This is the new playing field, but this game can't last forever. Most software is not churning through a software factory of endless patches and releases. Most software, once mature, is mostly done.

I see a world in which we all get some generous Dependabot 2.0 on large forges because leaving so much software insecure otherwise is untenable, but once the software is not iterating a billion times a week, you're not introducing new classes of bugs just sitting there.

You can have a frontier security model pentesting your program every night while you sleep and you can wake up knowing that whatever happens, you did the best you could.

Alas, our brave new LLM world is making iterating one billion releases per week all too easy.

And on the positive side, LLMs make remediation much easier too. It took me around 15 minutes and a few dimes worth of DeepSeek tokens to upgrade some gnarly, janky, exploitable PHP 7.x code to the latest fully patched version of 8.3 today. Without LLMs, I would probably have been having a serious discussion about whether we should ditch the app entirely instead.

> Most software, once mature, is mostly done.

I think this is a dated mindset with AI in the mix. Not only is AI making it easier to do big-bang rewrites which wouldnt have been done before, it is making working on brownfield codebases more feasible. It is lowering the barrier to entry for non-devs to contribute to codebases. Most software did not stagnate because there wasnt a need to grow it more, it stagnated because the friction and/or cost of change hit a critical mass.

I think we are much too early into the "new era" of software to understand what it looks like tomorrow, especially in terms of what we assume to be true today.

> Most software, once mature, is mostly done.

The caveat being that most software never matures. Maybe it's a cynical take, but virtually all software I use regularly is updated at least once a month. Right now, I'm using Chrome, and I see the "Relaunch to update" button waiting for me to press it. I see the arrow on the Ollama icon telling me I have to relaunch it to apply updates. I have Visual Studio Code running next to my browser, and two extensions need to be restarted to apply updates.

But at least somebody is maintaining that software.