Product developers make cost-benefit decisions all the time and much of the cost of slow or insecure software is externalized. A knee in the developer-visible cost-benefit curve represents the MVP everyone is so keen to release to market.

To be clearer, I would say that software is exactly as fast and secure as the market will bear.

There is probably an economics term I can cite to explain this better, like some kind of equilibrium (I appreciate any help explaining this).

But the sibling basically got it half-right -- software developers and designers are always making cost-benefit decisions.

The other half of it is that consumers tend to choose features rather than security. The are ALREADY faster and more secure alternatives to every piece of software you use -- you just don't use them because they don't have the features you want!

People vote with their feet, and what we end up with is not the fastest or most secure situation, because there are tradeoffs.

This applies to developers too -- not just end users. I mean why do people choose Python, PHP, or JavaScript? There are faster languages out there. There are languages that could help you write more secure applications.

But those languages have the features and library ecosystem we want, so we use them.

----

I'm one of those people who laments slow and insecure software. But doing my own open source project has kind of brought home the tradeoffs. I've been working for over 2 years on an open source Unix shell. It's written in Python [1], which is not exactly the right tool for the job. But if I wrote it in C or C++ or Rust, it would take 4 or 6 or 10 years.

So unforunately it is too slow, but there's a tradeoff between being slow and being fast but not existing and nobody using it. (Although I have a plan to fix it, basically outlined in that blog post. Not sure how much effort it will take, but I think less than rewriting from scratch.)

It's an economics problem -- if it doesn't have the features people already use, then they'll have to rewrite their software. Rewriting shell scripts costs a lot of money and it doesn't have a lot of advantages. It's more economical for one person/team to emulate bash in a new shell, than for the entire world to rewrite their scripts.

This recent blog post has the same sentiment buried in there:

https://apenwarr.ca/log/20180914

XHTML didn't succeed because it's more economical for a single browser vendor to make a really complicated parsing algorithm than it is for every single person in the world to change how they write HTML.

It's not like we don't KNOW how to design strict data formats, or we don't KNOW how to make secure software. (e.g. ask yourself why more people aren't using DJB's software.) It's matter of economics -- how much effort are the people making decisions willing to put in, and how much the market rewards them for it.

We can certainly improve the situation by valuing secure and fast software, and that has happened in the past. Windows used to be an utter disaster security-wise, but Microsoft realized that it was more than the market would bear, and they changed their whole attitude toward security.

Although if you want to be cynical, you can also say they made the "right" move to ship first and make things secure later :-(

[1] http://www.oilshell.org/blog/2018/03/04.html

It means that people haven't thrown enough {time, energy, money} at the problem.