Software development is an additive practice, where opinions and ideas are usually added to a big-ole-shipping-ball of software. I think this is where most complexity comes from.

Sometimes it can be a subtractive practice, where a person can delete / simplify, but this happens much less than it should.

Same with security, unfortunately.

Ironicaly, complexity is the enemy of security (as I’ve heard quoted a few times)

Zawinski's Law

> “Every program attempts to expand until it can read mail. Those programs which cannot so expand are replaced by ones which can.”