I agree but partially. We are not talking about some complex interactions between multiple components which lead to a security vulnerability. This is some triv

I agree but partially. We are not talking about some complex interactions between multiple components which lead to a security vulnerability. This is some trivial stuff like "don't give your passwords to anybody" or "don't run everything as root". The most complex vulnerability mentioned in the article is with proxying. If you have opened /etc/squid/squid.conf at least once you should have noticed the to_localhost ACL and the comments which explain why it is important. So is the Pocket team building a multi-million user service which has a proxying component without trying to configure squid once? Absolutely! Also I consider too optimistic hoping for the situation to improve - it's moving in the opposite direction for now with steady speed.