For the longest time I had been trying to figure out why nobody was taking the research seriously, why there weren't diagnostic kits available that determined which variant people were actually suffering from, and using the appropriate drug regime to manage the specific condition the patient had.

Then, last year I saw a paper being discussed (some 5 - 10 years after the initial paper), and it was building on the Washington research - it appears to me now (keeping in mind that I am a layman and an outsider) that the research /had/ been taken seriously, but it's seen as a signpost on the pathway rather than the destination.

I mean, the covid vaccinations - people are/were doing their nut about the Euro/US versions, but the Russians had their own, the Chinese had two, and I am aware that the Chinese were handing it out to other countries as part of their aid programs (the effectiveness of those vaccines, however, has been questioned, especially in comparison to the Euro/US ones, but I'm not sure if that's reality or politics, it's so damned hard to tell these days)

You're correcting someone, so it's clear that your understanding isn't universal, and example code is the absolute minimum.

This is the basis for "correlation points to possibly fertile grounds for an investigation"

My point remains: if we misattribute the cause of the rising vulnerability rate (discovery vs. creation), our 'educated guesses' will lead to solutions that address the symptoms while the underlying problem continues to fester. Calling precision 'blabbering' is exactly how we end up with the 'false sense of security' mentioned earlier.

Exhibit A:

ragall 2 hours ago | root | parent | prev | next [–]

> How do you know?

We know because we could see the effects of the average rate of vulnerabilities discovery and exploitation, and it's definitely going up very fast. Until recently, vulnerabilities were relatively hard to find, and finding them was done by a very restricted group of people world-wide, which made them quite valuable. Not any more.

Exhibit B:

ragall 2 hours ago | root | parent | next [–]

Very often you only have limited time for investigation and you have to act now. Action is almost always based on educated guesses. reply

But that's not accounting for all of the discoveries, not at all.

I've also seen the npm people talking about the surge in AI code overwhelming the ability to properly review what's being distributed, and a large number of vulnerabilities being attributed to that

However I wanted to also point out that relying only on educated guesses can lead us into a position where we are "papering over the cracks" or "addressing the symptoms", not the "underlying cause"

Yes, sometimes that's all that can be done, but, also, sometimes it can be more damaging than the cause itself (thinking in terms of the cause continuing to fester away, whilst we think it's 'solved')

Uh, no.

Correlation is only ever one thing - cause for investigation.

Everything based on correlation alone is speculation.

You can speculate all you like, I have zero issue with that, but that's best prefaced with "I guess"

edit: Science captures this perfectly, and people misunderstand this so fundamentally that there is a massive debate where people who think they are "pro science" argue this so badly with theists that they completely hoist themselves with their own petard.

Science uses the term "theory" because all of our understanding is based on "available data" - and science biggest contribution to humanity is that it accepts that the current/leading THEORY can and will be retracted if there is compelling data discovered that demonstrates a falsehood.

So - because I know this is coming - yes science is willing to accept some correlation - BUT it's labelled "theory" or "statistically significant" because science is clear that if other data arises then that idea will need to be revisited.

It could equally be argued that the AI slop that's being produced makes for a lot more vulnerabilities being shipped. The bigger target makes for the easier discovery.

I would like to see actual evidence of this, not.. vibes

I mean, this reeks of "Anyone is a Principal developer now" when the truth is there is still work to do.

"Our team used Go"

"Rewrite it in Rust"

Funny, we credit technology all the time.

Ha! I find that Gemini is quite useful - if only because I am forced to use it (on my personal projects) because it's the only one that has unlimited interaction for "free"

It has its limitations, yes, but so does Claude (which I am leaning on too heavily at work at the moment)

It means that future readers understand where it came from, and can look at that source to see more rationalisation about it than what I can provide.

DMR, Kevin Thompson are credited with creating C and Unix, but they were paid employees of AT&T - where's the issue with them being credited for their work?

But, just inserting the tag because it's being used for git commands - there's a line there.

> Does throughput really matter more than latency in everyday application?

IME as a user, hell yes

Getting a video I don't mind if it buffers a moment, but once it starts I need all of that data moving to my player as quickly as possible

OTOH if there's no wait, but the data is restricted (the amount coming to my player is less than the player needs to fully render the images), the video is "unwatchable"