pull down to refresh
That's exactly what I wanted to say but you put it more eloquently lol 😆
There's another, deeper issue though: devs have been losing control over their code.
I do the dependency hygiene for SN a couple of times per month and twice in a row have I found verified regressions in upstream packages coming from bugfixes, that according to their authors are written by bots. High-end, state of the art, bots.
This is bad, because it is debt. Plus I have to spend shittons of time to check if such a regression has impact, so it is super costly on the consumer side. Note that these are packages with 100s of 1000s of deployments, and for sure, "automated security" like socket.dev didn't see it - thus far it has called me out with false positive findings every single time, but not once has it alerted on a regression that I spotted.
So, I think that if you are a serious project then your security budget, even if it is just measured in the time you spend plus maybe some tokens, must go up. Preferably yesterday.
No one was singling or is singling out anyone. It's just about low hanging fruit. All the fruit hangs a lot lower now, because the paradigm shift is about cost to attack. So the things that were hard to spot a month ago are now easier to spot, and need less effort to be stolen. And it's a bit of a race to identify what's up and what needs to be defended.
Liquid things go first. Bitcoin, banks, high value information. Once all the low fruit has been plucked, other, lower value things are next. Especially: large repositories of data that can be held hostage. You're just seeing it here first. If you're in any other business that has any data (most businesses do) you're just down in the queue a bit. If I were working for any non-Bitcoin company, I'd be doing the beefing up right now. At full expense.