But how badly do you want your site to be up? all the time? Do you want it badly enough that you're going to put it in both Azure and AWS? How much, do you want a copy of, like, how do you make a plane that doesn't crash? Do you fly two planes next to each other? And then when one fails, like, you jump to the other plane? Like, it is ultimately on us, is it not? And we just need to decide how hard to squeeze.

I think there is usually a trade-off, if you want to really simplify it, between cost and resilience.

To your point, you know, ultimately redundancy is multiple paths to get to the same goal.

In practice, you need polyglot applications and systems.

That's pretty expensive to pull off.

I do think, though, that software has the beautiful luxury we sometimes don't leverage.

To your point about planes...

How do you feel about that? Is there a place for LLMs to live in security and in resilience and in chaos, or do they just increase chaos and entropy?

I'm curious, does, is there an example where traditional compliance actively makes systems less secure, where they think that they're checking boxes, but they're actually hurting themselves?

Yes.

Actually, a frequent, uh, co-conspirator of mine, Josiah, um, Dykstra, wrote a paper, not with me, um, it's an excellent paper, um, about that exact topic.

I think specifically, uh, covers HIPAA and maybe one of the others that shows that it doesn't, being more compliant doesn't actually result in better security outcomes.

I'm very much of the view, and I've tried to caution regulators as well is, like, well-intentioned regulation in this space very quickly calcifies and ossifies.

Like, it's what helped in year zero through maybe even year three may end up actually eroding resilience long term.

Great example, I'll keep the person anonymous, very innovative CISO, um, had to explain, I think over a few years to his auditors, like, "Actually, it's a great thing that we don't allow SSH access anymore," 'cause that's what attackers love.

And then investors see it, and compliance people see it, and that checkbox is the thing that stands between you and some certificate or some badge, and that's a problem.