This article might be a bit tongue-in-cheek but it's actually something I've been thinking seriously about for a while. I can imagine a future where every country and company writes their own operating system and that might actually be a very good thing. There is a security advantage in not using popular technology stacks and rebuilding everything public-facing in-house. Because with Mythos-level AI capabilities, it is almost guaranteed that anyone with access to Mythos/Cyber can find a zero day in your stack. If your stack is proprietary and bespoke with no public access to source code it's much harder to find vulnerabilities, because they can only probe your public facing interfaces.

▲

fc417fc802 3 days ago | parent | next [-]

This is the same erroneous reasoning as historical claims that FOSS was less secure due to being public. That has been disproven many times over by now.

The only way it might hold here is if no one with access to the cutting edge models bothers to run your code through one while an adversary does. That seems highly unlikely, particularly for any well funded organization.

That said I agree that monoculture is bad. Vulnerabilities like heartbleed or spectre are so devastating precisely because they apply to approximately everyone.

▲

znnajdla 2 days ago | parent [-]

AI has changed everything. Mythos/Cyber has made the Linux virtual machine sandbox useless: https://blog.trailofbits.com/2026/08/26/vms-wont-contain-cyb...

> The only way it might hold here is if no one with access to the cutting edge models bothers to run your code through one while an adversary does. That seems highly unlikely, particularly for any well funded organization.

But since AI models are non-deterministic and the harness matters a lot, simply "running your code through one" doesn't guarantee you'll find all the zero days. An attacker can simply run a few more iterations or use a slightly more advanced harness, or increase the temperature level and they are likely to find zero days which the maintainers didn't.

	▲	fc417fc802 2 days ago \| parent [-]
		> But since AI models are non-deterministic and the harness matters a lot, simply "running your code through one" doesn't guarantee you'll find all the zero days. The exact same line of reasoning applies to human security researchers and pen testers as well. The only difference is that automated testing via frontier models is affordable even for individuals. The VM comment is total nonsense. That's only going to be the case for an extremely short period here until the major projects all adapt their release procedures to include automated security audits. I imagine the kernel as a whole and KVM in particular will begin receiving a huge amount of such attention. I also expect increasing amounts of such load bearing code to be formally verified as the primary barrier to that has always been the amount of human time required.

▲

inigyou 3 days ago | parent | prev [-]

They won't be compatible with each other, guaranteed. Compatibility in reality comes from everyone using the same reference implementations that have been compatibility-tested, not from everyone implementing the same specifications.

	▲	convolvatron 3 days ago \| parent [-]
		I used to do this work in the IETF. take draft specs and write a C implementation and compare notes with the spec authors and other implementations. sometimes I would find a bug later on and see the same bug in multiple vendors implementations, and I would send them mail describing the issue and the fix. its been very sad for me to see standardization get ignored, and the implementation become the point of reference. for a long time the only way to implement QUIC was to try to extract it from the Chromium code base - a pointless waste of time. but they spec for years was a couple of pages of meeting notes and a sample compression dictionary. if we continue down this road we are impeding our own ability to evolve. if compatibility is defined by the implementation then were left with nasty balls of antiquated source that we carefully move around and try to plumb into our new environments, but no one really understands. at the core, things like IP are very straightforward. we can and should specify the semantics of every bit, and have a wide variety of other implementations to test against. this provides a path for us to build new techniques and environments that are still useful in the world that exists today.