I guess the author is arguing that we currently over-abstract, which is quite possible. At the end of the day, it will always be some kind of balancing act. M

I guess the author is arguing that we currently over-abstract, which is quite possible. At the end of the day, it will always be some kind of balancing act. My point is that web applications are, at least from a security standpoint (but also some others) anything but simple, and I'm fairly sure most attempts at creating a focused, lightweight, custom framework are littered with security issues. There are counter-examples in both directions, but this is just my general experience; people who know all the pitfalls you would have to avoid also don't generally want to try to implement all that by themselves.