> The person best positioned to lock down a program is the developer. The person best positioned to lock down a program is the maintainer of the platform on wh

> The person best positioned to lock down a program is the developer. The person best positioned to lock down a program is the maintainer of the platform on which all the other programs run. In fact the individual program developers should strive not only to ignore security altogether, but to develop a common set of tools that delivers arbitrary third-party code to the user's machine. This makes security theater unlikely as any given developer will only have expertise in their program proper and not in the security of their program plus the arbitrary third-party code. This also ensures maximum velocity of domain-appropriate development and focuses on ease of program installation-- the exact opposite of the problem being parodied in the article. That velocity will rapidly grow the platform. This neutralizes any efforts to thwart progress through ad hoc program lockdown as futile. At the same time it puts massive pressure on the platform itself to gracefully handle misbehaving programs lest systemic insecurity decrease installation velocity. Thus you get a system where arbitrary programs may be installed as quickly as possible with a security model that works even if 100% of the programs installed are malicious. The cost is that arbitrary user data is exfiltrated during most program installations and runtimes (but that is a minor implementation detail).