Despite what anyone would try to sell you, a regular expression is a programming language. It's Always A Bad Idea (TM) to compile untrusted input into any kind of programming language. Don't string concatenate SQL queries, eval is evil, it's all the same idea.

Security is always reactive by its very nature. You can do proactive things, but you will always be reactive to novel attacks.

Expect everything to have various levels of rolling upgrades, and soon. That's a lot of work.

The way LLMs are developed now is but one possible future we could have experienced. Imagine the future where the LLMs were built by a few governments with black budgets and hidden until a war or some other large event broke out. Then suddenly most of the computers and digital infrastructure shits itself as everything goes wonky.

At least this way we get to see that a shared global infrastructure built on the idea that security is someone else's problem was a really bad idea and we might have enough time to fix it or pull enough plugs we don't go back to the dark age.

Alongside the current scanning and patching of software.

This might feel like a "Yeah obviously" moment, but the fact is that very few Rails apps are running the latest ruby release the moment it comes out.

In go, vendoring dependencies just copies the deps out of the module system into the local tree and it's managed the same as not vendoring. It won't even build of the go.mod has changed without also updating the vendor tree.