I take your point, but the phrase 'being smart about security' trivializes a task of monumental proportions. We need to rethink how we design software / hardwa

I take your point, but the phrase 'being smart about security' trivializes a task of monumental proportions. We need to rethink how we design software / hardware systems. We need to rethink what we mean when we talk about software engineering professionalism. We need to rethink how we approach quality and liability issues. All of these things go so much further than just 'being smart about security': They go to the very core of our profession and how we organize ourselves. True, we need to contain bad actors, starting with the ones who are actually criminal and hostile, but that comes a distant second to the imperative need to get our own house in order. The security services are literally the least of our worries, and (almost) the last thing we need to worry about. We have much much much bigger problems.