I finally cracked software liability reform.

(Said tongue -in-cheek.)
A bit.🙂)

IMHO, It's all about the right balance of voluntary action vs state enforcement of promises + imposition of regulatory requirements. And the integrated, smart use of different types of policy tools.

https://x.com/arekfurt/status/1924870643759116341?t=axBOnaY0yrn2tLBMQ5JAAg&s=19

(More details to come....

I suppose the good news, if you want to look at things that way, is that in the U.S. we've got at least a few years of time to think, discuss, and argue about things, refine ideas, and formulate proposals before the chances for reform open up again.)

Remember that the swiss cheese model of safety/security failure doesn't apply well to cybersecurity. At least in terms of its current general state.

Things are much, much worse in cybersecurity.

In the swiss cheese model, defense-in-depth exists to some degree. But there are just too many holes in each layer, too few layers, or some combination of both for protection to be robust enough to avoid catastrophe with extremely high reliability.

Meanwhile, in typical failures of cybersecurity in its current general state you might say, with little exaggeration, that there are more holes than cheese.

"AI" things are indeed probably going to improve code security.

The irony is that, if so, they'll do it by increasing the amount of barely working, security-flaw ridden junk that gets put in use so drastically the problem finally becomes unignorable at a societal/policy level.

We need liability and/or regulatory reform to start pressuring software & device makers to actually use reasonable efforts to prevent critical, easy-to-exploit flaws in new products.

And sooner is better. Because things can well stay in use for so long.

[Just note how many heavily expolited vulns discussed here are years or even a decade+ old.]

https://www.greynoise.io/blog/2025-mass-internet-exploitation-report

Device code flow phishing is a great example of an attack that (generally) isn't that worrisome if you're implementing network-based security in addition to main identity system-layer security but is quite worrisome if you just let attackers from anywhere on the Net attempt it.

https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-authentication-flows

Cross-posted RT from the former bird site:

A Russian threat actor is using device code flow phishing to be able to register devices to orgs' Entra/AAD setups. Which can enable them to get around use of the security measure of requiring user devices to be Entra/AAD joined to access things.

Not great.

https://x.com/ItsReallyNick/status/1890551910471499976