Just the rumour of a bug is enough to find an exploit these days

Bend the spoon*

* for people who don’t know the ref

Right? If you move between file system or device I would expect "move" to be impossible. At best you could copy a logical block and then delete a logical block. If you share a filesystem then perhaps a logical block is a few hundred kilobytes. If you don't then I'd expect the smallest logical block to be the file itself.

> Delete them after you copy.

Why is the word “you” in there, as-if that is inherently manual labour for me to carry out?

I know! Move is two operations under the hood.

Rclone automates this trivial two step action.

Azcopy does not.

Well, they at least say that one is obligated to address bugs in a timely manner (where "not widely exploitable; won't fix" is a perfectly valid resolution).

What regulatory requirement says software may not have bugs?!

  > But, isn’t it our job to impress upon the managers the importance, in a certain regard?

I think it is. But this appears to be an unpopular opinion and I'm not sure why. The question I'm still unsure about is if managers realize they are surrounding themselves with "yes men". The other question I'm still unsure about is if people realizing that not saying "no" (or "yes, but") is not meaningfully different from being a "yes man".

Our job is to engineer. Our job is to build (good) products. Information can't just flow top down, it has to go the other way too.

What seems weird to me is that during "the good times" in our field, that happened more frequently. A strong employee market (as opposed to an /employeer/ market) seemed to be good for employee, employeer, and the people buying everything. But myopia is quick to set in.

  > Alternatively, what about just doing the right thing?

That's the main motivation of why I speak up. There are consequences to our actions. Our choices may have small or little influence, but unfortunately the problem is that the world is complicated. The problems we face are mainly composed of many small issues that add up. I am surprised this is more contentious in places like HN as we deal with this every day. The way we solve big problems is we break them down into many different small and manageable problems. The only difference here is that we're viewing things bottom up rather than explicitly breaking them down. Though that is harder to figure out which small problems add up to the big problem. But we deal with this type of problem solving in programming all the time too.

If you haven't heard it before, allow me to introduce you to Pournelle's Iron Law of Bureaucracy[0]. I think one of the important things it states is that the second group is actually bad for business. I think there's a common misconception. People are often saying "well it is good for business", pointing to all kinds of messed up shit. I don't buy that. It is myopically good for business, but not in any meaningful length of time. Though then again, as Buffet says "The market can stay irrational longer than you can stay solvent." Michael Burry famous learned this first hand.

[0] https://www.jerrypournelle.com/reports/jerryp/iron.html

  In any bureaucratic organization there will be two kinds of people:
    -  First, there will be those who are devoted to the goals of the organization. Examples are dedicated classroom teachers in an educational bureaucracy, many of the engineers and launch technicians and scientists at NASA, even some agricultural scientists and advisors in the former Soviet Union collective farming administration.
    - Secondly, there will be those dedicated to the organization itself. Examples are many of the administrators in the education system, many professors of education, many teachers union officials, much of the NASA headquarters staff, etc.
  The Iron Law states that in every case the second group will gain and keep control of the organization. It will write the rules, and control promotions within the organization.

>They get rewarded because they appear to move fast, eventually become management, and the whole thing gets worse as time goes on.

We've got a winner. Devs respond to the incentives set by management, and the message I have received loud and clear, my entire career, despite protestation, is that I should ship faster and not worry about bugs so much, big or small.

That I take pride in what I do is the only reason motivating me to not ship bugs. That and the thought of being the cause of an incident makes me physically ill, even though we have "blameless culture".

>as they will spend most of their times on what to name variables and how to structure the packages and modules.

Incredible strawman of dev behaviour, I can only assume you are a manager yourself. I assure you, that's not what we're doing.

Why would they suffer? They showcased that they were big enough to disrupt the global economy. Why _wouldn't_ you invest in something so big and powerful?

This is the same as when junkies specifically seek batches of drugs on which others overdosed.

Because the purpose of Crowdstrike is not to prevent exploits or make computing safer, its purpose is to allow corporate CTOs to tick a checkbox.

  > Your answer makes sense for me only if your boss is Elon.

What about for everyone that works for a big tech company. The same still applies.

I know I picked very big numbers, but let's be honest, a more "modest" $50m and you have everything you could ask for. Put that in a safe 5% earning account and you're making $2.5m/yr, sitting on your ass doing nothing. Good luck spending all that in a year, consistently. There's nearly nothing out of reach.

There's far more people whose bosses are richer than that. But I think the problem is people don't understand what these levels of wealth actually mean. Money works differently at that level as it becomes harder to spend it faster than you earn it. Even those get in big tech jobs aren't living at those levels.

Clearly these people are addicted to something other than money. No billionaire actually cares about money. The money is a proxy

I buy that but it still leaves many questions. The goal is ultimately arbitrary, is it not?

Why not seek fame instead? Philanthropy? World records? Knowledge? Innovation? Adventure? Or many other things? Money makes all these things easier to achieve. These are less hated by the public. Using capital to seek these pursuits does not risk them losing their heads as the populous revolts. Power can still be had through many of these pursuits. To do the things they claim their companies do...

I don't think you're wrong, but it is far from a complete answer and that's why I ask

Yep, this is for maintainers releasing fixes to secretly-reported 0days without tipping off attackers who are looking to exploit a (sometimes very large) install base.

and those measures have always been merely annoyances. except for the VM methods which impact performance significantly.

now none of those methods matter as you can just instruct an LLM to bang its head against the wall until the wall breaks.