michael-bey

What a nightmare scenario to tabletop. How do you even begin to recover from something like this?

I was really disappointed when Signal went away from being used as an "everything" messenger, including regular SMS. I onboarded all my family and now because it's not a default messenger, nobody is using it.

>this is not a eulogy, it's a reckoning

100%

>There's been some skepticism about whether they are truly high severity

To be honest this is an even bigger problem with Semgrep and other SAST tools. Developers just want the .1% of findings that actually lead to issues, but flagging patterns will always lead to huge false positive rates.

I do something similar as what you suggested and it does work well -pattern match + LLM. The downside is this only applies to SAST and so far nobody has found a way to address the findings that make up 90% of a security team's noise, namely SCA and container images.