clown industry.
We are clown industry becauee nobody would sponsor solid research, infrastructure and fixing all those bugs! PHP is junk literslly written over nights by some volunteers!
I suspect you're being intentionally obtuse here but the PHP Foundation isn't where PHP gets written. Zend are the closest we have to the PHP company I guess, and they have approximately 100 employees, then you've got however many people are employed either as contractors or by other companies with a primary focus of working on PHP itself.
> PHP is junk literslly(sic) written over nights by some volunteers!
And yet everyone knows this, and millions of people still continue to use it and develop new software with it, to avoid learning from our mistakes. The software industry is just not interested in fixing these problems; I've heard people upset that AI is pointing out flaws, instead of being upset that flaws exist. Deeply unserious.
Yup. Another reminder of how far software engineering lags behind other engineering disciplines in rigor and accountability. The chickens are coming home to roost.
This is also a result of consumers putting up with every kind of shit they've been dealt. The application layer has been the biggest resource hog.
You forgot NPM. Whereby we download code from unknown authors on GitHub and run in with full access to our filesystem on our machines. No vulnerability, it's been designed like this, we even have designed scripts to autoupdate vulnerabilites, that's the proof that vulns are not common.
It's okay, Perl, Python, Go, and Rust do the same thing with their respective package managers.
Not to worry, Linus said that given enough eyeballs, all bugs are shallow. So it sorts itself out, because we all review the code we download, right?
> We never had to do things correctly, we could flourish with abysmal levels of quality acceptance. This may not be true anymore.
Ironically, the opposite is the case with LLMs. Now those on your teams that wanted to stop the clownery will be overruled by the vast amount of bullshit code from their less skilled peers. Of course, those that care can use LLMs to faster clean up, but there's no way they are able to keep up.
Managers always favored outcome over correctness, and not giving two shits about the internals was, and will always be, incentivized.
>to not address the root issues but just scaffold on top of them and try to hide the ugly bits under the carpet
It's totally the devs fault and not the environments devs have to work in. Deadlines forced down on you until you have to make compromises, 24/7 having to compete with people who actually don't care because you have to meet months end payments somehow. Whole businesses blinded by a tech gold rush.
>We're a clown industry.
I do agree here, but that includes every non dev person.
Time for me to drag this old chestnut back up.
You don't see the same problems in say, structural engineering as you do in software engineering. I suggest this is due to needing to go through the formal training required of a structural engineer, and membership bodies like chartered institutions, with standards and codes of ethics. We might want to reflect on that
The state space of what you must check to ensure correctness in physical engineering is infinitesimal compared to ensuring correctness in software. Correctness in software is qualitatively more difficult by nature and an open problem at a theoretical level.
No amount of bureaucracy and process theater gets around this fact. There is a vast and very expensive gap in software between "don't do stupid things" and "this is actually correct". The tooling to close this gap is severely deficient and not for lack of trying. In physical engineering we've had automated design checking for decades because it is a relatively trivial problem in those domains.
It would be great if compilers could generate proofs but after decades of research they can't even generate SIMD code in most contexts.
I think being legally liable for any failures that pop up probably also has something to do with their more cautious culture...
Structural engineering, is engineering (though mechanical engineers would disagree), 'software engineering' not so much. It just happens to be a word that's a useful synonym for 'building things'.
I rarely call myself an 'engineer', preferring developer or programmer.
Isn't software "engineering" or shouldn't it be considered that? Creating a new painting program might not be considered that and a software failure would have little impact, but there is a huge amount of software which is essential for the operation of complex systems. We just had large parts of the internet impacted by the PHP bug - a lot of businesses were harmed in their fundamental processes by it. Like if a roof of a warehouse had collapsed.
In Europe, a lot of supermarkets were hit by a remote exploit which allowed attackers to switch off cooling of food. A blood bank in France was attacked the same way.
So how would building software for important or even safety-relvant systems not be considered "engineering"?
Especially, as faulty software might not only cause a product or device to fail in a dangerous manner, faulty software in this day and age often makes it possibly to remotely attack the faulty product.
You do. Structures fail. Less so in parts of the world where serious regulations are in place.
I agree with you but I would extend that observation to include the age of the industries. We have been making structures for thousands of years. Software is an infant compared to that.
I think that has more to do with than some unverifiable sentiment like "software people are simply inherently less serious than other engineers".
Sometimes software is a public works project but sometimes it is a backyard shed. You just have to know the difference.
We don’t have time to tinker about for months on regulatory processes and making the our screws are “B6”. Software is a different industry.
The people who set the deadlines are trying to stay competitive so there are contracts with clients so your salary can come from somewhere.
competing with others doing the same thing in a zero sum game. We all just have to simultaneously coordinate to agree not to set unrealistic expectations or deadlines! Sounds easy, right?
sorry, but you are really naive. php was peak engineering compared to the contrived layers of llm generated executable pseudocode we are about to build upon for the foreseeable future. php is opcode running in a C/C++ driven virtual machine. what llms are spitting out is statistically inspired plagiarisations void of sense that linguistically abstract non-linguistical concepts chaining all that crap then build towers of it and nobody will be able to even reason about what's going on without adding more llm to the mix. think apollo guidance computer but 1TB of code.
The amount of begging I've had to do as a Ruby on Rails dev to be given time to refactor debt was unreal. This was pre-AI, around 2018.
I basically just worked extra unpaid hours with a colleague to do it since it was frustrating. Not even from a security standpoint as it is now, but just plain developer happiness.
But while we were cleaning the Swamps of Dagobah the other team was extending them.
Our deliverance came when the other team got woo-ed by React and started coding less in Ruby.
For my mental sanity I treat the React project as a black box.
Just heard they had to update the Redis connection configuration in 6 places, after we had switched to Sentinel based connections.
I seriously can't with my people sometimes.
Haha, so how do I become a palace clown? Just kidding. I like and trust AI, but I don't think AI can solve the debt, because AI code creates a different type of debt than code written by humans.
The thing that pisses me off about people who complain about PHP is that all these smarty pants people have pointed out the flaws in PHP, but never really understood why it was successful, and because of that they never created a language that could succeed it. The things that made PHP successful were:
1. It just werked. You could write incredibly shitty code and it, like HTML, would work as long as there wasn't a fatal error. And sure you could just say "git gud", but that's not going to happen. People will just use the best language that works for them, and in this case, it was PHP.
2. It required very few resources to run low to medium traffic websites. Because of the Apache mod_php module, PHP sites wouldn't use any resources if they weren't being served, unlike every other language at the time. So it meant places could host thousands of websites on the same server no proble.
The guy who created PHP, Rasmus Leerdorf, never wanted and never expected that PHP would become as popular as it has. He has mentioned that he thought that at any moment, someone was going to come around and create a language that would succeed PHP. But it never happened. People are just better at pointing and complaining instead of solving the issues that people want solved.
We can now leave the 1990’s behind us by generating code non-deterministically.
At least put some formal verification on top of that GenAI pile.
"We're a clown industry."
How can even call this an "industry"
On the RISC stuff specifically: It sounds like you're saying CISC is just RISC with a microcode translation layer. It's not wrong, but then RISC is also RISC with a microcode translation layer.
The CISC vs RISC debate hasn't been interesting in a quarter century at least. The only real difference is that the instruction decoding (which CISC and RISC both have) is likely going to need more transistors on x86 than other contemporaries.
