Three of today's items change a system nobody decided to change
Victoria Shinder2 min readToday's releases have nothing to do with each other and share a shape. In each one, the thing that alters a running system is a default rather than a decision.
GitHub is the explicit case. The new Copilot policy asks an enterprise to set, once, how every generally available feature will arrive from now on: switched on, switched off, or delegated to organisations. The 28-day window before 22 October is generous and the rule inside it is narrow — only features currently left Unconfigured follow the global default, and anything explicitly decided keeps its decision. That narrowness is the whole story. The setting does not move what anyone chose; it moves what nobody got round to.
Rails 8.1.4 is the same shape one layer down. HashWithIndifferentAccess#filter used to hand back a plain Hash, and now keeps its own class. That is the correct fix. It is also a behavioural change arriving in a patch release, which is the version bump people apply without reading, and any code that leaned on the old downgrade behaves differently afterwards. Nobody chose the old behaviour either — it was a bug — which is precisely why nobody has a list of the places that depend on it.
Canonical's curl advisory completes the set. Three fixes, one of which lets a machine-in-the-middle bypass peer validation during SASL negotiation for LDAP. The difficulty is not patching curl; it is that curl is almost never a decision anyone remembers making. It arrives inside a base image, a build step, a language binding. A host gets the update. An image tag that does not move does not.
What it means
The common failure in all three is inventory, not judgement. Each of these is straightforward to reason about once you know it applies to you, and in each case the expensive part is establishing that — which features are unconfigured, which call sites relied on a Hash, which images were built before today and are still pulled by name.
There is an uncomfortable corollary for teams that pride themselves on moving fast. Explicit decisions are cheap to audit precisely because somebody wrote them down. The accumulated defaults are not, and they are the surface all three of today's changes act on. The 28 days GitHub is offering are not really for deciding the policy. They are for finding out what the policy will touch.