It all sounds very nice and grand, but the author had this epiphany during the presentation of a security vulnerability in Cisco's products. Cisco's superior so

It all sounds very nice and grand, but the author had this epiphany during the presentation of a security vulnerability in Cisco's products. Cisco's superior software engineering practices may in fact make their products more secure than the majority of software, but it didn't keep them from being broken. The fact of the matter is that security is hard. Balancing security with usability with speed of development with ROI is a tricky proposition. Cisco has a fundamental need to write high-security code because what they are selling is highly-secure infrastructure. That same need doesn't exist for other entities, and it shouldn't exist, because that security comes at financial and usability costs, at the least. That isn't to say that software developers shouldn't employ best practices and strive for secure code, but security is not a boolean, and it seems somewhat naive to equate "many people write imperfectly secure code" with "nobody cares about security". There's a middle ground between security being a "debacle" and it always being a persistent threat. Bugs exist - and will always exist. You can spend lots and lots of money making sure that fewer bugs exist in your code, and you can spend lots and lots of money writing in-house code or auditing external code, but unless there is economic incentive to do so ("a security breach in our difficult-to-update firmware will leave our company devastated"), spending those resources makes very little sense. Additionally, all it takes is one bug to bring your massively expensive hyper-engineered software to its knees, as we saw in the Cisco case. Security is always not about writing perfectly-engineered, hyper-secure code. It's about tradeoffs between financial resources and usability, and it's about mitigation of potential damage. If you write code predicated on "this is so well written that it can never be broken", you're in for a bad time.