I disagree. Security is always a trade-off.

Owning, auditing, and maintaining your entire supply chain stack is more secure than pinning hashes, but it is not practical for most projects.

Pinning your hashes is more secure than not pinning, and is close to free.

At the end of the day, the line of trust is drawn somewhere (do you audit the actions provided by GitHub?). It is not possible to write and release software without trusting some third party at some stage.

The important part is recognizing where your "points of trust" are, and making a conscious decision about what is worth doing yourself.

The blog is mostly focused on hardening the CI/CD pipeline.

Your sessions were probably getting auto-compacted much earlier before the context window got larger.

Cursor is an IDE and an agentic interface and a cli tool and a platform that all work locally and and in the cloud and in the browser and supports dozens of different models.

I don't know how to use the thing anymore, or what the thing actually is.

Without proper punishment, groups who "play fair" are at a strict disadvantage against those willing to break the rules.

At least in the US, we seem to be rapidly moving away from punishing groups for breaking the rules. All the mega successful companies (and people) seem to break a lot of rules to get there.

Conversely, the honest "play by the rules" groups can't be mega successful. Without punishment, the cheater always wins.

Can you point to a single competent expert who recommends the average driver should wear a helmet while driving? Again, there is a difference between one study showing helmets reduce injury in crashes, and an expert reviewing the problem as a whole and making a recommendation.

I'm not arguing all laws are good or make sense. In this specific case, the law lines of up with the recommendation of experts studying the topic.

Experts almost always set policy better than non-experts doing their own research. Especially on complex topics.

There is no point in two amateurs arguing over a topic they don't understand.

All I can do is refer to the publicly available reasoning and studies of experts, which have evidence and conclusions opposite of the amateur conclusion above.

There is a difference between cherry picking studies that back up your view point and how medical experts set policy though.

Experts review all of the data, and ignore outliers like a paper published in a law journal that suggests car seats are the primary reason families have shrunk from having three to two kids since the 80’s

Look at what lengths you went to in order to justify and defend what is, by your own arguments, the demonstrably less safe option.

And workers should refuse to do unsafe work, and simply take one of the many safe jobs instead.

We don't need a childhood vaccine schedule. We just need parents to keep their kids from getting sick.

Kind of silly that we as a society even bothered with all of the dangerous safety standards to start with.

> humans are so oblivious to safety

Are we? People saying "have a safe trip" is pretty weak evidence.

The counter evidence is just about everything else going on, at least in the US. Relaxed worker safety standards, weakened environmental protections, and generally moving as fast as possible.

If everything is reported as a bug, there will be 0 false negatives but a lot of false positives

According to the quiz, I am a beginner!