But I'm not sure what you mean by "stop doing things like that". The ISA is "the API". Sometimes the best CPU implementation (for whatever definition of "best") will need to change the ISA-to-microcode translation.
It's not reasonable to assume that a decades old ISA will have a 1:1 instruction to microcode mapping. Hell, it's not even 1:N. Macro-op fusion makes the mapping N:M. So you could say that RISC also has variable length instructions, in a way.
And RISC-V has two sizes of instructions, with RVC. So it's not even "super transistor efficient because all instructions are 32bit".
Yeah, I just don't see how every chrome or even firefox tab has to consume 500 mbs each, it's actually insane, even for basic websites like HN
...and not forgetting that there are always 10+ spare threads on the shelf which each consumes 300MB+ while doing nothing...
>frustrated by the tendency of software devs, and in particular web devs Are you sure that's not the typical cost optimisation of management/c-levels rather than a developer problem?
What you wrote reads a bit like ye olde typical "nyeeeh javascript! you're only a dev if you write everything in assembly! kids these days!"
It seems "coding AIs" can enable the final form of coding (end game): binary specs with direct assembly implementations. No more compilers.
Just for my curiosity could you name a non-clown industry?
My guess is aviation or .. defense?
We don’t have billions to throw away on making sure our about-dialog is memory safe.
>Just for my curiosity could you name a non-clown industry?
The real clowns union paradoxically is the least clownish industry one can find.
There is no upper limit on the definition of "clown." It all depends on how much money you have to play with and how many nines you're willing to accept.
I think we need to start over with safer languages and runtimes.
That’s what I started to do 10 months ago.
You want a safer language AND transpilers from PHP, JS, Python etc. into it? So you can find issues in your original code using source maps, or just speed up your PHP by 10x and your Python by 100x? Here you go:
https://ulanguage.org
We all know software is swiss cheese. Now it wil be swiss cheese with duct tape on it. So what.
Or have the devs been Vindicated as AI is the newest scaffold
This sounds like "I told you so".
What the heck have you been doing instead of pointing out the obvious?
> We can leave the 1990s behind us.
I'll believe it when I see it.
Otherwise, I completely agree.
Are you sure you are senior? Because in my 22 years of experience in 3 countries and host of employers (banking, telco, insurance, military, municipality, energy distribution, retail etc) it was always management setting the tone and only fools ignore the hand feeding you and go against it due to some 'higher principles'.
No we don't need to have documentation and keep updating it what you can't read code? No we don't need to rewrite system that was patched ad absurdum so codebase became fragile and its hard to navigate layers of abstractions. We need to deliver this project yesterday at all costs since somebody up there slept on requirements for 6 months and didn't do their basic job, and we will never pick up half-assed pieces we were forced to deliver. No we don't need to update those 12 years old libraries, too much work and testing. I could go on and on.
It seems like you consider engineering to be delivery of perfect things, or utter failure. Thats not how things are anywhere, sw dev is more unstructured but you also don't have 5 million ways to build a good wall using every possible substance in the universe, do you.
We are not a clown industry - we are an evolved industry - both parts of that matter. We evolved in an environment where these kind of attacks were not possible or were freak, state sponsored events. Kind of like moving from a sheltered lagoon to the Pacific Ocean. And we are an industry - where profit matters. Open source was lead by people like you who cared and did not have profit to constrain them. Which is why it’s better engineered (and frankly if open source like Linux or FreeBSD had not existed in our lagoon, the profit would have failed earlier and commercial Linux would have had to been built and built to same standard (god knows how)
But we are out in the pacific now, and boats that sink make no profit, so we will evolve again, and again.
But it’s hard to blame Moana standing on a pacific island for not inventing a nuclear powered battleship.
(Trying not to be too blame-y on either side)
These attacks aren’t freak, and nor did they take state money. It’s more so that security by obscurity really did work because it didn’t cost a few dollars to attack people. Now we’re having to reckon with security debt, not code debt. It’s still quite fashionable to increase code debt to buy velocity and efficiency.
So I was saying that prior to AI say 2025, complex multi layered attacks were so hard to do that the resources kept it at a low frequency. Now layering ten different vulnerabilities to capture a flag is just five prompts away. This used to be so hard it could be ignored as a “likely” security risk.
That’s changed - we are in stormier weather and need better boats, but it would have been unlikely to have built battleships to sail the lagoon just in case…
I hope some of these backdoors and/or 0-days being kept under wraps by nation states or corporate espionage companies (Pegasus et al) are being found incidentally through all this.
It’s frustrating to have all these 0days and CVEs to patch for now, but in the long run perhaps we’ll leave with more robust software.
The logical extrapolation of AI capabilities stress-testing human software is all bugs being discoverable. Hence, you have to aim for actually bug-free software.
The only way to do that is to make your code provable. That again is only realistically doable using AI.
In the process, people will have to turn the pretense of "software engineering" into reality, making the engineering part explicit.
That only works when humans actually understand what they're doing.
> "I have only proven [my code] correct, not bug free."
> -- Donald Knuth (if I recall that exact quote correctly)
Just because you have proven the correctness of your code, that does not mean that it is infallible. Especially -- as a lot of HN users point out -- there's intricate complexity that is likely to cause erroneous behavior if several interfaces/complexities get combined. And those might be caused, for example by a 'user' setting the driver to 'db.backend.sqlite' instead of 'db.backend.sqlite3'; and then you have suddenly an unexpected configuration.
Engineering is the discipline of designing and implementing solutions that achieve desired outcomes, using limited resources, while satisfying a defined set of constraints and minimum acceptable standards.
We have way more resources now to achieve way higher standards.
Hopefully we'll also see us back to KISS principles too. But who am I kidding
What I have heard from AI it is anything but KISS... More features and more code as fast as machinelly possible.
> ... More features and more code as fast as machinelly possible.
i am going to quote that a lot...
People complain about LLMs not respecting KISS, but fail to address why = LLMs being defensive and coding for situations that either do not happen or are unlikely to happen. That doesn't absolve you from deciding using your human brain if given change makes sense or doesn't. You can also tell LLMs to not program defensively.
Same with any other acronyms - if you don't set up guardrails on when given principle should apply you'll get code that you can only complain about.
> coding for situations that either do not happen or are unlikely to happen.
Not coding for situations that “do not happen” is exactly what creates vulnerabilities. But I also don’t think that such code is the main source of complexity in LLM-generated code.
An example to what I'm talking about: I have application that takes two inputs from request. I've put in validation on request values to deny values that are greater than 100. In my code I'm adding these values. LLM can say "cater for addition of these two numbers, because they might go over MAX_INT and result in overflow". This is a situation that won't happen. LLM can recommend - add assertions. That's unnecessary.
Arguably it’s only unnecessary when the value range is enforced by the programming language (types). The structure of who calls what in the code can change, and suddenly larger values can appear. You don’t want to have to perform whole-program analysis on every change to check whether all assumptions made in the past still hold. That’s also a source of vulnerabilities: assumptions that held when the code was written, but stopped holding sometime later.
That’s why I think code needs to document all its assumptions, and in a way that is checked by the compiler to the extent possible. If you document that the values have restricted range, then the AI should be taking it into account.
Types is an option. Another option would be tests (and in this case mutation testing).
My main point still stands = LLMs code defensively catering for unknowns that are not loaded into context.
I vibe-slopped a small and local forms application for my family. I explicitly mentioned that fact to the LLM.
