pacificpendant

If all the libraries are rust as the article claims having the top layer in Python probably makes even less difference.

I tend to agree with the article’s statement about the value of the test code though, may even have been true before LLM code took over.

Without giving away exactly how old I am…

I am old enough to remember old programmers complaining about the wave of new shareware/freeware apps that people made with Visual Basic when that came out. Many of the apps were visually awful because it opened up desktop app development to people with no aesthetic experience.

I don’t see that awful style any more despite those tools for rapid UI creation still existing, did those people get better or did they get bored and move on to other things?

I guess the same will happen with vibe-coders, they’ll get the experience to make better software or their poor quality apps won’t give them what they want and they’ll move on.

The article is relatively clear that it is an assumption that the apps are vibe-coded based on the jump being so large. I guess they could’ve tried to cross-correlate that with sales of books or courses on app development that vibe-coders wouldn’t need.

There are a few examples of the types of apps people are making in the comments on this page and it sounds like a lot of the time it’s custom apps for a personal itch that might appeal to very few other people.

Similar to how I have Python scripts on my computer that I won’t publish. They’re not production quality, but I know how to deal with their quirks. I suspect a lot of the apps mentioned in the comments are similar and maybe that’s fine.

I imagine some of the rise is people using AI to clone existing apps too.

I’m not the person you’re talking to but the stats are copied from the second link in the post, the web archive one.

You’re right that SBOMs cannot be used to attest that a library is correctly used. I’m not sure if that’s a common use-case of SBOMs though. I normally see people wanting SBOMs for security transparency (customer can see if you’re maintaining your dependencies), vulnerability management (customer can know what vulnerabilities lurk in the dependencies) and license compliance (they can know you didn’t use any dependencies with licenses that cause commercial issues).

Related to your point though is that just because a dependency is vulnerable doesn’t mean the software using it is affected too. It might not use the functionality that’s vulnerable. Which means a supplier needs to share their assessment of each dependency vulnerability.

A long time ago, so the details are vague and may have changed, I was interested in adding trees and tagging their species in OSM. I asked some people that know more about OSM than me and was told that OSM doesn't want to store data that isn't used for rendering the maps.

There are sometimes links to external data in OSM using Wikidata for example.

I had regular emails from a security testing tool telling me that internal IP addresses were being exposed on a webpage, in reality the page was a forum post where someone had pasted some console output including an IP address they were working with. In the end I blocked the emails from the tool because I wasn't allowed to mark things as false positives.

If a tool wants to remain relevant it should try to minimise false positives, in some cases this might mean removing rules that are going to throw false positives significantly more often than true positives. Tools should also be run such that anyone that receive alerts should be able to flag false positives with minimal effort.

The response to this false positive could be to fix Prometheus, but if you end up having to fix lots of things it's more of a sign of a bad rule that is making you concentrate on things with a low value to the goal of improving security.

In one of the TV interviews a cave rescuer talked about a rescue where an inexperienced diver was restrained whilst being brought out of a tunnel. Given the distances involved here it would seem unlikely they would sedate them.

EDIT: "Mr [Peter] Dennis also said he thought the boys would have been lightly sedated by a doctor who joined them in the chamber, to prevent them from panicking during the journey out." From the BBC live reporting webpage.

When people say things like "serious possibility" they are not merely intending to alter the perception of the likelihood but also attempting to impress upon the listener the gravity of the event.

In cold war era America would people have felt any different knowing that a Russian invasion was only 20% likely rather than 30%? For something so /serious/ any non-zero probability is something that should be prepared for.