Perhaps you would re-read what I wrote? I didn't suggest that people should add more hats -- I suggested that people should cooperate more, and learn from each

Perhaps you would re-read what I wrote? I didn't suggest that people should add more hats -- I suggested that people should cooperate more, and learn from each other. It makes no sense to have a security policy and an implementation of that policy and not have it be automatically distributed and applied, for instance. And security implementations should be tested just as much as any other code.