AI, decompilation and the future of SaaS

Free-flowing thoughts during my morning walk, to get some blood flowing to the brain.

Alarmism on Instagram

Yesterday a friend showed me an alarmist video: “AI can decompile installed programs, take a character from one game and put it into another, so security is over”.

Hold on. I’m not a cryptography expert, but I studied it enough, I even wrote my thesis on it. And there’s one thing I feel I can say: decompiling a binary and breaking an encrypted system are two very different things.

Decompiling isn’t breaking encryption

A binary is a program you don’t have the source code for. Decompiling it means understanding how it works, not breaking any encryption.

The real fear, for cryptography, is quantum computers: they reason differently from today’s processors and could make tractable problems that aren’t today, cracking keys. But even here, post-quantum algorithms already exist, designed to hold up even when, and if, large-scale quantum computers arrive.

The real problem: zero-days

We’ve already seen the serious problem: exploiting zero-day bugs, starting from open source code or with cybersecurity-expert approaches, and sneaking into online systems. It happened at Hugging Face and in many other places, in very little time and with very little human effort.

On desktop and mobile apps the vulnerability is the same as always. A reverse engineer used to take a long time, now it takes little. But keys stored in the Android or iOS keystore stay there, barring big holes. You can decompile the app, see which endpoints it calls, pretend to be the app… (I’ve done it in the past for fun, don’t you do it!). But that’s a different story from getting at the secrets.

The Dark Software Factory

And here’s the point. Today cloning an application is very easy. You study a web app by using it, extract its logic, and with enough tokens in one to five days you have frontend, backend and most of the edge cases. The missing ones? An angry customer shows up, you run an agent pipeline and fix it.

I’m doing it, so I can confirm it works. Think of all the small management apps out there. It’s what they call the Dark Software Factory.

All the sales, trust and administration side is left out, and it’s essential. But the technical side works like this today. Antirez wrote himself a CAD in a couple of weeks: he’s a genius, but without these tools he’d never have had the time.

My prediction: SaaS like airlines

Baldarn’s prediction: SaaS prices, at least for products people don’t get attached to, will converge towards operating cost plus maintenance. A bit like airline flights, where margins are now razor thin.

If a management app costs €1000 a month to run and whoever sells it makes a good margin, that margin will shrink to the minimum. Software will cost like a T-shirt. I think it’ll happen within a few years.

What do you think? Tell me in the comments on the video (it’s in Italian).