I don't know if it's a good time to blame the blocker, especially publicly. You don't know what people are going through. If they set a boundary, respect it and move on. It's a big world out there. Lots of other people to talk to.

If someone blocks you, it's a great time for self reflection. Were you in the wrong? Should you reconsider how you treat people?

Or was the person who blocked you too thin-skinned? Was there a conversation you should have had that didn't happen? How can you approach such people in the future differently?

Or did you say the hard thing that needed to be said? Was it worth burning the relationship to deliver some hard truth?

There are very few people who can "unfairly" block you.

Elected representatives, emergency responders, government agencies: their role requires a duty of access to you, no matter how much of a fuckwit you are.

The rest of us have a right, maybe a responsibility, to manage where our attention goes. There are no objective criteria whatsoever in who we choose to follow and who we choose to block. We are the sole arbiters of our attention and there is no court of appeals.

There was also a question of reverse discovery:

https://swicg.github.io/activitypub-webfinger/#reverse-discovery

I'd be happy to submit FEP 2c59 as an input for the task force:

https://codeberg.org/fediverse/fep/src/branch/main/fep/2c59/fep-2c59.md

@trwnh @jdlh @quillmatiq @thisismissem

@trwnh there's going to be a new task force to open up further discussion of Webfinger for ActivityPub, including using unicode usernames, and using bare domain names as usernames. As the co-authors of the previous report on Webfinger, I think we should participate. /cc @jdlh @quillmatiq @thisismissem .

If you found out a friend or family member was cheating, would you tell their partner(s)?

https://en.wikipedia.org/wiki/Infidelity

#EvanPoll #poll

@luc I added a calendar reminder!

I added a calendar event to remind myself to check.

Anyway, my answer is: slightly lower. The backlog drains, scanning becomes an essential part of releasing software, so this huge rise flattens out and drops a bit.

There are other factors at play, though. The fact that there are so many CVEs mean that people have needed to make filtered or curated lists. It's possible that over time those other reporting systems become more independent, eclipse the use of CVEs, and consequently people stop reporting CVEs as much. I don't think that process happens in the next 5 years, though.

As I write this, I realize that we have already had a big change in how we make software, namely, the models themselves. I don't know how tractable an open-weight model like Gemma is to static analysis, especially for security issues. So, maybe we'll see more happening there.

I think unless there is a big change in how we make and use software, the answer is no. Code complexity isn't an infinite resource; there is only so much interaction between components, lines of code, and external interfaces that can be tied together into an attack. As long as we make human readable, human sized code, there's a limit to how many security issues scanners can find.

So, what about scanners getting better? We've just seen a big step up in reports mostly attributed to Fable. Won't better models find more and trickier bugs?

I think this process will negate the problem with AI generated code. AI and human written code are both scannable.

Doing AI security scans is automatable; I think it will become common to run in CI before releases or even on each Git commit.

As long as the same models are available to everyone, the blue team will have mostly the same tools as the red team.

So, here's what I think: a rich vein of errors in legacy code is currently being mined by AI scanners. I think in 5 years that rich vein will be tapped out, and won't be as big of a factor.

There are three reasons commonly cited:

- AI scanners are finding a lot of security issues
- AI code generators are making more mistakes
- New processes have made it easier to report issues

The number per year has been overwhelming for a while; they have shot up ~2-3x over the last year or so.

https://www.cve.org/about/Metrics

CVEs are public reports of security issues, more or less.

https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures

Thanks to everyone who responded. Here are my thoughts.