Youtube channel "MentourPilot" [0] has some excellent examples of how civil aviation was built to withstand "small fuckups": with "Swiss cheese" model. [1]
That’s my point. We would not tolerate companies that build bridges that collapsed all the time and keep letting them build bridges so why should we tolerate companies that get hacked repetitively by ransomeware groups? Insurers are running because it’s not good business to insure these risks. Sounds like the market is working just fine.
"Small fuckups" which result in catastrophic failure, property damage, injury, or death, are not.
For the latter, you'll find all manner of standards, codes, practices, maintenance, and inspections.
What we're discussing with regards to infosec aren't "small fuckups", they're repeat major catastrophies, bearing little or no risk to the firms and organisations perpetrating them.
A large component of the risk resides simply in collecting and retaining data, as well as exchanging it with other organisations. That turns out to be a very high-risk activity, though the risks are externalised. The point is to internalise those costs, and to sharply reduce the incentives for the practices which present those risks. This includes incentivising the IT products and services sector toward architectures which can be more adequately protected.
I do agree with the rest of the post but this is definitely NOT true. Your house probably has small issues here and there if you are willing to pay for an inspector. Doctors fucking up things is not news too, plus you never know if there is "one small fuckup" as long as you don't feel particularly bad afterwards.
The thing is I think you guys regard real world engineering too high. Small fuck ups happen all day.