🪶Chilcano

Why are the AI labs releasing cyber models? 1. There’s a lot of $ to be made 2. We’ve had extremely smart people make use of AI for security, setting a precedent, paving the path early There are other niches where this will apply, but few have both of these attributes. The problem with huge financial incentives, is they bring lies, deceit, sales psychopaths & charlatans exploiting the situation. As cybersecurity practitioners, it is very important for us to prevent their attempts to control our tools. We need to focus on self-hosted models, cheap alternatives, open-source models, and any way to decentralize tools and prevent big ai labs from monopolizing tooling. Cybersecurity tools for everyone, no guardrails, no KYC checks, no account managers or “contact sales” buttons

“Patch the planet, we can fix everything” is one of the most misleading, and harmful security initiatives I’ve seen. As if spending billions of dollars cooking the oceans to run swarms of agents spinning their wheels applying hourly? minutely? patches on every abandoned instance across the planet, racing against every incompetent sysadmin - no you will never catch up with human stupidity. And it’s completely the wrong direction. It’s this old school mentality that “I’ll stay in my IT lane, and just update every package and infra” as if this will ever amount to anything. As if this hasn’t been the strategy for half a century. Obviously you’re supposed to patch. But why be a hamster in a wheel spinning idly, while incompetent devs slop-cannon millions of lines of some of humanity’s most atrocious code ever conceived, bypassing every security recommendation, every known best-practice, to meet an arbitrary deadline set by their private equity overlords to ship some inane b2b saas that nobody is going to use, but will get everyone’s data leaked. You won’t patch everything. You won’t catch every bug. You know it’s stupid, it’s a helpless strategy because you don’t want to address the real root cause: making software that doesn’t suck ass. Engineering principles that aren’t guided by psychotic greedy men in suits that just want a return on their investment at the cost of everyone’s data. The problem is nobody gives a shit about breaches. “Cyber insurance covers this”, you send the breach notification, everyone shrugs as if it’s the accepted cost of living in society. So companies have no incentive to care. Some of the most incompetent passionless people become “engineering leaders” that “understand the business” of shipping atrocities, without an ounce of consideration or thought, pure monkey level poop-slinging. The worst code you’ve ever seen is production code, self-merged by the guy thinking increasing shareholder value is how you barely make it across the retirement line. “Move fast and break things” has been one of the most dangerous principles, and an embarrassing one to hold today. We have solutions. The dumbest dev can still ask a coding agent to find, explain, and address security issues in software architecture, and in implementation. And it does a better job than the majority of security engineers I’ve worked with. But they do the opposite. They go AROUND and bypass every security recommendation anyone or anything makes. I’ve seen Claude-generated comments in code saying “this is highly insecure but we have decided to accept the risk” for things with trivial fixes. God forbid, you’re going to have to work with devs. Teach them software design, architecture, planning how components and microservices interact, how to make safe code, how to keep it safe, ultimately just to be considerate. To care a little bit about your craft. “Patch the planet” is a waste of time. Invest in what we ship instead. It’s the ONLY way to make software resilient.