It's also worth pointing out that the developers at Mozilla literally decided to make a brand new programming language (Rust) that eliminated an entire categories of bugs and started working on a new browser (Servo) where its components could be switched into firefox.
Then Mozilla fired the team working on it.
Lesson 1: Better tools and processes eliminate bugs.
Lesson 2: If you don't have the tools, make them.
Lesson 3: Mismanagement leads to security vulnerabilities.
Yes, and even after introducing and using Rust, there were still vulns in the remaining code.
FWIW, Rust is my main language, so I am grateful to the humans that created it, and it is indeed a monumental effort. But vuln finding is a different kind of creative endeavour, and one that is heavily weighted against defenders.
You would choose rust (from a security standpoint) because it massively reduces memory safety issues (which from a Microsoft study was responsible for around 70% of bugs).
Then you look at things like linting, fuzzing, design by contract, proofing, deterministic test runs, etc...
If Apple wanted to make the OS more secure, they would make the OS more modular, allowing users to reduce the surface risk by not installing bloated components
You have the same long list for Sequoia 15.8, so how is that better? Besides, newer OSes are also more likely to have uniquely knew bugs from both AI slop and in general all the shiny new broken features
Yes, I should have been clear - I don't mind AI working on patches or vuln-hunting; my issue with MacOS 27 is the amount of AI included in the OS that is not opt-in. I use Claude Code everyday - but it doesn't run locally on my main production machines.
I'm still on Sequoia and I have zero intention of updating to this AI-saturated slop.
There are over 200 security patches in the newest versions of macOS. AI is helping patch previously unrealized holes.
> AI is helping patch previously unrealized holes.
AI is also making plenty of holes.
I have not seen a single case of anything that an AI has found that could not have been automatically found without AI.
Mozilla had 400 Firefox CVEs found by Mythos; if those were so easy to find, why didn’t humans do it before?
Humans did do it before.
------------------------
It's also worth pointing out that the developers at Mozilla literally decided to make a brand new programming language (Rust) that eliminated an entire categories of bugs and started working on a new browser (Servo) where its components could be switched into firefox.
Then Mozilla fired the team working on it.
Lesson 1: Better tools and processes eliminate bugs.
Lesson 2: If you don't have the tools, make them.
Lesson 3: Mismanagement leads to security vulnerabilities.
> It's also worth pointing out that the developers at Mozilla literally decided to make a brand new programming language (Rust)
In my memory, that does not seem 100% right. And indeed https://en.wikipedia.org/wiki/Rust_(programming_language)#20... says a single developer who happened to work at Mozilla started it as a personal project.
After a few years Mozilla became interested in it and then sponsored its development, transforming it into the language it is today.
Good point about the whole new language as a tool for eliminating many thousands(?) as a whole category
Yes, and even after introducing and using Rust, there were still vulns in the remaining code.
FWIW, Rust is my main language, so I am grateful to the humans that created it, and it is indeed a monumental effort. But vuln finding is a different kind of creative endeavour, and one that is heavily weighted against defenders.
Yes, which is why you don't stop at rust.
You would choose rust (from a security standpoint) because it massively reduces memory safety issues (which from a Microsoft study was responsible for around 70% of bugs).
Then you look at things like linting, fuzzing, design by contract, proofing, deterministic test runs, etc...
As I said above: use better tools and processes.
LLMs don't fit that criteria.
If Apple wanted to make the OS more secure, they would make the OS more modular, allowing users to reduce the surface risk by not installing bloated components
You have the same long list for Sequoia 15.8, so how is that better? Besides, newer OSes are also more likely to have uniquely knew bugs from both AI slop and in general all the shiny new broken features
i'm sure most of those patches will keep coming to Sequoia over the coming years
They've already come?15.8 has a long list of vulns fixed
Yes, I should have been clear - I don't mind AI working on patches or vuln-hunting; my issue with MacOS 27 is the amount of AI included in the OS that is not opt-in. I use Claude Code everyday - but it doesn't run locally on my main production machines.