We are not a clown industry - we are an evolved industry - both parts of that matter. We evolved in an environment where these kind of attacks were not possible or were freak, state sponsored events. Kind of like moving from a sheltered lagoon to the Pacific Ocean. And we are an industry - where profit matters. Open source was lead by people like you who cared and did not have profit to constrain them. Which is why it’s better engineered (and frankly if open source like Linux or FreeBSD had not existed in our lagoon, the profit would have failed earlier and commercial Linux would have had to been built and built to same standard (god knows how)

But we are out in the pacific now, and boats that sink make no profit, so we will evolve again, and again.

But it’s hard to blame Moana standing on a pacific island for not inventing a nuclear powered battleship.

(Trying not to be too blame-y on either side)

These attacks aren’t freak, and nor did they take state money. It’s more so that security by obscurity really did work because it didn’t cost a few dollars to attack people. Now we’re having to reckon with security debt, not code debt. It’s still quite fashionable to increase code debt to buy velocity and efficiency.