Yet, I removed 2/3s of the code, because it triple-checked that every file really existed and was valid, that the input form was less than a million bytes in size, that there were propper HTTP status codes for everything, that every possible error from reading data was eagerly checked and caught, and so on.
Like come on, three people will ever look at it. Iwant to keep it small and tidy!
Depends on your incentives, most people and companies are measuring Lines of codes and features as the metric so ofc it will increase it, but AI can create small KISS applications. It might have a little difficulties in doing so sometimes because it sometimes likes to overengineer things but I have to wonder how much of it is because it is RLHF'd to solve questions at any costs in terms of lines of code rather than training it in solving it in KISS principles. Also I wonder how AI will perform if we explicitly treat KISS as the only principle and have checks running on it and have it discard all the code which wouldn't follow KISS principle if it doesn't follow the principle.
> have checks running on it
We don’t have effective objective measures of what would constitute KISS.
Dunno about your company, mine measures in lines of code removed.
Yeah, so far coding agents haven't been good at reducing entropy at a large scale. That's the area where we need to push hardest in my opinion. Writing code is cheap now, but that makes it easier than ever to inflate codebases to millions of lines of unnecessary complexity that are impossible to work with and maintain. I want to see an LLM reduce a complex multi-million line codebase to 1/10th of its size or less without breaking functionality. That would be impressive!
I may be ignorant, but what do you mean with this and why is it upvoted so much?
To me KISS is basically about how you’d write the code, the architecture, which is something that - at least currently - humans need to oversee when writing new code with LLMs.
But what does it have to do with AI discovering a ton of bugs in a lot of (open-source) software?
Software that does less is easier to understand and reason about, and typically requires less code. Less opportunity for bugs to appear.
Maybe, when they build a pomodoro timer, people will consider the possibility that the entirety of a browser engine as well as 30 000 javascript dependencies from random unvetted sources introduces unnecessary complexity and a practically infinitely fractal attack surface.
that people will finally start solving issues by simplifying the software rather than generating even more edge cases.
A lot of these bugs are in rarely exercised code paths that probably shouldn't have been written into the software in the first place.
Plain http 1.0 is KISS. Does not really work that well.
Systems should be made as simple as possible, and no simpler.
That doesn't mean every simple system solves the problems we intend for it to solve. It means that all else being equal, we should prefer parsimony.
Could the global economy survive what that would do to the B2B SaaS industry?
It's interesting that no-one talks about writing new systems and base languages that don't inherit anything from the current toolchain. That's the first step, then new architectures / fully open auditable hardware basis. With html you don't need any of this dependency chain. As long as you can write a browser you can be running on anything underneath.
While it's hard to point to a fully top bottom initiative to create new platforms from the ground up, the Chinese appeared to be making an effort to reduce their non-native surfaces with things like Harmony OS.
A complete plan to reduce vulnerability from untoward influences is more feasible now with agent assisted engineering. You have to be carefully selective about what matters and what doesn't, or the cost and time balloon out of control.
That's also weird, in this reality, isn't it? You've got russians, chinese, etc, supposedly antagonistic to the western cultural hegemony, but then they just rely on western technology tool-chains. If I was guiding any of these countries a close to number 1 priority, technologically speaking, would be to create a completely independent software tool-chain. And talk through adaptors.
At this point, a browser is a significant part of the way to being an OS virtualised inside the OS it's really running on. Complete with occasional leaks through the virtualisation to the real host OS/machine.
Yes, chrome for instance is more lines of code than the entirety of Linux, I think this just makes the case stronger for what I said. Although I understand why it might be so.
What do you mean with "don't inherit anything"? Using the existing binary ABI is mandatory for interoperability so yes, in that sense every new programming language inherits something. Other than that, there's plenty of languages that have fully self-contained toolchains and runtimes, e.g. Erlang and Rust come to mind. Guix bootstraps its entire environment from a minimal Lisp implementation. There's also Microsoft's CLR and its entire ecosystem of programming languages, but I don't know if the runtime exists next to the Win64 C/C++ base or on top of it.
HTML is entirely the wrong comparison as it's a document format and not a programming language, and "as long as you can write a browser" is not a simple condition. Do we have any browser (even in development) that isn't written with current toolchains? Or a headless javascript runtime perhaps?
HTML as the "transport"/"dialect" to keep compatibility with the existing computational world. What I mean is from the ground up, no C, no erlang (which Im a big fan of in terms of application organisation), no Rust, no Javascript. Start from first principles, OS'es closer to uni-kernels, sane sharing/privacy policies, ability for instance to start an "executable" (already an abstraction tied to the current mode of software production, albeit a perhaps useful one) with a narrow set of scoped access. Then it only has to implement a browser/subset of it to parse HTML and it can "access" most of the relevant parts of the existing software world (internet). Ditch anything complex, if necessary make a browser that just uses flexbox, no other things, no backwards, compatibility, if you need compatibility buy a normal laptop with a normal OS, that comes with all the cruft, but design this new one from the ground up.
But I also don't understand why (without compatibility layers) a browser should be as complex, or remotely as complex, as currently, specially with all the knowledge in hindsight.
I'm not saying this is easy, doable, or whatever, but that was what I meant.
I'm more annoyed by the fact the fixes and exploits themselves are being artificially delayed in misguided attempts to coordinate disclosure, in world where anyone can just point AI at vague direction of the bug and just find it
This is the real reason for the vulnpocalypse, not "technical debt".
NSA spent 20 years stockpiling vulns and pushing the industry towards half-assed solutions like address sanitization and pointer tagging when they could have put the industry on memory-safe languages instead.
They managed to get the IME/PSP/TrustZone into 99% of the CPUs out there by mandating it for government purchases; they could have done the same thing with memory-safe languages. But instead they chose to stockpile vulns. Hope they burn in hell for this.
Why do you think the NSA could have put the industry on memory-safe languages?
Even if they wanted to, I highly doubt they could push the industry to do that. The industry does what it wants to do, and rewriting tons of software was far from its priorities. There were no LLMs back then to help with such a massive migration.
There's also the fact that rewriting software tends to introduce a lot of new bugs.
The U.S. government could have required all new software for any government-procured system to be written memory-safe languages, thus making it ubiquitous. This could have been phased in slowly with a few years of on-ramp time to allow for industry to acquire the relevant skills.
The DoD tried that with Ada and largely failed. That was with defense contractors whose primary customer mandated it. That was despite Ada being proven to work in its first projects.
The U.S. government had pushed Ada for years and it never worked out. The government was forced to accept C++ because industry was rebelling against ADA, even though ADA was memory safe. Well, Ada did have the ability to be memory unsafe. It was much better by default.
But even in memory-safe languages, compiler bugs are still an issue. The theory is perfect but the implementation is flawed. In such case once the compiler bugs are found, the software would have to be rewritten to compile. For example an 11 year old memory bug was discovered recently in the rust compiler: https://www.penligent.ai/hackinglabs/rust-borrow-checker-bug....
Memory safe languages are not a silver bullet either.
Definitely not a silver bullet (consider also that memory management isn'the only source for vulns), but still much better than C/C++.
The DoD have even created their own language: ADA. Massive contracts power, but different markets to incentivize.
The distance between the usual consumer/b2b tech startup and the kind of company that sells software to the air force is even bigger than the distance between Google and the kind of company who hires Accenture.
>IME/PSP/TrustZone into 99% of the CPUs
Yeah, about that. Its the biggest vulnerability in the industry. Nobody wants to confront this fact, though.
