Harlan Ellison's story "Repent Harlequin said the Ticktockman" is also a good analogy for cybersecurity. The setting is a dystopic future where everyone has to be on time, on pain of death. Not being late is the same sort of moral imperative our community treats security.
2/ You don't need to be so secure. You don't need to lock your door in most neighborhoods. The few who would try to open an unlocked door wouldn't be stopped by a locked one, they'd just break a window. But it's a moral imperative to be secure, regardless of risk calculation.
3/ The is true in the infosec industry, a moral imperative to be secure regardless of risk calculation. According to Verizon DFR, vulns account for 2% of breaches, and always after patches have long been available.
4/ But even though 0days are inconsequential in cybersecurity, they are the focus of much public policy discussion, with the belief that companies from Microsoft to IoT vendors should be punished for them.
5/ Trying to regulate such things, such as forcing "liability" penalties for bugs, won't improve security, can't improve security, but will destroy software innovation.
6/ In our dystopic future, Europe and the US will have regulated the Internet and software to death. We'll all be downloading bootleg software from China and Indian, places where code writing is still free.
7/ Anyway, we already live in Harlan Ellison's dystopia where busybodies force us to do things they think are good, despite evidence against them. Example are laws requiring seatbelts and against texting while driving.
8/ Texting while driving is a prime example. Everyone knows its dangerous. The only people who don't know this are the scientists who measure accident rates, and economists who can explain why ("risk compensation").
