It's funny watching this happen given that for pretty much my entire adult life I have recognized that the threat model which "solves" inherently compromised software by trusting private third parties to constantly change it in a way that is unauditable for someone with a normal life is an evil trick and not remotely the right way to think about computing, programming, or anything else.
If you tried this in any other industry even 20 years ago people would instinctively smell the deception and be outraged, asking what the hell was defective about what they bought in the first place.
For much of my career I worked on things that had to operate indefinitely with no mistakes, and failing at that for physical reasons, with deep containment for all possible failure modes. It is possible to design systems, even systems that do sophisticated general tasks, which will never need to be amended short of physical repairs in order to remain secure and correct.
That's where #neverupdate comes from. Because I know what's possible, and I know the reason we don't think that way for consumer computing is because it would run contrary to planned obsolescence and the ability to exercise authority and ownership over what was purchased remotely by adversarial corporate entities.
The reason we do things this way is so you never own anything, and the incident that just played out shows exactly how the blackmail works. I personally still did not update. I just dropped the bad certs. But a lot of people who were holding out over the extruded slop being shoveled into the kernel probably caved and updated.
That's how the racket works.
#neverupdate #neverslop ⚔️