> In principle we can make computers much more secure and in practice some groups actually do. In principle we could, and yet in the 20-30 years of common inte

> In principle we can make computers much more secure and in practice some groups actually do. In principle we could, and yet in the 20-30 years of common interconnected computers we haven't. > If we get some decent information out there and stop enabling people with the mentality that computer security is an add-on product This isn't just about getting "information" out, and if it were only information people would've fixed it decades ago. The problem is that there are no incentives. The cost of making products actually secure, dwarfs the cost of getting a product out that makes money. The cost of being found out with a massive security breach pales in comparison to the amount of money to be made on being first to market, or having dominant share. > I doubt google or microsoft will be significantly harmed by a "cyber-weapon", and I don't think most end-user devices with automatic updates enabled will either. Linux based Android and Microsoft Windows are currently full of holes and have been exploited now for years. And this is happening by small groups of people who do it for a few dollars or to spy on a company - none of them have the full backing and resources of a nation state. To think that this problem will suddenly be solved by doing more of the same "educating people" to me comes across as a bit naive. It hasn't worked this long, it won't suddenly work now. Incentives need to change. Punishment for a security hole needs to increase significantly, entirely new tooling needs to be enforced or some other solution needs to be created. This is one of those cases where the solution is seen as so drastic that people will want to just ignore or dismiss it. Thinking to themselves, no-one can really be advocating for that it'd impact everything. It will - making our digital systems secure will be hugely expensive. I see a Y2K x 10 style concerted effort as the only way to get things to change - but hopefully someone out there has an idea more likely to be implemented.