Too much profit to be made in subversion and human rights abuses.
Sometime the profit made by the companies for inserting backdoors can be quantified:
" In 2013, The New York Times reported that documents in their possession but never released to the public "appear to confirm" that the backdoor was real, and had been deliberately inserted by the NSA as part of its Bullrun decryption program. In December 2013, a Reuters news article alleged that in 2004, before NIST standardized Dual_EC_DRBG, NSA paid RSA Security $10 million in a secret deal to use Dual_EC_DRBG as the default in the RSA BSAFE cryptography library, which resulted in RSA Security becoming the most important distributor of the insecure algorithm. "
https://en.wikipedia.org/wiki/Dual_EC_DRBG
Yeah.
People seem to be fine with it as long as their own team seems to be profiting from it - but for those of us who are not subject citizens of the NSA's government, it is a truly heinous state of affairs.
Is it forcing us to "pay off" technical debt or is it starting us on a compulsory endless treadmill of feature-neutral fix-work? Collectively, we just won't know for a while.
It totally feels like the former if you watch it find and fix vulnerabilities or other debt-tasks one after another.
But only so many of these "technical debt" issue are little off-by-one errors that get remedied by a surgically narrow patch.
Many enough require some kind of restructuring or redevelopment of their own and it's going to take time to figure out if AI faces the same dilemma as human developers: where each non-trivial change carries the risk of some new issue, ad infinitum.
If that happens to be the case, and AI isn't able to magically produce perfect software in finite time, then what's really happened is that the threat of hostile AI exploiting our technical debt will force us to always be burning and churning code just to remain a moving target.
It's another "we'll see" thing for now, I think.
[delayed]
the equilibrium state would be having found a good pattern for making patterns good. we probably aren't too far from that, so i think your worry may show up in the short term but not the long one
You're thinking of provable code? Or something else?
The original technical debt, which cannot be paid off, was the decision to use a Von Neumann architectures instead of a Harvard architectures for CPUs.
That won’t help with Lisp programs. ;)
Good point, but not much infrastructure runs on Lisp
Explain? (Genuine question because I wanna know)
Basically, have an explicit distinction between data and code at the architectural level, to enforce "Write xor Execute" in hardware. In this way, you would prevent e.g. a buffer overflow letting an attacker injecting shellcode that gets executed later by somehow pointing at it. AFAIK the issue would still remain with some programming languages though.
don't we already have the NX bit?
and it's not sufficient anyways. even with NX you could have the attacker control a function pointer you call. in any sufficiently complex program you'll have enough widgets to build anything you want just out of data.
code and data are the same thing. whatever inputs your system receives is "code" that your application interprets, just like your application is the code that the CPU interprets. turtles all the way down.
In a Harvard architecture, it's not possible to point the CPU at data.
But.. alter data that gets executed (interpeter?), I mean, how does this work even in theory? All data is potentially code?
All data is potentially code only in a Von Neumann architecture, but not in a Harvard architecture, where there's a separation of data and code with different memory access to each.
Code and data being equivalent is a consequence of Turing completeness; you can always write a Python interpreter, point it at "data" and have it execute that via interpretation.
and we don't believe a sterilized virtual machine creates a similar situation?
any respective machine doesn't require full Turing completeness?
any ad-hoc machine allows for mutations and flexibility, which I'm sure is an added strength.
2nd edit,
Also, didn't we have a weaker model of this with segmented non-flat memory models on i386-
How do you turn text into code in this architecture? Through the kernel?
you don't. I also believe that JITs would be impossible under strict Harvard.
PHP would still be a C interpreter even if you disabled JITs.
Really, we never should have left the Garden of Eden. Things were great there, other than the maternal mortality rate.
Max AI-glazing perspective in the title, as expected. We need to fix bugs that no mere humans could successfully find and exploit. Thankfully we have AI that can fix those bugs that wouldn’t be a problem without superhuman code agents.
But there are potential upsides like the already mentioned possible nation state exploits (sleeper exploits).
I was down voted a lot months ago for saying that a lot of open source software had a false sense of being secure with the assumption that someone else would have audited the code. And this AI auditing is going to make the promise of open source software getting audited by others actually real. Nice to see others waking up to this reality.
There was always, in my mind at least, a tension with Linus's Law ("given enough eyeballs, all bugs are shallow").
It's true but the problem is assuming, just because something is open source, it has received sufficient eyeballs. AI now gives us near unlimited eyeballs so, if we survive the bumpy transition, open source should indeed become very secure compared to closed source.
We were getting routine audits from security companies as well as public universities around the world on our OSS healthcare project. I would say it did give us in some way a false sense of security as we had the belief that a lot of the major bugs were addressed. The last 6 months have been very eye opening as the slew of reports have been difficult due to how many there have been, even with all of the false positives there's been a lot of legitimate vulnerabilities. This has been taxing for us to go through (and humbling as well).
That said, if we were a closed source project, I don't know that our own tooling would have discovered all the issues using LLMs as we are seeing more and more creative ways of people exposing exploits that I never would have thought to put into the LLM prompts.
I think the argument was that it was more secure than the closed-source equivalent.
Perhaps it will also challenge the assumption that open source is something you can run a billion dollar business on without re-investing a penny.
a lot of open source software had a false sense of being secure with the assumption that someone else would have audited the code
Do you have examples of people saying this? I don't think I've come across idea being espoused...
I've certainly seen people interpret Linus's law to mean this. (https://en.wikipedia.org/wiki/Linus's_law).
I do not have an example for this, but the most ridiculous argument for open source software (at lease for most people) has always been that if the software has a bug you could simply fix it yourself. Funny enough this has actually become kind of true with new LLMs.
Did you not fix bugs in the oss you run, pre-LLM? Or not bugs, just your own changes? Being able to just grab the source and tweak it without needing to try to RE or wait around or convince the owners/developers to do something I wanted to happen was one of the biggest selling points.
I don't agree that it was an assumption as part of open source, but that it was a possibility with open source. However, there are lots of assumptions made about computer software in general - part of the problem is having cognitive models of software that aren't necessarily reflected in how the hardware runs code.
Also, closed source software can similarly be analysed with AI, but there's no guarantee that the company involved will deal responsibly with disclosures.
> ... a lot of open source software had a false sense of being secure with the assumption that someone else would have audited the code ...
I agree on this part, but what's your point here? Are you suggesting closed source is better?
I don't think they're suggesting that, rather that the "more eyeballs" quote is a bit flawed (in that not every project gets enough eyeballs). A thing can still be better then another thing and not be perfect.
The article takes PHP2Shell as the worst offender of the present wave of vulnerabilities but HTTP2Shell/Brotli2Shell was arguably worse. The consequence over at Brotli may very well be the same, but the timeline shows, if anything, that at least part of reality is actually still very much "humans just sitting on vulnerabilities for months or even years". From the timeline: 8 years in the code, 8 months unreleased (but fix in Git) and at least 4 independent researchers finding the problem and pointing it out.
[0] https://www.bugsink.com/blog/http2shell-timeline/
Google also authored libwebp which contained the high severity buffer-overflow vulnerability used for the zero-click hack that made the Pegasus weaponized spyware famous worldwide for targeting journalists, human rights activists, etc.
ironically, AI is also making us create a new whole new level of technical debt - where _no one_ has actual understanding of the code being written and we're just trusting the machine
Indeed, and it's just going to end up as a zero-sum game where the winner is the one who can most adeptly manipulate the machine to cause harm to the other.
