Hacker News Reader

It means security is hard. And yes, we keep finding security issues (in web specs, not just in implementations) due to two different people designing two subsystems and not considering their interactions, or not even knowing about the existence of the other subsystem.

Finding a sane solution to this problem would be wonderful; I haven't thought of one yet.

Security is it's own separate issue. There are best practices that must be observed in all frameworks (preventing xss, sanitizing user data). Of course sometimes there are bugs, but the OSS community resolves those rather quickly.

In general, if I don't use something, if it's outside of my focus, that shouldn't harm security. As an example, given your two secure systems which can combine into an insecure system, if I don't use that second system I should be good. If I do, I better know their interactions.

This argues for a small reliable toolset rather than having every contrivance in the HomeDepot center aisle on my belt.

Not full stack, definitely not fool stack, just stack.