Is all software critical software? This guy makes the argument that it is

The amount of insecure and exploited "IoT" devices is only going to increase in the coming years. As many others on HN have advocated before, a defense in depth [1] strategy is the best (and perhaps the only) way to effectively reduce the risk of successful attacks in complex real-world environments.

Software engineers should still do their best to write secure software, but higher order strategies are really the only way forward at this point. From that perspective, there is diminishing returns to hardening fish tank thermometers and the like - but still the tradeoffs and threat models should be carefully evaluated.

[1] https://us-cert.cisa.gov/bsi/articles/knowledge/principles/d...