TCP/IP is perfectly fine. It's the security of endpoints (OSes, language runtimes, etc.) that sucks and is largely responsible for our perpetual security disast

TCP/IP is perfectly fine. It's the security of endpoints (OSes, language runtimes, etc.) that sucks and is largely responsible for our perpetual security disaster. Why do we still have buffer overflows in 2015? OSI would not save us from that. If anything, the byzantine complexity of OSI would result in giant blobs of C code that contain even more vulnerabilities. Complexity is a very bad thing security-wise-- a linear increase in complexity always leads to an exponential increase in opportunities for bugs. Bugs in turn are fixed in linear time. Exponential effects always trump linear ones, hence our security nightmare. If grown-ups know better they should show us by shipping things. If I can't use it it doesn't exist. IMHO one of the more general anti-patterns in security is to try to secure the network not the device. It's a fool's errand for many reasons, most notably the fact that there is an intrinsic trade-off between the transparency / audit-ability / firewall-ability of network protocols and the security of the protocol itself. A secure protocol is utterly opaque and therefore cannot be inspected at the perimeter. Secure the device. While it's important to pay attention to your network, if your devices are not secure netsec will not save you.