Unfortunately, mitigating a vulnerability can take a long time and might never happen. When the Imperfect Forward Secrecy paper about weak Diffie-Hellman excha

Unfortunately, mitigating a vulnerability can take a long time and might never happen. When the Imperfect Forward Secrecy paper about weak Diffie-Hellman exchanges came out in 2015, not all systems using the vulnerable groups upgraded immediately, and some systems couldn't be easily upgraded either because they were hard-coded or because they had other software limitations. The IT security situation in many developing countries is also pretty alarming, for example if you look at the prevalence of old unsupported operating systems and browsers in many places. Even thinking about traditional emanations issues, the "van Eck phreaking" attacks were publicly demonstrated years ago https://www.youtube.com/watch?v=ZZ5HS8GWIec https://www.youtube.com/watch?v=ZZ5HS8GWIec but have still not been widely mitigated in practice. Neither have the emanations problems documented by Tromer. https://www.cs.tau.ac.il/~tromer/ https://www.cs.tau.ac.il/~tromer/ And we know that the vendors were notified about Spectre in June of last year and the public was told over a month ago, but pretty much all of us continue to be potentially vulnerable to it in some settings, even more than seven months after vendor notifications! It can be nice for infosec researchers to think that attackers only gain power and capability by knowing secrets, and that if those secrets are exposed the attackers will lose their capabilities, but a number of people have been pointing out that it doesn't always work that way -- or at least there can be quite a long window of vulnerability. (However, exposing secrets is definitely an important prerequisite for denying capabilities to attackers.)