For the second time I think I have accidentally convinced a project to just … stop doing security updates on a critical dependency forever, because they'd assumed the LLM usage problem wasn't as bad as it is.

Both of these so far are offline things that are not at al security-sensitive, but I am starting to worry that in the "dark matter" of the broader developer community there is a meaningful plurality of people who are just going to stop updating e.g. the Linux kernel because of broken trust