> Initially people assumed without evidence That's like configuring a firewall with a default-allow rule. No, with any safety critical system you must assume

> Initially people assumed without evidence That's like configuring a firewall with a default-allow rule. No, with any safety critical system you must assume there might be a problem until there is overwhelming evidence that there won't be.