Don't let perfect be the enemy of good

Haven't we learned that in the security and privacy domains that maxim requires its inversion? Especially with the passing of time! "Don't let temporary adequacy undermine lasting protection."

Not really. Defence in depth is an example.

If things were perfect you only need 1 layer of security. Things aren't perfect, that doesn't mean we should just give up and have no security, we have multiple layers of good security as while it's not perfect, it's better than nothing.

And if we don't talk about things that aren't perfect, there will never be a improvement.

Right. I think we're all in agreement about the end goal,... The "how we get there" is another story.

I'm partial to aiming for perfection — when there's time for it — after having been the person paying down the tech debt across different domains (i.e. untangle spaghetti code to unravel subtle logic errors, fix them, and write down documentation).

But I agree that sometimes you just need to ship a workable solution ASAP... I am of the opinion that that should be an exception, and that it isn't a sustainable modus operandi.