[ryandrake]

Unfortunately, with security, you have to "get everything right all of the time" because the attacker only has to get their attack right once.

[phillmv]

I worded it unfortunately, but we're getting at the same thing.

What I mean to say is the easier it becomes for everyone to get everything right all of the time the more likely it is to occur.

Expecting everyone to individually know and understand every single gotcha is unrealistic compared to distributing the work load across a framework.