It&#x27;s an interesting categorization. I&#x27;d be in both categories given various activities. Yet, I disagree with category 1 as it seems like an accidental strawman. There&#x27;s certainly those types of people literally. There&#x27;s more of us, though, that see insecurity baked into almost everything we depend on even as a country. The state of the grid, banks, increasingly important mobile OS&#x27;s, infrastructure protocols... you name it... has been shit for way too long. Unnecessarily so. You alluded to that with your DNSSEC example.<p>So, on top of engineering challenge, there&#x27;s the need to fight for a greater baseline across the board. I&#x27;m just for doing it a different way than in OP where they call the dev&#x27;s idiots. ;) More along the lines of convincing management to adopt whatever practices add great improvements to quality and security with little extra cost. Quite a few exist. The value is lower liability, more predictable schedules due to reduced debugging, quality&#x2F;uptime differentiator vs competition, and possibility of charging extra for that.<p>Enough promotion of better-by-default in key areas will improve our baseline over time. There&#x27;s actually been a lot of progress vs where we were in 90&#x27;s. So, it&#x27;s at least working a little. DARPA and NSF are also steadily funding strong stuff in variety of areas that has legacy compatibility where possible. More potential to push strong stuff in the future.