Coda
Detection Was the Control
Everything here was one instruction. The rest is will.
Detection was the control all along, and its home is the source.
Every argument in this book collapses into one instruction. Check the software where it enters, before it can act. Scan it at publish, so malware is refused at the door instead of pulled after the install. Gate it at install, so a reachable, exploitable flaw has to be waved through on purpose. The cooldown, the catalog, and the scanner were all describing that one move the whole time, from the one place that cannot perform it.
The data settled the question, and it did not stutter. The time from disclosure to exploitation has gone negative. The exploit lands before the advisory, the attack before the number, the compromise before the committee has booked the room where it would have been discussed. Every control that works by waiting was built for a world that gave defenders months of warning, and that world is gone. A defense that starts its clock after publication is set for a decade that already ended.
Notice what the weakest of them becomes when it is dressed up as a safe default and switched on for everyone. It does not even keep the secondhand safety it had when only a few used it, because those few were shielded by the many who did not wait and were hit first. Turn the waiting on for all of them and there are no carriers left to trip the trap. The whole ecosystem starts one clock on one publish and walks together onto a single new first day, the malicious version aged into trust on the way. And not one of them agreed to have their own fixes frozen to make it work.
So the question stopped being technical a while ago. It is a matter of where you decide to stand. Run a registry and you already operate the detection, and the only thing undecided is whether it guards the door or sweeps the floor behind it. Run the catalog and you already know it is numbering the calm decade while malware outruns it four to one, and that the score you staple on top only buries the facts a defender came for. Sell the scanner and you already know it is guessing at a tree the package manager built and handed you, and billing you for the noise it makes while it guesses. None of these are research problems. They are positions, and each one is the wrong one.
The cost of the wrong position is never paid by the people who hold it. It is paid by the developer whose machine is emptied while the dashboard reads clean, by the team that shipped a fix a week late because a default they never chose could not tell a patch from an attack, by everyone downstream of a ledger that recorded what was convenient and left out what was fatal.
They never got a vote. They get the bill.
I have tried to leave no excuse standing. The detection exists. I run it, and I will hand it to any registry willing to put it at publish, for nothing. The formats exist. The exchange is designed. The evidence is in, it is public, and it points one way. What is missing was never capability. It is the will to move the check upstream, to the source, where it can refuse harm instead of timestamping it.
The attacker’s week was never a law of nature. It is a decision about where to stand the clock, made wrong, on purpose, every day it is left alone. Stand it in front of him. The control was always yours to move.