It is that in 90ties nobody predicted Internet. Most systems where build with assumption that network is trusted or no network. Secondly Moor Law consequences

It is that in 90ties nobody predicted Internet. Most systems where build with assumption that network is trusted or no network. Secondly Moor Law consequences where visible after few years. Even MS did not predicted PC boom, everyone now have few computers. Both in terms of performance and availability of hardware we see it massive shift. It is extreme difficult to add security to system afterwards. In Last Kerberos vulnerability was fixed like last year (Kerberos is used from Windows 2000). Wordpress is still not secure... OpenSSL have something every year. > it was deployed by people who knew what they were doing. It is opposite. These people had no clue that systems they are building will be exposed to internet. Even if they did, it is all written in C on hardware that have very little protection (rowhammer).