Seeing this posted a week after I had to emergency push cve fixes to 1200 servers in production is pretty funny.

Every person on my team is capable of networking, product engineering, database, job processing and we have command of the entire stack. We will push updates for CVEs with stuff we manually compiled. We own the build system and have the ability to change product as needed. We all have experience in product and we're all capable of pushing fixes as needed. Frankly the SRE team is by far the smartest team I have ever worked with at any company I've ever worked at.

Is your org at the point where it would make sense just to upstream patches for FOSS projects and pull rather than patch and push to just your infra?

Just a matter of curiosity for me as my career progresses, where I think that is the ideal, but I don't work in a heavily privatized nor regulated space at the moment of posting.

I did read your latest blog post looking for an answer, but it wasn't clear to me from that reading.