>"If Microsoft had to pay the costs of vulnerabilities" Yeah, ok but lets trade out MSFT for FOSS, Firefox or small iOS app developers. At some point, we shou

>"If Microsoft had to pay the costs of vulnerabilities" Yeah, ok but lets trade out MSFT for FOSS, Firefox or small iOS app developers. At some point, we should ask to see if we are inadvertently advocating for scaring people into doing the right thing. Worse yet, for something that they couldn't see or anticipate. What about the standards makers? Are they going to be held accountable too? When is the last time you've read OWASP articles? Have you seen the state of that sort of literature? Its a mess. Have you seen how arcane and arbitrary the NIST-800 series is? What is the limit to this sort of "accountability"? At the risk of being even more trite, ideologically motivated statements like this look cool only because its on the internet.