This is exactly what has happened the past 50+ years, too, your toolbox was just different in the 90's than it is today.
So if it has happened, should we now proceed with even more powerful and dangerous tools, with a much tighter integration with society?
Is a nuclear power plant dangerous? Or an airplane? Both are examples of an advanced form of what other entities in their category do.
Of course we should proceed with even more powerful tools. We also need even stronger governance of said tools. We don't want an AI-version of the Chernobyl incident but we do want the AI-version of the benefits that nuclear power gives.
Basically whoever has the deepest pockets to burn the most AI time.
I like to think of it as a new abstraction layer on top of something we've been comfortable with for years. The developers of the past had to trust that human-readable code would compile to the machine-level bytecode they were used to write, and that even though it wasn't as efficient as they could make it, one day the benefits would outweigh the negatives. Today most developers don't understand compilers well enough to even begin questioning if the code doesn't work because the compiler has a bug or because their code has a bug. They have to trust the abstraction layer beneath their current domain, and they have to find ways to prove that their work is correct in that domain (e.g., writing a sufficient number of unit- and integration tests, compiling with different compilers to different targets, etc.).
We, too, have to adjust to this change, this new abstraction layer, because whether we like it or not, the code an LLM will produce in no more than five years will arguably be much, much better than the code any 10x developer could produce even if given months of time and an infinite supply of caffeine.
We "just" need to find a way to confirm that our work in this new abstraction layer - primarily prompt engineering - results in the code functionality that we had in mind, not necessarily the code implementation that we had in mind.
I'm still unsure if we won't figure out that the right abstraction level to describe what code means is, well, code.
I've spend the past month-or-two on developing a platform scroller game for smartphones using nothing but AI. It has created everything given my instructions, to my liking, from the way the game is played to graphical assets to sound effects. It looks and feels like any other typical studio-developed game you could find in the store, the difference is that I didn't have a studio of professionals working fulltime for months or years with various levels of project management and what not. It's just me. Me and my agentic coding subscription.
Vibe coding originally meant giving an LLM an instruction, having it regurgitate something potentially wholesome, testing it and feeding back the errors for it to fix it. What I've done in the past couple of months is so, so much more than that. I'm a puppet master and my coding agent is my puppet. I don't need to understand the code when I can describe the problem I want solved and it will do it 100x faster than I ever could.
I didn't use code to describe this level of abstration. I used English prose - and a heck of a lot of software engineering theory, mind you. If you know the solution requires a quad-tree and binary search because in this case, that is the best option, then that's an instruction, not a block of code.
Is it a challenge to Agile methodologies? I mean is most software today designed at all? If we want a pm to be able to write half baked feature ideas and expect the devs to sort it out, rather than just paste the ticket into Claude, don't we make this chaos inevitable. Maybe there is a missing formal engineering layer missing between feature request and prompt. Llms seem to do much better when they are told exactly what to do, vs when they are given room to...express themselves
I note you're downvoted but I strongly agree. Forcing humans to speak machine language is inherently inefficient. Having them speak a language we're already comfortable with is an obvious evolution in abstraction and control. I suspect you've ruffled some feathers because speaking machine language has been a knowledge and skill gate which is rapidly becoming redundant. It doesn't feel good when one's career and skillset become much less valuable. Never-the-less, this technology is not going anywhere. Opus 5.5 already codes better than most of my developers at about 100x the speed. Architecture is still valuable, but I have no doubt that this is also going to be done better by AI soon.
Some people react to harsh realities and truth with negativity and the only the only things they have control of here on HN: a downvote. :)
I, personally, never downvote people I disagree with. Who am I if I don't use another perspective as an opportunity to learn and grow? I can tell that many people agree, too, because my "comment score" is still mostly neutral at the time of writing.
Human speech is inherently inefficient and ambiguous. Humans rely on non-verbal clues and context to distill the exact meaning of phrases, and even then the potential for miscommunication is non-negligible. It is a huge leap to assume that artificial intelligence can succeed in flawlessly divining intent from regular human speech to the point where it can generate debt-free code. And if your solution to that is to say "no, you need to issue specific instructions to guide the machine to the correct solution" then you have not removed the skill requirement, you have merely redefined the skillset.
the worst case for this is if that doesnt cause sufficient problems to force a reckoning. it has to hurt badly enough that we put significant effort into training legibility into the process.
Yup. Feels very much it's creating a mess on purpose IMHO.
It's like an over-eager junior engineer that will implement whatever pattern they read about last week. It just doesn't feel trained on high-quality enterprise, battle-hardened codebases.
Even Opus 5.5 on High thinking still littered a root directory of a JS project with source files without thinking to put it in a 'src' directory. It had to be told to use a testing framework. Had to be told to also test with Firefox (the project already had established Chrome /and/ Firefox targets).
I have to continuously burn tokens and effort correcting it.
I imagine it performs a bit better with a huge corpus of architecture and style guides. But I did expect to get some that for free with the "leading" model.
I think this is great. Reminds me of Y2K. I remember sometime around 1993 having a discussion with my boss why we store dates on our mainframe as YYMMDD instead of YYYYMMDD since we are approaching year 2000. He ignored the issue totally. I left the company but people told me later that in 1999 they suddenly started a huge effort to change the date format. Same with all the technical debt. It got ignored for a long time but finally we are forced to address it.
Having worked on both sides of the table, the reality is that it is far too easy to game certs like ISO27001. The risk calculation by companies taking that route is changing right out from under them thanks to Ai tools.
> too easy to game certs like ISO27001
These certs only exist for compliance, not for security. Nobody cares they don't add any extra value, because they allow every business to say "my supplier was ISO certified, so I did my due diligence".
And nobody really ever gets prosecuted for lying during their audit.
It seems like you've never tried to get it. ISO27001 is a security certification. You will not pass the independent audit if you're bad at security. You will not be recertified if you're bad at security. You can say this for other, non-prescriptive certs, but not ISO27001.
https://consilien.com/news/what-is-iso-27001#how-do-you-actu...
I worked at a place which got ISO27001 yet had its proprietary source code available unauthenticated from an old CVS server, including over HTTP. You just needed to connect to the wifi or plug in any Ethernet cable into any device. The company just did the magic “accept the risk” and moved on. Anecdotal but I can’t help but feel it would be common for other orgs which are bad at security getting certified anyway. https://youtube.com/watch?v=9IG3zqvUqJY
> You will not pass the independent audit if you're bad at security.
I wouldn't agree with that. What I would say is that to pass the audit you must appear to be good at security. More to the point, you must appear to be doing many things that most companies don't actually want to do.
> It seems like you've never tried to get it
I have. What I wrote was based on personal experience working for an ISO 27001 certified company and being very involved in the (successful) audit and recertification.
> You will not pass the independent audit if you're bad at security.
Incorrect. You will pass if you have all required processes documented and have documentation that show you follow those processes. Whether you actually do follow the processes is irrelevant, the auditor just needs to think you do.
Also, you can be incredibly bad at security and still be ISO 27001 certified. For example:
Process: Describes that employees use an encrypted password vault for secret management. Keys in the vault are rotated each year and when employees leave.
Reality: Keepass database is sent through email, the password is "CompanyNameVault2023!", which is shared in the same email. Keys are never rotated because it's annoying.
