Those are the usual answers. But they're too broad.

A good way to look at the problem is that trusted software needs to be far less vulnerable, and untrusted software needs to be kept in a cage where it can't make trouble.

On the untrusted side, all games, for example, should be caged or sandboxed. (Yes, this breaks some intrusive anti-cheat mechanisms. Tough.) Applications on phone-type platforms should have far fewer privileges, (Yes, that breaks some ad networks. Tough.)

Until somebody with enough power to make it stick takes a hard-ass position and sets standards, there's not going to be progress. It would be progress if AT&T or Comcast or Verizon deployed secure routers, for example.

Fairly in-depth. I'm surprised though, at the generally positive tone around containers/docker. No mention of the the current widespread practice of containers running as root. Nothing about the relative lack of protection against local kernel exploits escaping the container, etc.

Was expecting something a little more balanced on the topic.

I don't really understand why this doesn't cover memory safety.

It seems like I am seeing something about SAT solvers almost every day now.

Some of these are great, some of these are OK, and some of these are horrible ideas. I wish instead of "studies" we did RFCs

"A weakness is an undesired characteristic of a system’s requirements, design or implementation [Black11a]. This definition excludes:

* ...

* insider malfeasance, such as exfiltration by Edward Snowden"

Heh.