A true disaster always has more than one cause. It took many separate problems and mistakes to sink the titanic and cause such a large loss of human life. Same

A true disaster always has more than one cause. It took many separate problems and mistakes to sink the titanic and cause such a large loss of human life. Same here. There can be endless and interesting discussions about the role of the NSA, Microsoft, the end users in this very specific incident. But the root of the problem is, that computer security still does not get the proper awareness and attention. This starts from how we write software, but from a society point of view, mostly how we deal with computer systems. Computer systems are not toasters which you can replace easily. Often they are part of larger installations, difficult to replace as a component. We need to deal with them as with aspects of traffic or workplace safety, or hygiene. There should be a clear concept (I sincerely hope we don't require too strict state regulations) that like any professional tool, a computer system has to be reviewed in regular intervals for being fit for its intended purpose, and maintenance for security should be done as naturally, as mechanical or electrical checks. So, for any computer-powered (and networked) device, this would mean, that either there is a maintenance contract in place, which in the end would mean, the provider has a contract with Microsoft, if Windows is used, or, like with any other device, the machine is no longer considered fit for professional use.