This will 100% get you ISO certified, in my experience at least.
In my experience you are not wrong.
I honestly think there are some kind of laws of physics at play here... in statistical limit of the massively participatory interaction of engineers, there is some kind of least action principle in play where the system is seeking lower energy (i.e. less code complexity, better foundations, etc), but only locally. The path towards a radically better foundation for the entire industry is outside of the "energy well" that it is currently in---at least that's how I see it. I feel like that's why we see more things like elegant scripting languages rather than ground-up reimaginings of computing itself.
There is a concept of the hourglass model [0] of internet protocols, where IP sits at the waist. I believe that similar things are probably true in any "stack" based structure, such as computing, where the protocol at the waist has the most staying power (which at the current moment could be e.g. x86, or something) because it's essentially the universal translation layer that connects all the language protocols built above it and all the transport protocols below it. So, I see it as an open question as to what is the best way to affect change in a situation like. Interested in if anyone else has any thoughts along these lines.
[0] https://en.wikipedia.org/wiki/Hourglass_model
We could rephrase it like this: “AI has removed all the excuses we had not to remove technical debt”
Yes, AI developed code might have vulnerabilities or bugs, but so already has your JSP based web server that has Oracle and God knows what else among dependencies.
"Disaster has been averted"
Yeah, hmm a lot of people don't actually auto update their PHP so.. it's not like the vulnerability disappeared from the wild.
> As far as anyone is aware, disaster has been averted: The hack was discovered by cybersecurity researchers who reported it to the PHP Foundation
Thanks to The Lord everytime someone discovers the vulnerability he reports it right to the owners/maintainers and there are no bad actors out there keeping it as secret and using for years.
It's also introducing a new kind of technical debt much faster.
we're seeing easier PR approvals when AI is involved. Since changing the code in the future is a lot easier.
Instead of a highly structured engineering process it's more like a gardening process of figuring out what works, what doesn't, what the Business actually wants vs what their requirements were
So more debt because there's more code but it's easier and simpler to change that debt. And in 3 years the product is EOL so shrugs
I think I doubled the amount of tempermanent fixes I pushed in my whole career just in the past two weeks.
Which can also then be fixed faster?
Not necessarily and most likely not. I think a lot of people's definition of "fixed" is "stop hiccuping in the previous way so that my butt is covered" and not "yes, it actually works and was given the proper time and testing to ensure that remains true."
Developers would do well to remove the word fast from their vocabulary. It has done tremendous damage to human systems (and the mental well-being of the people dependent on those systems). The whole reason the "technical debt" exists is because there's an addiction to speed. The sad part is that when you poke at that with most people, they couldn't give you a clear reason as to why they need to move fast; just that they have a sense that it's "how everyone does it."
Meanwhile it's creating 4000 years of technical debt.
Other AI's will patch that, other AI's will find new holes, other AI's will patch that, etc.
Might have some back and forth going on there without ever reaching the state of fast, clean and elegant software
i dislike the term "technical debt." we don't know the trade offs someone made while building a system. often times, it's too few people to do the perfect job, so we decide to do the best we can over the whole solution. for instance, we could all probably do a better job with accessibility, but often times we can't afford the time with stakeholders wanting other things. i don't see it as "debt" but more as the typical trade offs we have make when prioritizing work.
i hope we get to a place where we keep the same number of developers employed as today, but leverage ai to make all software better across the board. hopefully the people in power realize that we've been understaffed this whole time.
I sometimes hear "We have so much technical debt! We're using Mongo when we really should be using Postgres for this data structure."
Not technical debt, just a preference for doing things a different way (which admittedly might be a better way, but just because there's a better way doesn't mean the current way is bad)
"pay off technical debt", haha
What do you think the chance of nonzero budget and time being allocated for this is, given that almost no company has seen real consequences to the business?
This is the same cycle we always go through: big spending on a new wave of tech, something breaks it, and spending shifts to the ones doing the cleanup in the years after as the funding moves to the other side. Y2K created huge growth to the cleanup firms overseas. Y2K didn't break, but it had a clear macro deadline. More recently, cloud cost shock and cyber/ransomware accelerated FinOps and further grew zero-trust security industries respectively. But in the current case, we are waiting for the macro break to happen because AI-found bugs are not creating a visible deadline. And until that happens the spend at the front of the wave won't move to the other side of the wave.
fun anecdote from yesterday:
AI removed 80k lines of code and nothing broke. much of this code was written by AI few months earlier.
This reminds me of a slightly different take. AI will allow us to deliver on promises made over the past 20 years. For instance, CI/CD is actually happening now like evangelists claimed before and it really does unlock tremendous value, mostly through efficiency.
The strain from the amount of bugs is visible in bug bounty programs. A run on many targets will turn up exploits, but if you report them on any of the platforms a majority are instantly marked duplicate. It's so overloaded that companies are shutting down their programs from the volume of reports.
Anthropic is arguing for formal verification [0]. This is an excellent idea on the edge of feasibility, but it's hard to see how this can work for the majority of software that has to adapt rapidly and are so open ended that it's difficult to even conceptualize all the input modes. It's an easy prediction that we will see verification on large trunks of fundamental software in the next few years, and a sub-verification confidence scheme for the software on top of it.
[0] https://www.anthropic.com/research/formal-verification
There's also a new startup[0] that came out recently from stealth with mission to auto formally verify all of open source in Lean.
[0] https://andtruth.com/the-proof/
Earlier this year, the cybersecurity firm Calif offered to independently audit PHP, sponsored by OpenAI. Within two weeks, a researcher at Calif, aided by AI tools, found a way to use the out-of-memory bug to run arbitrary code on the host server, allowing a malicious actor to install malware or read critical data. Now, it was no longer a minor bug—it was a critical vulnerability, and the Calif team alerted the PHP foundation to start working on a patch immediately.
So, the headline should read,
"AI is helping us eliminate 40 years of technical debt."
Since AI found the bug, and probably also generated the patch at this point.
An abundance of solutions is a problem for people who sell solutions.
Two things are true here. Our decades of rapid-release mentality is now fuel for vulns. Those chosen mistakes we decided can live in the code have directly created holes in the Swiss cheese model. The headline eloquently stated this fact. However the scary part is the inhuman speed of chaining. This is a much bigger problem. The holes in our Swiss cheese now take hours to find instead of weeks.
If it forces us to fix bugs and discover backdoor, I'd say it is a tremendous "win", as the modern PM likes to say.
What's hillarious is people vibe coding massive AI apps thinking its not creating tech debt and security holes. If anything, AI is discovering existing holes, and creating them faster than ever before in history.
All those "paying down" technical debt with AI, I would advise reading the code _very_ carefully. Sometimes the "solution" which passes some test or adheres to some described functionality is incredibly narrow / brittle, and/or has failure cases that are non-obvious.
Yes I'm using $latest_model on high, its still not there. Unless your threshold for "fixed" is "the 1M line lean proof runs, we don't know how it works", it still requires a lot of attention, hand-holding, and scrutiny, especially when fixing issues / working around failures (where it tends to shortcut or invent workarounds).
The same can be said with human-written code. LLM code is by far better than the average developer’s code at this point, and there’s not enough top percentile developers to go around, so it’s a wonderful tool.
Also, those very average developers are also the ones doing the code review.
Below-average developers generating bugs now will be submitting AI created security holes at 10x the rate going forward. Hah, people are literally on this forum debating whether to use openSSL because they can vibe-code it with a smaller surface area (just have AI only create what you need).
