←back to thread

837 points turrini | 1 comments | | HN request time: 0.207s | source
Show context
titzer ◴[] No.43971962[source]
I like to point out that since ~1980, computing power has increased about 1000X.

If dynamic array bounds checking cost 5% (narrator: it is far less than that), and we turned it on everywhere, we could have computers that are just a mere 950X faster.

If you went back in time to 1980 and offered the following choice:

I'll give you a computer that runs 950X faster and doesn't have a huge class of memory safety vulnerabilities, and you can debug your programs orders of magnitude more easily, or you can have a computer that runs 1000X faster and software will be just as buggy, or worse, and debugging will be even more of a nightmare.

People would have their minds blown at 950X. You wouldn't even have to offer 1000X. But guess what we chose...

Personally I think the 1000Xers kinda ruined things for the rest of us.

replies(20): >>43971976 #>>43971990 #>>43972050 #>>43972107 #>>43972135 #>>43972158 #>>43972246 #>>43972469 #>>43972619 #>>43972675 #>>43972888 #>>43972915 #>>43973104 #>>43973584 #>>43973716 #>>43974422 #>>43976383 #>>43977351 #>>43978286 #>>43978303 #
vrighter ◴[] No.43971990[source]
Don't forget the law of large numters. 5% performance hit on one system is one thing, 5% across almost all of the current computing landscape is still a pretty huge value.
replies(2): >>43972020 #>>43972063 #
titzer ◴[] No.43972020[source]
It's about 5%.

Cost of cyberattacks globally[1]: O($trillions)

Cost of average data breach[2][3]: ~$4 million

Cost of lost developer productivity: unknown

We're really bad at measuring the secondary effects of our short-sightedness.

[1] https://iotsecurityfoundation.org/time-to-fix-our-digital-fo...

[2] https://www.internetsociety.org/resources/doc/2023/how-to-ta...

[3] https://www.ibm.com/reports/data-breach

replies(1): >>43979329 #
1. timewizard ◴[] No.43979329[source]
> Cost of cyberattacks globally[1]: O($trillions)

That's a fairly worthless metric. What you want is "Cost of cyberattacks / Revenue from attacked systems."

> We're really bad at measuring the secondary effects of our short-sightedness.

We're really good at it. There's an entire industry that makes this it's core competency... insurance. Which is great because it means you can rationalize risk. Which is also scary because it means you can rationalize risk.