As always I think the answer is in the middle. You can&#x27;t have a piece of software that defaults to insecure and expect everyone to have the common sense and skill to secure it. You rarely can release a piece of software with hard security defaults and expect it to have enough usability to gain critical mass &#x2F; adoption &#x2F; be popular.<p>I remember when I first learned web development and I absolutely had a belief that the defaults would protect me from royally fucking up. Postgres security defaults for example. And although this is obviously not true in reality, we can&#x27;t let ourselves overlook it just because.