On avoiding band-aid security after penetration tests | Hacker News Reader