Anthropic is literally creating their own git alternative because they are slopping so much code. You think its 100% secure? Even if it has bugs at 10% the rate, there is 10x more of it to go around.
Do you think Anthropic's git alternative tool is more secure and better written than git? Hah, I bet it was just some vibe-coded thing they did over a couple of days, when it starts bogging down, dropping commits, or getting unstable, they just have to prompt harder! I wonder why they won't open source or release to the public, its probably too dangerous to release!
A developer on my team introduced new features behind feature flags despite concerns about whether we should have those features and how they are going to be maintained. Changes touched 200+ files which is half of the files.
Turns out nobody wants to use them, they caused many subtle bugs in existing features and is a distraction for many things we do.
The developer left the team, and I am left with purging all of this.
Now imagine if he had 100x the speed! I'm sure AI will help him thoughtfully pay off tech debt at his next company!
That's so true. Nobody gave a damn about those bugs because they were too hard to exploit, and companies had a mindset of "move fast and break things." Bugs were given low priority, and developers had no time to fix them since they were buried in higher-priority feature work as part of a cost-optimization effort. Almost all of the smart people who could actually exploit them were afraid of criminal charges. Now, lots of script kiddies are having fun with AI, and state-sponsored actors in different countries are using it to accelerate the discovery and exploitation of vulnerabilities. But instead of extending validation campaigns and allocating larger budgets for hiring and funding security audits, software vendors are mostly trying to lobby for limitations on models' capabilities and regulation of the field, like Amazon reportedly did[1], despite even OpenAI and Anthropic offering subsidized[2,3] access to their frontier cybersecurity models, which are significantly better than those malicious actors have.
[1] https://www.theverge.com/ai-artificial-intelligence/949601/a...
[2] https://openai.com/index/coordinated-disclosure-of-critical-... - "To help more defenders use these capabilities, we’ve committed $1 billion in subsidized Daybreak access through Daybreak for Frontline Defenders, focused on organizations with limited security resources protecting essential services."
[3] https://www.anthropic.com/glasswing - "Anthropic is committing up to $100M in usage credits for Mythos Preview across these efforts, as well as $4M in direct donations to open-source security organizations."
In my opinion, the whole paradigm how we use computers needs to be replaced. It is like the 80s, but now with internet and a thread larger then anything in computer history before. I remember boot sector viruses and stuff.
My approach is https://tix.im/ - not launched yet. But from expedience: modeling everything as workflows of composeable nix flakes (expert systems from programs, skills, agents, workflows and their snippets, DBs blobs, service descriptions, ...) and then run everything in highly isolated environments. It is not only so much more efficient, reduces errors, increases quality, reduces unnecessary cognitive load, ...
I start to move more and more daily tasks into the systems. Even UI programs become interactive workflow steps, which allow me to attach from anywhere back to a task in an environment optimized for the task.
Dependency updates for example, a workflow. A subgraph from a security scanner expert checks each change in the dependency tree.
>In my opinion, the whole paradigm how we use computers needs to be replaced.
>But from expedience: modeling everything as workflows
No thanks. I like private computing. I like all the fun stuff you can do with Computers. I'll never want agent based computers.
you can build workflows without agents. Giving them highly isolated environments where they can't break stuff and having human gates where it makes sense - game changer. And you can use local LLMs - stata is awesome. I have a strata tix flake, I start it, it registers the model locally, and it becomes useable everywhere.
I dont want LLMs in my devices.
I don't mean to be that guy, but your website feels inscrutable to me. I know that a lot of that might be because it's written by an LLM, but the page seems like it's full of private language and is the product of a deep context conversation with your agent that I don't have enough context to understand.
Yeah. The concept is quite large and hard to understand - beeing the inventor does not make me the best explainer of the system, and english is not my native language. People grasp it more in a personal conversation and seeing it in action.
tix.im combines conecepts of expert systems with LLMs and other AI systems. Everything is composable via nix flakes. Any change is modeled via workflows that run in isolation. Each step type, is composed from the nix flakes defined and installed in the environment. Not only the projects nix flake (devshell), but also the tix project enabled experts. vx-maintainer is my software development expert - does only know about conecept of software development. Each workflow implemented is steps and workflows. For example, each change lands via land-feature workflow, it has ~40 steps. Workflows have complex parameters that define the flow inside the workflow DAG. In this case, rebase is mechanical, if it fails, medium smart rebase fixer is spawned, then mechanical step checks if all commits arrive in the rebase. Then it builds a collections, spawn a review swarm, open-code-review, etc... everything is tracked in an own issue tracking system and workflows can be restarted with minimal overhead.
Then I have an optimized queue-manager, an own agent prompt with an goal that can never be fulfilled. He manages that items from the tracker get done and land, extra workflows mechanically later check the landing.
rust expert, knows about rust specifics, has snippets, agents, skills etc. security expert has workflows with red-teaming, cyber models that get registered at the internal LLM gateway for usage, ...
I start to model everything in my daily live as an expert system now, with workflows that can be used by other expert flakes.
Workflow steps can be shared and also run wayland and x11 apps, rmux multiuser sessions etc. So, my goal is to move most of my tasks into some specialized environment.
And this is just a small part of the architecture - it is fully decentralized and user owned.
personally have started going the other way: AI-assisted microkernels, and only the programming that is actually needed for the problem at hand
my webserver never needed a million lines of code just to pass bytes to other people
Do you have an example in public? Or are you interested in sharing more here? Very curious about this.
I think what's fascinating is that the mentality of "It's too painful to attack" as a security strategy isn't working anymore in the era of AI. A lot of open issues and bugs were kept because folks assumed as long as they were less vulnerable than other folks they would be fine. However I think that paradigm is being phased out since AI can take the pain of sifting through decades of old code for us to find these vulnerabilities.
I can't help but feel a lack of investment in new product and feature work.
Instead we're spending the time churning out busy work fixing bugs that were too low value to care about a year ago. We have a new street lamp so we're working on anything it illuminates.
I haven't really seen the same kind of push towards verifiable software. It's mostly around solutions that will perpetually burn tokens and justify usage of the new toys.
Mine is a cynical take for sure but I honestly really miss meaningful feature work but that's not what the market's interested in right now, I guess
I'm personally not sharing the connotations of negativity towards software development and the term technical debt. I keep reading implications that most of this has always been in some way preventable, but it really is not that simple. How did nobody find these types of exploits 40 years ago? Why are we suddenly shocked and blame the field for this? I think the majority of people severely underestimate the complexity and seriousness of software. Once that perception stops and the economic incentives are right, we can start to look closer.
Just consider how laughable some working conditions in software are and then come to realize how architecture is shaped by the organization communication patterns and not reality. You will see it in a different light then.
> Just consider how laughable some working conditions in software are and then come to realize how architecture is shaped by the organization communication patterns and not reality.
I've never considered this problem from this perspective, but damn, I think you're dead on.
You could just as easily headline this as:
AI is enabling us to fix longstanding software security issues that nobody had the time, skill, or desire to find
All a matter of perspective, I suppose.
> that nobody had the time, skill, or desire to find
They've always had the first two to varying degrees - it's the desire that killed most motivation.
Time and desire are derivatives of money. Skill, too, largely, though less directly.
Should be something like:
> nobody is paying to find and fix
AI lowers the cost, but certainly doesn't eliminate it. I think we can hope significantly more technical debt will be paid off, but don't expect too much.
