[ewindisch]

This conversation circles back to Theo de Raadt's argument that developers are caring too much about performance in security-critical applications.

[pfortuny]

Which is the typical point in which Theo de Raadt is right even though he may be saying so quite singularly.

This is another instance of the lack of 'engineering' in Computer Science/Programming/you name it. Engineers have long ago learnt that you need "automatic" standards and compliance before, during and after building anything, and that the best practice is always assuming thing will go wrong.

This, unfortunately, is not the case with programming as we can see time and again.

But I digress.