I've been working on a web app for the past two years and keep having the uneasy feeling that security-wise all I'm doing is adding a few "rooms" to the house of cards that is today's software and network security.<p>Would it be possible to host a single _bit_ on the web that I KNEW could not be hacked, exploited, MITM'd?<p>So much of civilization is now networked, critical infrastructure, even nuclear power plants. With the state of our security capabilities, this seems unconscionable.<p>I'd like to be part of building something that has actual security---not the whack-a-mole that is de facto for every major operating system, library, database, API, service, device, CPU architecture, programming language, etc.<p>Is security even possible?<p>I've learned Rust, which can solve or seriously reduce the risk of _one_ class of security holes. But that's at best a constant-factor improvement---even if all software were competently written in memory-safe languages, the threat surface would still be unfathomably vast.<p>What are we even doing here?<p>P.S. I know this is a bit hyperbolic but... there's got to be a better way?<p>P.P.S. The lack of security also seems to be the main threat to the Internet's end-to-end principle, which has previously been the most empowering thing about this global network.