Playing whack-a-mole is losing

Security engineer David Adrian contrasts two mindsets in the industry: 'Security as Identity'—the hacker ethos that prizes clever vulnerability discovery—and 'Security as Robustness,' which focuses on building systems that don't fail in the first place. He argues that bug bounties, while useful, become a trap when they're treated as the goal rather than a diagnostic tool. Drawing parallels to climate activism and SRE practices, Adrian contends that constantly patching issues is a losing game; true security means reducing the incidence of bug classes over time, not just responding faster.