> For instance, there was one person, 2 decades ago, flying out of france, who hid a bomb in his shoes so today we are all still taking off our shoes, all of us, each time, on every flight. Splendid.

I'm still disappointed Umar Farouk Abdulmutallab's attempted bombing didn't lead to a similar policy.

> it's like we've taken the structure of folksy tales like "one child did that and they poked their eye out" and are all like "ok, let's make official policy around this"

Growing up, my mom was repeatedly told not to play with a button on a string because, "some kid put his eye out". Being a kid my mom always thought that was just a stupid story. She played withing a button on a string, and didn't know anyone that happened to. Decades later, as an adult she was telling the story about this weird and admonition to a distant cousin (2nd?) of hers, and her cousin got real quiet, and simply stated, "That was my brother," and then told the story about how it happened, and that he did lose sight in one of his eyes he struck it with a button tied to a string.

> For instance, there was one person, 2 decades ago, flying out of france, who hid a bomb in his shoes so today we are all still taking off our shoes, all of us, each time, on every flight. Splendid.

I feel like the shoe inspection is silly, but this seems like the wrong logic. To the extent that there's a vulnerability in the system, patching it makes sense, even if it's only been exploited once.

No one has closed network sessions with unauthenticated RSTs lately like we used to do in the 90s-- so is the sequence check no longer necessary?

Of course, one needs to consider the cost-benefit of every mitigation measure and whether you're addressing the biggest risks.

I bet a lot of people on this website will nod their head and think to themselves that they agree with your comment (because of the specific examples you gave), but in my experience fewer than 1% of the general population and probably fewer than 5% of people on HN today are capable of actually thinking in a utilitarian manner. Even my smartest and most numerate acquaintances (let’s say +2-4 stddev, mostly scientists and engineers) have to be pushed to thinking this way about specific issues unless they have a background in economics or something. The concept of making decisions as part of an explicit optimization strategy, rather than as a result of applying a set of heuristics, is completely foreign to most people. Giving specific examples almost invariably pisses people off, because they’re emotionally invested in the heuristics being accurate. They would probably be fine in a tribal group of ~100 people with no out-group communication, but they scale very poorly to billions of people with an internet connection.

I mean, speaking of the shoes, yes it was one time. But once it was shown to work, there would probably have been many copycats without a countermeasure.