> But if all application developers were responsible, we wouldn't need security mechanisms in the first place. That's not true. I mean if developers could be i

> But if all application developers were responsible, we wouldn't need security mechanisms in the first place. That's not true. I mean if developers could be infallibly perfect always, then yes we wouldn't need this kind of security mechanism. But acknowledging that code always has bugs, it's a nice additional layer of protection. If someone comes up with a code injection bug and tries to use it to run attack code that gets blocked by a previous pledge, that's an improvement.