This is a fascinating discussion because it betrays two fundamental attitudes of society to risk.

RyanZAG is "correct". If someone breaks into my house and steals my TV, then my security was a failure.

This leads to the next problem - its not a catastrophic failure in today's (western) society. I am probably out at work, and I am insured, and the burglar is unlikely to be waiting when I get home to murder me.

However, there have been plenty of societies in the past, and are many now, where the expectation of loss would be almost total - someone breaches your security, they take the tv, kill you and your family and burn the house down on the way out.

So its not a judgement on the resources of the attacker that matters, it is the expected consequences of the breach - the expected value of damage.

Which side of the argument you come down on depends on whether you see the Internet as basically a nice London suburb with a few bad eggs in it, or a violent amalgam of Feudal Middle England and Mogadishu on a bad day.

You're conflating two things, inappropriately in my opinion:

> If you offer a bug bounty to improve security, make sure you give a reward for any possible breach that could cause you to get hacked, regardless of whose 'fault' the vulnerability is.

This is true. There's no upside for rejecting this as "out of bounds" except for a relatively tiny sum of cash.

> If you know of a way to increase security, then you should increase it.

This I disagree with completely. If there's anything you can do with negligible cost you should do it, however there are all kinds of costs. There are usability costs, operational costs, training costs, etc, etc.

You can't hand-wave these away by declaring that any breach is failure without recognizing the fact that there is no such thing as perfect security. In fact all security is gambling, and it should be a gamble based on the best odds we can come up with professionally against the cost of failure. If something requires 100% perfect security then that thing should not be done, period.

No, security is about trade-offs. If you throw absurd resources toward protecting against entirely unrealistic threats and your company goes out of business, you've failed. If you have legitimately made the risks small enough, for the resources and threat model (and that threat model sufficiently matches reality), you've succeeded. There are of course some legitimate caveats, including talk of externalities and questions about how one would measure things, but I still assert my basic model is more correct than yours.

Recognition that security is only as strong as the weak link does not imply that all links must be infinitely strong.

> So skimping on security is always a terrible idea. If you know of a way to increase security, then you should increase it.

This is what all of the "security" vendors would like you to believe. It completely ignores the value of the assets you are securing.

How many rounds do you use with PBKDF2 if you want to slow down attackers? You can always add more rounds to slow down brute forcing, so how would you reconcile this with your statement of always increasing security. The same applies to bcrypt.