[E2EEd]

It's all broken, but a purist will go off grid and live in the woods.

Perhaps you'd find passion in pursuing a PhD (or other avenue of professional R&/D) that focuses on resolving the fundamental issues with much of software development methodology, endpoint arch, and networking.

Barring that, the MO is to devise more robust bandaids.

The proprietary and secret nature of big tech security creates a playing field of fortified castles vs. self reliant survival in the wilderness. Tail end participants such as Google's core infra security will outmatch any independent actor. And, still, both google and apple consumer endpoints seem to have fundamental security flaws, entrenched due to being built on many billions in investment over decades.

Something like CHERI may take decades to bear fruit, hopefully turning over and pruning any insecure legacy systems sooner rather than later. Telecom is an example of why this will likely never occur anytime soon, and that we may be stuck with current security paradigms for many, many decades.

[pc2g4d]

The CHERI / Morello effort looks pretty serious, thanks for the pointer... (pun intended?)

I wonder if there is an equivalent in x86-land? As far as I see, this is limited to MIPS, RISC-V, and ARM architectures.

But again I'm left wondering: if this eliminates 70% of security exploits, what about the other 30%? It's great to close and lock the garage door and front door and back door, but if the windows are still unlocked, the house remains easy to rob. Still looking for that secure single-bit....

[E2EEd]

User error is still the 600 lbs gorilla. Figure out how to make tech security idiotproof. This is increasingly difficult as IT systems become more complex over time, adopted by an expanding pool of participants.