Why security is terrible: computers, software, and the people who use them are broken
Everything Is Broken — Once upon a time, a friend of mine accidentally took over thousands of computers. He had found a vulnerability in a piece of software and started playing with it.
Context & Ripple Effects
The essay arrives at a moment when its thesis has fresh receipts: six weeks earlier, the Heartbleed bug put the chaotic state of Internet security under scrutiny, and January's coverage of wildly insecure, often unpatchable connected devices had already made patching failure a mainstream story. It also extends a longer arc — The Register was cataloguing why SSL was hopelessly broken back in 2011, and the Washington Post was preaching basic rules plus common sense as far back as 2005.
First-order effects
- Security practitioners and commentators gain a shared manifesto that reframes breaches as structural failure across computers, software, and users — the anecdote of a friend accidentally taking over thousands of machines via one vulnerability makes trivially easy exploitation concrete.
- The essay's unusually broad same-day pickup — TechCrunch, The Verge, PandoDaily, plus prominent security voices on social media — signals it is being adopted as shorthand within the security conversation itself.
Second-order effects
- Vendors of connected hardware face sharpened criticism that their products ship unpatchable by design, pushing patchability and update mechanisms toward the center of buyer criteria rather than an afterthought.
- The argument redirects responsibility away from user error — the 2005-era 'common sense' framing — toward software makers, raising pressure on maintainers of critical code in the wake of Heartbleed's exposure of thinly resourced infrastructure.
Third-order effects
- If the everything-is-broken frame hardens into consensus, security stops being sold as user awareness and starts being treated as an architectural and accountability problem — a precondition for eventual regulatory or liability debates over software quality.
- The gap the essay names — between what attackers can do with single vulnerabilities and what defenders can fix — points toward industry consolidation around platforms and practices that can actually be patched at scale.
The trend: The security debate is shifting from individual vigilance and common-sense advice toward systemic accountability for software that ships broken and stays broken.