Glyph recently convinced a project to stop doing updates altogether by accident, and has had some thoughts about it. For the second time I think I have accidentally convinced a project to just … stop doing security updates on a critical dependency forever, because they’d assumed the LLM usage problem wasn’t as bad as it is. Both of these are offline things that are not at all security-sensitive, but I am starting to worry that in the “dark matter” of the broader developer community there is a meaningful plurality of people who are just going to stop updating e.g. the Linux kernel because of broken trust (Recommend checking the full thread)