Thanks for following up. I agree, however say Google and Apple have very few of these despite being disproportionately targeted. Doesn’t mean they are doing en

Thanks for following up. I agree, however say Google and Apple have very few of these despite being disproportionately targeted. Doesn’t mean they are doing enough. But it sure as hell makes a difference. In ~15 years my gmail has never been leaked or hacked. That’s better than having an unprotected DB leaking every customers credit score, like we’ve seen. Certainly this audit-, certification- and checklist based security is a joke. Security isn’t a patch-work. It’s not separable from software development, and cannot be a separate process/workstream either (a thousand faint gasps ring out from middle managers across the enterprise world). Anyway, I’m rambling. I guess I wanted to say that I’m optimistic for the long term. We’ve already made some significant progress in the last 10 years, for the better. I expect that to continue slowly.