I agree with pretty much everything you said. Current OSes, protocols, and practices all conspire to destroy any guarantee of complete security. But 99% of the

I agree with pretty much everything you said. Current OSes, protocols, and practices all conspire to destroy any guarantee of complete security. But 99% of the time for 99% of people, a complete guarantee of security is overkill. With a few exceptions, as long as breaches are quickly discovered and fixed, the damage is relatively minor. Stolen credit card? Report it to your card company. Charges are blocked and you get a new card. Website vandalized? Shut it down, clone the disks on any compromised machines (for postmortem examination), restore from backups, blah blah blah standard panic procedures. In areas where security and reliability really matter (basically: medical devices and avionics software on planes that carry people), software is expensive. Certain software development processes are required by law (See http://en.wikipedia.org/wiki/MIL-STD-2167 http://en.wikipedia.org/wiki/MIL-STD-2167 and http://en.wikipedia.org/wiki/DO-178B http://en.wikipedia.org/wiki/DO-178B ). Greatly increasing the costs to create and use software kills new ideas in the womb. It becomes impractical for startups or small groups to build stuff. So is Internet security a failure? Yes. But really, I'm glad we're not so risk-averse as to paralyze ourselves with more draconian measures.