It's an interesting categorization. I'd be in both categories given various activities. Yet, I disagree with category 1 as it seems like an accidental strawman. There's certainly those types of people literally. There's more of us, though, that see insecurity baked into almost everything we depend on even as a country. The state of the grid, banks, increasingly important mobile OS's, infrastructure protocols... you name it... has been shit for way too long. Unnecessarily so. You alluded to that with your DNSSEC example.
So, on top of engineering challenge, there's the need to fight for a greater baseline across the board. I'm just for doing it a different way than in OP where they call the dev's idiots. ;) More along the lines of convincing management to adopt whatever practices add great improvements to quality and security with little extra cost. Quite a few exist. The value is lower liability, more predictable schedules due to reduced debugging, quality/uptime differentiator vs competition, and possibility of charging extra for that.
Enough promotion of better-by-default in key areas will improve our baseline over time. There's actually been a lot of progress vs where we were in 90's. So, it's at least working a little. DARPA and NSF are also steadily funding strong stuff in variety of areas that has legacy compatibility where possible. More potential to push strong stuff in the future.
So, on top of engineering challenge, there's the need to fight for a greater baseline across the board. I'm just for doing it a different way than in OP where they call the dev's idiots. ;) More along the lines of convincing management to adopt whatever practices add great improvements to quality and security with little extra cost. Quite a few exist. The value is lower liability, more predictable schedules due to reduced debugging, quality/uptime differentiator vs competition, and possibility of charging extra for that.
Enough promotion of better-by-default in key areas will improve our baseline over time. There's actually been a lot of progress vs where we were in 90's. So, it's at least working a little. DARPA and NSF are also steadily funding strong stuff in variety of areas that has legacy compatibility where possible. More potential to push strong stuff in the future.