At least it can potentially help close the bugs too at scale.
> As far as anyone is aware, disaster has been averted: The hack was discovered by cybersecurity researchers who reported it to the PHP Foundation, and a patch was released before any bad actors got their hands on the exploit.
Aren't there still vulnerable services right now being hacked?
Yeah... sorry but that's not a technical problem, that's a business problem.
Everybody wants a $1 Website, avoid security updates, pay nothing for maintenance, and done yesterday.
It has nothing to do with AI or a specific language or stack. As long as cost cutting will be the culture, driven by the economical model of competition, then we will accumulate technical debt BECAUSE it is the strategy.
And that's the biggest win with AI. With old-fashioned development, it was considered acceptable to defer addressing valid feedback ad infinitum, hiding behind whatever lousy excuse you could come up with. No more.
Everyone’s levered to the tits in tech debt.
Now the interest rate is going up.
That's a weird way to say creating 40 years of technical debt per year.
The most pessimistic interpretation is that AI is superhumanly good at exposing technical debt and not that good at avoiding it.
We'd be replacing decades of technical debt with debt we'd have no hope of paying.
Yep, the takeaway from this should be that we move to leaner applications that can be actually be formally verified. But what I imagine will actually happen is that we'll patch over these vulns with AI that produces 10x the amount of code, just for the next generation of AI to find vulns in that so we can patch that with more code, repeat ad infinitum.
And you know how are those technical debts created in the first place? More than 40 years of negligence in IT infrastructure.
What does that mean exactly?
For my part, I have my pet neglects based on observing the parade of hacks: private companies neglecting to fund open source projects upon which they rely; private companies neglecting to fund product security staffing and remediation sufficiently.
We've patched more bugs and more vulnerabilities in the last 3 months than entire years at my last job.
I fear it's only going to get worse.
Does it feel like you are happier with your codebase as a result?
Worse?
Better you mean? Or are you saying you prefer having unfixed bugs?
Worse as in having to stay up late patching more bugs.
Of course no vulnerability has ever been found by a human or by fuzzing.
AI does find things, but it is a small percentage the overall vulnerabilities.
IEEE is of course and industry owned organization that shills for BigAI, NSA and any other entity with money or influence.
You're joking right? I work on a place public software product and over its ~15 year life we've gotten over half of validated vulnerability reports that we have ever had on it within the last year. We basically had to stop feature development for 6 months to burn that down, even with AI providing correct fixes for 80% of the vulnerabilities that were reported.
> Of course no vulnerability has ever been found by a human or by fuzzing.
Who do you shill for? because that sounds like someone who want to fuel the flamewar.
Why are there so many accounts on HN that only post one-liners?
I'm sure the NSA has an eye on the groups that are asking AI about security issues in various popular softwares ...
The amount of e-mails I get of the form "Important information regarding your xxxxx account" (which essentially is just code for "we've been hacked and your data has been stolen") is quite concerning, but not surprising. Security by obscurity was always big in most companies, as long as the bar to carrying out sophisticated attacks was putting a costly IT professional to the task you could be relatively relaxed as no one would bother to hack your stupid little e-shop, but now carrying out such an attack costs a few cents to a few dollars at most, that changes the game entirely and everyone is a target.
This summer I had my Docker registry poisoned with malware artefacts, which again is something that no sane attacker would do before as it required downloading my images, carefully modifying them and then overwriting them, ensuring they work as before. Now it's just a simple prompt away. I am definitely ramping up my defenses, everything that doesn't need to be Internet connected goes behind double VPN and port knocking schemes, essentially making my infrastructure invisible from the outside, all unknown packet types get hard dropped, end-to-end encryption of all internal traffic, web endpoints behind CDN proxies and WAF providers (as much as I hate doing that), double and tripe security mechanisms everywhere, maximum restriction of privileges, ultrafast automated patching and AI based continuous monitoring, audits and interventions. You should also get used to that, this will surely still get much worse as attacker tooling gets better.
I'm not going to lie, I'm having a great time thinking at the endless discussions around unsafe languages and the relentless smugness of many practitioners claiming everything was fine as long as the responsible and the skilled (them) were in charge; and let's not forget the formulaic "with great power comes great responsibility" closers.
Well now, Great Responsibles, it's clear you too were out of your collective depth and were all paying for your smug hubris. Perhaps take a bite out of that humble pie you've obviously never tasted?
Better sooner than later, to be honest.
luckily it will help us paying it off too
Yeah but AI also helps in lowering the debt ...
Maybe now developers will stop fighting tooth and nail to not update libraries and programming language runtimes and so on.
At my current day job, if I mention “hey, how about you update PHP to at least a supported version” people start whining about how that takes a lot of time and if really anyone would try to attack our public facing services written in… PHP.
Next time we get hit I can sit back, eat some popcorn and say “told ya’”.
These threads with doom and gloom about the modern internet seem full of people who either never experienced or forgot what it was like at the beginning of the century. Back when the internet was fair game to anyone who kinda understood it.
Back then, you could log in as admin to any phpBB forum by copying a generic admin cookie from a shady web site. You could often then also compromise the hosting company that was running the forum, because nothing was really separated.
You would try to trick your friends into installing Sub7 so you could open their CD drive.
You could easily capture other people's data on public wifi networks in restaurants and hotels.
You could change the price of the pizza you were ordering through devtools in your browser.
You could infect half the world by emailing a picture of a blonde tennis player.
Sure, there have been quite a lot of pretty serious zero days recently. But many of them have been pretty hard to actually abuse, in part thanks to all these layers we've added over time. So I guess I'm not as pessimistic as many of you are. Especially because we all seem to be incredibly aware of what's happening and are acting on it.
The real slop was the human slop we made along the way.
While we're at it, I'd appreciate easy secure authentication of a device without having to pull in a third party authentication provider. Thanks.
It also inflated almost all of that debt away, though. So in a way people who built "just ship it" buggy things in the last few years, made the right bet.
I think we'll look back at this moment as peak C/C++ before they begin a long, slow decline into irrelevance.
I've been bullish on Rust for years because memory safety is simply too important and Rust can essentially prove an implementation correct and solve a certain class of very important bugs. It doesn't solve every problem and there is a complexity cost.
I've also said that writing multithreaded code is simply too complex. In an era of out-of-order execution, different levels of caching, asymmetric cores, hyperthreading (although this is largely dead now?), branch prediction and having to support multiple architectures it's simply too hard for most people to write correct multithreaded code. Period. If you find yourself as a non-library developer creating a mutex or spawning a thread, somebody has screwed up.
This is also why I think the single-threaded async/await model with post-request teardown of PHP is the correct choice for most people.
We're going to go through a dark period of a lot of 0days. As the article notes, this is paying 40 years of technical debt. It will result in a more secure ecosystem however. I believe this will ultimately also hamper black markets, governments and 3 letter agencies who trade in those 0days.
As painful as this all is, it will ultimately be a good thing, one of the few to come out of AI (IMHO).
Spawning a thread can be pretty safe, if there's no mutable shared state.
> PHP, which originally stood for “personal home page,” is a programming language created back in 1994 and largely used by legacy sites.
Wow. Love it or hate it, but tell me you have no idea what PHP's place in the web ecosystem is without telling me you have no idea what PHP's place in the web ecosystem is.
Why are we even discussing this article? Do you know who Dina Genkina is and what are her contributions to the field?