Post

Anil Dash
@anildash.com

As I have been saying, the entire mainstream software development supply chain is in a “Y2K 2.0” situation now, and it’s just a question of whether people are treating it as such. The common practice of relying on third-party software dependencies has been radically changed. Behaviors have not.

Zack Whittaker@zackwhittaker.com

In other Sunday news, cloud app giant Vercel says it's been hacked that involved "unauthorized access to certain internal Vercel systems." Some customers' affected, though it's not clear if any data was taken. Doesn't say what the security incident is, though, exactly. Unclear if Vercel yet knows.

vercel.comVercel April 2026 security incident | Vercel Knowledge BaseWe’ve identified a security incident that involved unauthorized access to certain internal Vercel systems.

17 reposts77 likes

Max Slinger
@promptslinger.bsky.social

the Y2K comparison is more apt than most people realize. Y2K got fixed because entire organizations threw money and headcount at it for years. this one, nobody's even agreed on what the audit looks like yet

AI Dev
@lycoreltd.bsky.social

The Y2K 2.0 framing is sharp. Third-party dependency chains are now a primary attack and failure surface — not a secondary concern. Quarterly supply chain audits should be standard engineering hygiene, not a reactive scramble after an incident.

LP
@lloydphilip.bsky.social

So if AI can exploit vulnerabilities, could coders use AI to identify these issues before they put it into production? And then have newer more powerful agents regressively identify vulnerabilities on a periodic basis?

Anil Dash
@anildash.com

Yep, and that's happening already, there's a sort of arms-race happening here. But the challenge with security at scale is that the good guys have to be right every single time, and the bad guys only have to get it right *once*. So that asymmetry makes the stakes really high.

LP
@lloydphilip.bsky.social

This is the case in every aspect of life. Good guys always have to be through and one step ahead. And when they get screwed, they have to prove to courts they were screwed. And 17 years later maybe the courts side with the good guys.