Most breaches aren't genius.
They're a known hole
someone never got around to closing.
The exploit was public.
The patch existed.
The update sat in a queue
behind "more important" work.
Patching is boring.
It ships no feature.
Nobody claps
when you bump a version.
So it slides.
And slides.
Until the day it doesn't,
and the incident review
finds a fix that was available
for months.
Boring maintenance
is the cheapest security you'll ever buy.
Update the dependency.
Apply the patch.
Rotate the thing
you've been meaning to rotate.
None of it feels urgent
until it's the only thing
anyone's talking about.
The unglamorous work
is the work.
Patch boring.
Sleep well.
– Serguey Asael Shinder
Top comments (0)