>
I'm sometimes confused how far apart the general opinion on platforms such as hn is compared to people you encounter in real life.Really? If anything I'd think HN of all places should be used to this class of problem, because it's endemic in much of tech particularly IT/devops, and we have arguably one of the more recent biggest and most well known cases of it ever: the Y2K effort. That was a massive industry wide problem that, in a rare case, also got significant media attention. And it was solved thanks to an utterly enormous level of effort. Hundreds of thousands if not millions or more of man years were put into going through decades of by definition crufty-as-hell code that maybe nobody had looked at in ages or had any recent mental model of and hunting for and fixing date issues. Sometimes permanently, sometimes through delay hacks ("let's consider 00-20 to be the 2000s, 30-99 to be the 90s" for example). Then there had to be lots of testing and dry runs leading up to the switch. And it mostly worked! There really were major problems, but they mostly came up in testing. The deadline was hit, it was a huge success. And the public result? It became the butt of jokes and a "cautionary story in overhyping a nothing burger" etc for the next decade at least. The general takeaway for the public seemed to be not "we solved this potential catastrophe thanks for a huge effort" but "we spent a ton of money and time and worry over something that didn't do anything!"
The basic issue of problems where the success scenario is essentially "nothing happens" but the failure scenario is huge costs is definitely hard to square with human psychology. Prediction vs reaction requires expertise in the subject that of course not everyone can possibly have, which in turn means non-experts must be able to identify and trust actual experts and institutions, with all the fuzziness and further issues that can bring. Arguably the ideal for Security, IT, ops, health, and many other areas is that they're mostly like air: noticeable primarily in their absence or degradation. If it's a particularly nice day and environment and the air is extra fresh we might take note of that as we first encounter it, and perhaps reflect at times how we feel more energized and clear headed then normal, but it's human nature to quickly let that fade into the background, and a significant amount of pollution or quality degradation is also something that can become omnipresent and looked over if it's not to the level of actual pain/breathing issues.
I don't know if there is any real formula for that beyond the hard work of institution building, with trust hard to gain and taking long time periods but fairly easily squandered. Even that may not be enough in the face of short term expediency and profit. Experiences like being treated as a cost-center and screaming into the void about security threats that we can see coming down the track from ages away and know have the risk of major costs are probably all too common here :(.