Cybersecurity

From what I've read, thus-far, prohibiting autotools would be a good 1st-step.

Then auditing all the damn ocean-of-vulnerability-in-a-single-crufty-swamp dependencies, & getting committed about clarity & accountability in packages, would probably be required.

I read an article, a couple years ago, about web-frameworks..

The guy doing the writing said he found they were often malware, or corrupt, or trojans, or utter-bullshit..

Haskell's got a kind of mantram: don't bring in a whole framework, just compose what you need, yourself, together.

Its a granularity-difference.

Requiring a framework, which itself requires other frameworks, as that guy was pointing-out ( he wasn't interested in Haskell ), is a liability nightmare.

But the culture of just having an infinite bring-in of frameworks & libraries, so one can write a little, easy code, is a culture that is biting the world's security in the ass.

It cannot be, that people just include everything from everywhere, & somehow have secure/trustworthy systems.

To have a secure, trustworthy system, one needs to know that one has disincluded corruption/malicious-code.

That requires limiting what's included, that includes auditing, that includes accountability, that includes having understandable, sufficiently-clear stuff that one is including.

Consistently, at all levels, relentlessly.

It's a chain: you cannot have a weak-link without compromising the whole chain.

You cannot compromise ANY subsystem in a distro, & have a trustworthy distro.

There are 2 contradictory paradigms: the "magic bullet paradigm", which doesn't care how much rot, compromise, anything, so long as they include the "magic bullet" which takes-out the competitor..

.. vs the "no weak-points, whatsoever, paradigm", which doesn't rely on magic, it relies on defense-in-depth, and carefulness, and everybody working coherently, etc, in order to disallow corruption/malicious-actors any leverage/grasp on us.

They are cultures, not just ideas.

Some people cannot tolerate a "no weak-points" culture, they "NEED" to compromise things ( I don't care about the bugs, get more features in!!" ), and they must be put out into the other organizations/operations, because they CANNOT tolerate careful-paradigm.

It truly is a culture, or "religion", and there's no faking it.

Look to OpenBSD, & see what it takes to be like them..