> Ignoring the failure is perverse. If the failed system is a security module, I think that's absolutely correct. If the system runs, without the security modu

> Ignoring the failure is perverse. If the failed system is a security module, I think that's absolutely correct. If the system runs, without the security module, well, that's like forgetting to pack condoms on Shore Leave. You'll likely be bringing something back to the ship with you. Someone needs to be testing the module, and the enclosing system, to make sure it doesn't cause problems. I suspect that it got a great deal of automated unit testing, but maybe not so much fuzz and monkey (especially "Chaos Monkey"-style) testing. It's a fuzzy, monkey-filled world out there...