More importantly, this neglects that buying a home is locking in the price for the long term for the majority of your housing cost. Buying usually is similar all in the first year, but after 5 years your mortage payment is the same while rent has probably gone up significantly.

The article and settlement seem to only mention the false positive rate, which is a bad thing to focus on. Every true positive is a much faster experience. Only subjecting 110 out of 3000 people to a longer search is a big improvement. Given the negative outcomes of a gun slipping through and the lack of a cost of a false positive, we probably want it to be tuned to be more false positive prone anyway. We don't need these to detect guns THAT well, we just need them to weed out people who definitely don't have them.

I do have concerns about what its false negative rate is relative to the standard practice it replaces. I do not really trust whatever psuedo-AI they're bolting to their metal detectors; it's probably easier to get a gun through. That said, the false negative rate probably isn't good already. TSA isn't great on their false positive rate, does more intense screening, and isn't being staffed by hungover 20-somethings. So maybe the false negative rate didn't actually increase by much?

I think the book is still very applicable, and every security practitioner needs to be hit over the head with it (or at least The DevOps Handbook or Accelerate). Security generally is decades behind engineering operations, even though security is basically just a more paranoid lens for doing engineering ops; the ideas from Phoenix are still depressingly revolutionary in my field.

Password resets are definitely one, and I still have to tell prospects and customers that I can't both comply with NIST 800-63 and periodically rotate my passwords, every single day. Other ones I often counter include other aggressive login requirements, WAFs, database isolation, weird single tenancy or multitenancy asks, or for anti-virus to be in places that they don't need to be.

You're a bit off on whether this would fail a SOC2 audit, thankfully. As the OP said, they don't have access to production systems, which basically means you can treat that employee however you want from a SOC2 (and ISO, and most other control framework perspectives). The company OP is working for can state "We do not require these controls on contractors without production access" and that is totally fine for SOC2. Pushing back on the agent requirement is totally reasonable!

Gladwell is directly quoting Nassim Taleb, and openly says how little he follows the math Taleb discusses earlier in the same chapter. The point is "Look at how smart Taleb is, I don't even know what half these words mean", he was never trying to understand the math or imply he did. In that context mis-transcribing eigenvalues doesn't feel nearly as damning as it's made out to be around these parts?

For this to have the societal impact ya'll seem to want, it's going to need high usage from people who probably have little experience with the changes in the Fed rate and its impact on savings accounts. You obviously need to adjust to this yourself, but I can see changes in lottery odds (or changes in prize value) as being aggravating to users.