Security is not one project. It is every project that faces the world. A "Manhattan Project" isn't a useful analogy or approach to the security problem. The pr

Security is not one project. It is every project that faces the world. A "Manhattan Project" isn't a useful analogy or approach to the security problem. The problems we have are: 1. High capability attackers (states, corporations) have a high motivation to compromise privacy and security and low motivation to improve privacy and security for users. 2. The tools relied on by users for security and privacy are often built by people with very limited resources (GnuPG, OpenSSL, nearly every other Open Source thing in the world). Fixing security online requires audits and maintenance across a huge spectrum of projects, and historically there has been very little funding for such things. It's almost dumb luck that we have tools that are as good as they are, and we shouldn't be surprised by bugs like Heartbleed and Ghost and others. They're what happens when there is very little profit in maintaining core infrastructure.