I think this is already well trod ground, using an unmeasurable claim that doesn’t withstand scrutiny. If security didn’t matter, we wouldn’t have consultants

I think this is already well trod ground, using an unmeasurable claim that doesn’t withstand scrutiny. If security didn’t matter, we wouldn’t have consultants earning 500k+ per year doing glorified QA. We wouldn’t have the fines associated with GDPR. We wouldn’t have the public turmoil over the Clinton email scandal. I don’t think anyone is smarter about solving security problems as a result of reading this paper. I don’t think anyone’s smarter about shipping products without security as a result. This reads like an apology for the status quo. There are predictable and avoidable financial consequences for anyone who takes to heart the claim that “security is not very important.”