For several years now, I've been an advocate for either "uninstalling" the default route on (most) hosts and/or switching to a default deny policy for <i>outbound</i> traffic, just like we all did for inbound traffic a long time ago.<p>I'll readily admit that the amount of work required in order to do this is <i>HUGE</i> and, of course, it isn't gonna happen overnight. Every time we have another one of these massive vulnerabilities that affects damn near everything and everybody, though, I think we get just a little bit closer.<p>Once some large company makes the decision to do it, then actually does it, then (at some point down the road) shares publicly how it totally saved their ass when $thing happened, maybe some CISOs will start to take notice and (eventually) follow suit.<p>As with IPv6, I remain hopeful that we'll get there at some point in my lifetime! Unfortunately, though, I'm sure it'll take a lot more "bad shit" happening first.