“Patch the planet, we can fix everything” is one of the most misleading, and harmful security initiatives I’ve seen. As if spending billions of dollars cooking the oceans to run swarms of agents spinning their wheels applying hourly? minutely? patches on every abandoned instance across the planet, racing against every incompetent sysadmin - no you will never catch up with human stupidity. And it’s completely the wrong direction. It’s this old school mentality that “I’ll stay in my IT lane, and just update every package and infra” as if this will ever amount to anything. As if this hasn’t been the strategy for half a century. Obviously you’re supposed to patch. But why be a hamster in a wheel spinning idly, while incompetent devs slop-cannon millions of lines of some of humanity’s most atrocious code ever conceived, bypassing every security recommendation, every known best-practice, to meet an arbitrary deadline set by their private equity overlords to ship some inane b2b saas that nobody is going to use, but will get everyone’s data leaked. You won’t patch everything. You won’t catch every bug. You know it’s stupid, it’s a helpless strategy because you don’t want to address the real root cause: making software that doesn’t suck ass. Engineering principles that aren’t guided by psychotic greedy men in suits that just want a return on their investment at the cost of everyone’s data. The problem is nobody gives a shit about breaches. “Cyber insurance covers this”, you send the breach notification, everyone shrugs as if it’s the accepted cost of living in society. So companies have no incentive to care. Some of the most incompetent passionless people become “engineering leaders” that “understand the business” of shipping atrocities, without an ounce of consideration or thought, pure monkey level poop-slinging. The worst code you’ve ever seen is production code, self-merged by the guy thinking increasing shareholder value is how you barely make it across the retirement line. “Move fast and break things” has been one of the most dangerous principles, and an embarrassing one to hold today. We have solutions. The dumbest dev can still ask a coding agent to find, explain, and address security issues in software architecture, and in implementation. And it does a better job than the majority of security engineers I’ve worked with. But they do the opposite. They go AROUND and bypass every security recommendation anyone or anything makes. I’ve seen Claude-generated comments in code saying “this is highly insecure but we have decided to accept the risk” for things with trivial fixes. God forbid, you’re going to have to work with devs. Teach them software design, architecture, planning how components and microservices interact, how to make safe code, how to keep it safe, ultimately just to be considerate. To care a little bit about your craft. “Patch the planet” is a waste of time. Invest in what we ship instead. It’s the ONLY way to make software resilient.

I read this and I'm terrified, the situation seems intractable. In the python ecosystem alone every cpython install, venv, UV is at risk. Don't get my started on npm, pnpm, yarn, go, rust. My current 2026 security posture: stay home and only connect to the internet from a trusted ISP. The winter is coming. discuss.python.org/t/informa…

We placed the fruit fly brain inside Odyssey-3, a frontier world model. The lil’ guy is now flying around totally imagined, simulated worlds all by itself 🫶

Before it became possible to get rich by creating wealth, the way to do it was to be on the winning side in a military or political dispute.