[kentonv]

> As some people used to say, "security is binary; you either are secure or you are not".

Disregarding all other context: I disagree strongly with this statement. Practical security is about risk management, and is never binary unless you've proven the absence of bugs (and backdoors) through your whole stack down to the transistors (unlikely). The practical exploitability of any particular bug is certainly relevant.