[weberc2]

The topic is security research, not security practice. Security practice has improved, but security research has not (or that's the thesis, anyway).

[naniwaduni]

What we see is security practice. The security practices coming into play today that come out of research already done by 2000 were not widespread in 2000. Is there no security research being done in 2017 that we won't have paid much attention to for another decade?