The essay includes several bits of advice for improving security in our field. IMHO, we overlook this one far too often:

Gordon Bell once observed that “[t]he cheapest, fastest and most reliable components of a computer system are those that aren’t there.” The most secure software dependencies are the ones not used in the first place: Every dependency adds risk.

I’m a little disappointed in the amount of time spent on the XZ attack. The title and it starting off with some good history made me think this was going to be more of a retrospective, looking into the issues that created the solutions used today.

It seems to be just calling out the solutions and how they would interfere or did interfere with a given attack, where XZ is most commonly used as an example.

Entirely missed bootstrappable build; they solved the entire Trusting Trust Attack