Security analysis is finally reaching software's long tail

This post was formerly titled “17 bugs in 10 weeks from AI security scanning”.
It was changed upon feedback from trusted readers who suggested, while accurate,
it did not give a good sense of what I’m actually arguing in the post.

Over the last several weeks, I’ve been receiving more security bug reports for
Perfetto’s trace processor than I ever have before, all of them found by AI. And
I’m very happy about it! These are bugs that would almost certainly not have
been found a year ago and it feels good to close these loopholes even though
trace processor is by no means security critical.

For years, security researchers concentrated their time on the highest-stakes
targets: kernels, cryptography libraries, password managers. But there’s a lot
of code out there which is security-relevant but not truly security-critical. In
my experience, these sorts of projects didn’t draw much attention. Now systems
in the long tail can get that attention which they wouldn’t have before.