Yes, I haven't mentioned defence in depth here. And as you say, serious real world applications are more than a single layer. But of course what we see with DiD

Yes, I haven't mentioned defence in depth here. And as you say, serious real world applications are more than a single layer. But of course what we see with DiD is polynomial growth of complexity, so policy, monitoring, rebuild time and so much else gets hard to manage - upshot is someone, somewhere falls back to simpler configurations - and there's the entry point. But sure, thank goodness we've moved beyond a single blacklist firewall these days :)