I didn't mean it as a cutdown on him: more a reminder to do what he does professionally. Security evaluators and hackers alike often get into networks with attacks on gateways and firewalls setup poorly. It's on everyone's checklist. A Netgear router works similarly, albeit less features, so I tried to get him to make the mental connection between a weakness he'd readily recognize in one area and one that applies in another area. I could see how it might come off differently though...

Far as my post, it's part of my larger theme that people aren't apply what the field learns. You don't need to be Paul Karger or Dan Bernstein to do better than what we see. The safety critical industry responded to C's problems by subsets, reviews, static analysis tools, and dynamic testing systems. Quality went way up. We've seen the same in academia with free prototypes of many and further work to straight-up knock out the issues (Ur/Web & Softbound are recents). No uptake. There were system languages such as Ada that, by default, eliminated many of the common problems. Little to no uptake. There were concerns about a steady stream of compiler problems. They could improve/use the model with constant problems or the one (CompCert + ML implementation) with the solution. No uptake. Safety- and security-critical work showed microkernels greatly improved security by eliminating much kernel code, isolating others behind mediated interfaces, and allowing recovery in simple failure modes (eg drivers). Most ignored it and Linus deplored it but at least GenodeOS took it up with an active community. Rare exception.

There's a recurring pattern in INFOSEC where proven solutions to problems are either forgotten or ignored. I fight that trend in my posts where I identify known issues or promote alternatives (design or implementation) that were previously field-proven. I also give credit to those that make solid attempts to do it better often with results: qmail, GenodeOS, Minix 3, INTEGRITY RTOS, Secure64's SourceT OS for DNS systems, Sentinel's HYDRA PCI firewall, CheriBSD, Cornell's SWIFT, Praxis's Correct by Construction w/ SPARK Ada, Python with Cleanroom methodology, and so on.

There's lots of amateurs and pro's alike doing stronger methods in academia and commercial sector. It doesn't have to be a full EAL7 system or even that formal. Yet, if a tool exists that immunizes against big problems, why aren't we using or breaking/improving it? Why do I see another presentation at DEFCON breaking a vanilla bug or a new tech that delivers a tiny fraction of that protection? Why are security-critical apps not leveraging free tech to improve them and decomposition/least-privilege at the least?

I'm not asking much. Just using what exists, what's shown to deliver most bang for buck, what's free, and what takes only a small portion of the labor. Do that from language to architecture to protocols. Baseline will be so much better. I noted in both comments I was grateful to the fragment of INFOSEC that does this. Yet, most of the field just reinforces the status quo while occasionally calling out or bandaiding the preventable problems it introduces. Many get a rush out of these attacks they create they don't get out of building tools that create immunity to attack classes. Hence, that other m-word as a metaphor for what they're doing. In the end, nothing changes with that approach but at least they're having fun. ;)