ASk HN: Did Internet evolution kill all the security models?
When you design with security in mind, you assume things are going to get compromised.
As such, one of the unix-like systems strategies, is to limit the available resources for compromised "elements" (users, processes, hosts, subnets, etc).
Back in the day, we did "download markup to render rich text".
That is relatively acceptable, even if it implies some trust levels (the server software, the client software, the content processed, the scenario, etc...).
But hey, we're 2013. The browser access to many layers of abstraction and functionalities, the smartphone is not better...
Quality of default configurations of many elements has "evolved" across the years... to the point of demand your work exponentially if you want to follow some minimal security best practices.
Once upon a time, the data was in your computer, and you used e-mail to communicate, and did access to content following html links. But nowadays any security model is broken by default for the average use that people does of internet.
Share everything, locally, remotely, between devices, reuse credentials between providers, crappy software validation processes, code which you cannot audit but your data uses, etc etc etc
Did the internet evolution kill our computers security ?