Looking back on all both Daves said, there is an extraordinary amount of attention paid to getting things done and out the door, and almost no mention of planning ahead, and actual security strategy. Its all commercial pressure to get the sausage out of the meat grinder, and keep the failures down to an acceptable level.<p>No wonder things never get better, and never take a turn in the right direction, industry wide. I used to think we'd eventually get to capability based security, but now I see we'll always be stuck with application permission flags, the almost worthless bastard cousin, instead.<p>I weep for the future.