My personal opinion is that we bull-shitted ourselves into believing the slap-dash tech stack we created for internet facing applications is the greatest thing

My personal opinion is that we bull-shitted ourselves into believing the slap-dash tech stack we created for internet facing applications is the greatest thing since sliced-bread. In the past, we developed software that was meant to be used by one person who used one pc which connected to one server and there was maybe three software vendors involved: the client OS, the software tool itself, and the server OS. With internet facing applications, it is not uncommon to deal with open sourced software (with no vendor responsible for maintaining it), several APIs (each API may or may not have a vendor who can provide support), and security by duct-tape (we slap this security module on it and hope it stops most attacks). That is the complexity of modern applications has increased exponentially. To deal with this complexity, instead of a mechanism to pay/fund engineers to improve our tech stack. We magically hand wave these concerns away. My opinion is that those who can afford it and demand security will go full "zero trust" by using flashed EPROMS. Software will no longer be soft. Instead software will be flashed onto EPROM chips and only after they go through thorough testing against hacks, will they be deployed into production. When your company buys cyberinsurance, instead of a checklist of security best practices, your company will attest their software stack consists of EPROM chips that have been certified by CISA and the like.