I've been fighting to get your friendly northern neighbour, GC, secure. One thing I can't quite square though:
Why on earth are so many supposedly important systems _so_ insecure.
For example, TLS on email servers for our military think tanks or the unclassified email servers of our intelligence agencies or militaries.
Not having S/MIME or PGP I kinda understand, but full-blown TLS? I know protocol downgrade attacks / DNS attacks / etc are a thing, but passive surveillance of email traffic is _well documented_ and a thousand times easier than something noisy involving forged DNS responses. Even if there are networks with reliable blackers for actual classified stuff, surely communicating with professors or researchers that lack clearance is also worth protecting, no?
Why is it taking decades to get simple email / server configurations fixed?
Also, why is everything so broken and why does nobody seem to care?
Take QNX for example, the supposedly secure microkernel OS that we put in ever switch, router, car, truck, nuclear power plants, military radios, etc. It had almost all the same vulnerabilities that Linux and Windows had. Broken SRNG, hardcoded backdoor⇧⌥←^h^h "maintenance password", easy privilege escalation. Hell, even the crypt function wasn't a hash! It was just a bit mixer!
What is in the way of someone at the NSA just saying: "No, don't allow this to happen. Don't let them put the operating system into a bunch of stuff that we sell on the market."