> But there is a good enough in security too.

The disagreements usually arise from what exactly is considered "good enough". Your air purifier probably doesn't need quantum-proof cryptography and end-to-end encryption in case the transport layer security is compromised (e.g. emudhra).

The problem is that people will frequently argue that approaches like the one in the article (fetching root certs in an insecure manner) are "good enough" because they don't understand that the whole dance is worthless and connections might as well be unencrypted - at least that's honest.

  > people will frequently argue that approaches like the one in the article are "good enough" because they don't understand

Its true that complex means multiple things. But there's a strong push against elegance.

I'll give an example. In one job we had to deal with a bunch of different file types. We had a function for each, about 500 lines for each one. Mostly copy pasted. Recognizing that, I wrote one 500 line function that allowed us to write a new file type routine (a common occurrence) in 5 lines. So I removed thousands of lines of code, increased code speed by 10x, decreased developer time by 2x, and by boss (who only ever imported the code, never wrote it) overruled because it was "too complicated" since I was using a C++ abstraction he didn't understand (guy barely knew C++. Like didn't know what a template was).

The problem with both of these is that they slowly lower the bar. If the shortcut was "good enough" last time then another shortcut will be "good enough" this time. If X is "too complex" because I struggle to understand it, then Y is too. Which I find extra ironic since our field is quite egotistical and we seem to revel in the fact that we don't understand. But I guess Dijkstra was writing about that half a century ago. Which is plenty of time for things to go to shit