Cloud Rats and Software Roaches

We are entering an epoch where it may become easy for small pieces of self-replicating code to permanently infest Internet-connected devices in a way that is hard to undo. Such a world would be annoying to live in and we should take steps to forestall it. Anyone who used email in the 1990s remembers a similar, primitive era, when worms and viruses briefly ruled the net. But the connected world of that time was too simple to sustain an ecosystem of rogue escapees. Even today, much of the internet remains a monoculture, with vast fleets of identical hardware running just one or two flavors of software that can be quickly patched at scale. And as practitioners, we have become used to a world where writing working code is difficult, writing bug-free code is impossible, and finding exploitable bugs is somewhere in between. This has led to a sort of dynamic stalemate. Big companies pour millions of specialist hours into hardening a small set of operating systems and cloud services, while…