> Imagine that the whole city has to install iron doors and window grilles, because wooden doors and glass windows are not safe enough anymore.

> That's a lot of work, but is it productive in the end? Probably not.

Your imaginary scenario defines the solution to be pointless. If that same city was subjected to weekly riots smashing windows & doors, and people regularly died, stopping "productive" work to install things that keep people alive and productive? That's productive.

The physical world comparison is interesting. In the real world we have a small amount of security, but most things could be broken in to. Instead of fortifying everything, we just imprison the people breaking stuff.

Obviously this doesn't work on the internet since most hacking comes from overseas out of our control. Which makes me wonder if there is a possible future where we just block packets coming from countries that don't lock up the hackers.

I think the physical world comparisons should keep in mind the kind of data a lot of these systems (eg postgres) handle. It's more like securing a bank vault than locking a home's door.

People usually don't install steel doors because most burglary is prevented in other ways. Insecure software will be exploited this way or another, if the vulnerabilities are real and the threat model is valid.

By this line of thought building nice and usable UIs is not productive too, because users can learn cli tools (they did, DOS) and it costs less to develop them. And all the work in TLS/HTTPS has been wasted because HTTP is enough. And ssh vs telnet.

It becomes productive only once your business stops for days because somebody brought it to a halt by breaking into the servers and deleting them.

In the rest of the world making sure your product works like it is supposed to is considered table stakes. In software we somehow consider checking the parts of it we can think of 'good enough' and the rest unproductive

Flawed analogy! These bugs are bugs regardless of the label. Security bugs are a subset of "regular" bugs.

You have a perverse view of product ivity

it actually is productive, because steel bar retailers and metal door installers will make a ton of cash and then 'trickle' that money into the economy.