Post

Anil Dash
@anildash.com

As I have been saying, the entire mainstream software development supply chain is in a “Y2K 2.0” situation now, and it’s just a question of whether people are treating it as such. The common practice of relying on third-party software dependencies has been radically changed. Behaviors have not.

Zack Whittaker@zackwhittaker.com

In other Sunday news, cloud app giant Vercel says it's been hacked that involved "unauthorized access to certain internal Vercel systems." Some customers' affected, though it's not clear if any data was taken. Doesn't say what the security incident is, though, exactly. Unclear if Vercel yet knows.

vercel.comVercel April 2026 security incident | Vercel Knowledge BaseWe’ve identified a security incident that involved unauthorized access to certain internal Vercel systems.
LP
@lloydphilip.bsky.social

So if AI can exploit vulnerabilities, could coders use AI to identify these issues before they put it into production? And then have newer more powerful agents regressively identify vulnerabilities on a periodic basis?

Anil Dash
@anildash.com

Yep, and that's happening already, there's a sort of arms-race happening here. But the challenge with security at scale is that the good guys have to be right every single time, and the bad guys only have to get it right *once*. So that asymmetry makes the stakes really high.

LP
@lloydphilip.bsky.social

This is the case in every aspect of life. Good guys always have to be through and one step ahead. And when they get screwed, they have to prove to courts they were screwed. And 17 years later maybe the courts side with the good guys.