keeda

That is a great definition of adequate for security! My point is that at scale, bureaucracy is a necessary (though not sufficient!) condition for achieving adequate security.

Another way to look at it is, bureaucracy is an aspect of the corporate culture, and lasting security comes down to having the right culture. At least in that respect Microsoft is doing something right. Doubtlessly a lot of that bureaucracy is ineffective, but it's a signal that the cultural intention exists.

As a relevant counterexample, we've never heard of these kind of processes at Meta and so you get Cambridge Analytica.

My perspective is skewed by my experience being on a security-adjacent platform team for years. Our biggest challenge was not external threats, it was internal teams seeing us as friction on their productivity, to the extent that it regularly led to escalations.

So when Cambridge Analytica happened, I played it up for all it's worth; Meta may move fast because they didn't have our "bureuacratic team", but look where it got them! Unfortunately the $25B penalty happened just last week... I'd have gotten infinite political mileage out of that.

My take is that at least until we achieve our destiny as an immortal, intergalactic species, there will always be a need for more intelligence ;-)

Of course in the short term we have to deal with pesky things like rent and food, for which we need jobs that are little more than filing TPS reports, which keep us from making progress towards our destiny…

But in the long term, after the economy implodes because AI starts filing all the TPS reports, and we rebuild it for a future where humans are actually allowed to reach for their full potential, we’re gonna need all the intelligence we can get!

On the other hand Bernie wants the government to take a 50% stake in the AI labs. Can we make up our minds, do we expect the bubble to burst or do we expect a windfall? ;-P

Either way Anthropic will IPO soon and we’ll be one step closer to finding out.

One thought I had is that, bubble or not, this technology is likely going to upend economies of entire nations and impact all people, so it would be better if controlled by the people which is (in theory) represented by the government.

Looking at this as a backdoor bailout is the wrong perspective; it should be more like giving the people control over their economic future.

Correlation is not an absolute measure here, it’s relative. As is the entire concept of security.

As is what constitutes the standard of “adequate.” Which BTW is the standard in ALL engineering (not just security or software) because we live in a world where economic pressures apply and costs must be managed. Trivial example: bridges only use an “adequate” amount of steel and concrete because they are not free. The word “adequate” fundamentally involves the concept of tolerances. There’s a reason we consider over-engineering a bad thing.

So which development approach would you say is better correlated with good security outcomes?

Yes and no. They (or anybody else) are not guaranteed to be secure, of course; see all the compromises regularly found in cloud providers; Azure especially has had so many cross-tenant vulnerabilities (there’s one on the front page right now!) that I’m amazed the concept of public multi-tenant clouds still exists.

But they are also very highly incentivized to be more secure. They have millions of customers (hence a correspondingly higher expectation of trust) and billions in revenue from the trillions in economic activity happening on those platforms (hence a correspondingly larger target on their backs.) This means exponentially higher liabilities. And that probably matters more than any other factor.

Having crippling bureaucracy does have better correlation with security outcomes than the “move fast, break things” philosophy that most of the software industry lives by.

I’m not even blaming Zuck for that, he didn’t really invent it, though he certainly popularized it — he just made an astute observation of the dynamics in software and turned it into a company motto.

Right, I don't necessarily think Google will lose its userbase -- although ChatGPT and Claude and heck, even Muse, are formidable threats -- but I do think its ability to monetize each user will drop sharply as users shift to AI search.

Like, in the theorycrafting in my comment that I linked before, I didn't assume any change in userbase; just how lucrative (or not) each step in a chat-based journey could be versus a search-based one.

I should have been more precise, it depends on what you mean by "search" -- traditional search is still a huge cash cow, but AI search is not as lucrative, which is what the exec called out in that Ars link. The problem is that AI search is rapidly replacing traditional search.

Personally I have doubts that AI search would ever be as lucrative as traditional search, which I expanded on in that comment I linked.

“Recently”?? Have people not seen the findings of the AdTech Antitrust lawsuit they lost? Y’all should google it (heheh) especially the ad auction rigging parts of it, including Project Bernanke.

What they’re doing now is just being a lot more overt about it, because they want to carve up their old cash cow to feed their AI ambitions before ChatGPT and Claude eat it up first.

It's a more correct oversimplification than the other one though ;-)

Like I'd be really curious to see evidence of people saying, either directly or indirectly, that "we should be suspicious of competence and excellence."

On the other hand, you already mentioned concrete evidence of money-seeking causing disasters: Boeing.

Right, we don't know about this one, but typically there are some corners being cut somewhere or some other money motive lurking in the background, like the Boeing one OP mentioned.

To me it seems the opposite is happening: the push for higher profits by the Capitalists is overriding the competence of rank and file, resulting in these disasters. And all these profits just shoring up wealth that is accruing unequally to those same Capitalists is what is inciting socialist sentiments.

To me Ayn Rand's writings always seemed like an Economics Horror story: effective at instilling dread in its readers, but of some highly unrealistic boogeyman.

“Software used to be horrible. It still is, but it used to be, too”