Comment Can't blame it all on Private Equity (Score 1) 26
The poor architectural decisions and lack of care when fixing vulnerabilities goes way back, before PE got involved, it seems. Fortinet decided that "encrypting" their appliance filesystem to obstruct researchers was a better use of their time than actually trying to *design* a secure architecture for their systems. Of course, it was a pointless waste of time, because the appliance decrypts itself during boot, so the keys are available.
Another of the VPN vendors had a more recent vulnerability, that turned out to be in the same CGI as another vulnerability reported several years before, just a different parameter. Had they taken security seriously back then, they would have searched for any other places that could be vulnerable, not just implemented a point fix.
And of course, practically every vulnerability discovered in the major VPN providers ends up as a root shell. Because everything is running as root, rather than as a less privileged user.
This is what e.g. OpenSSH does. Someone finds a vuln in OpenSSH, and they scorch the ground! They implement solutions to eliminate entire classes of vulnerability in their code base, so that it can never happen again. They architect their code to reduce impact of any vulnerabilities in a belt-and-braces approach, for example, privilege separation to ensure that the exposed attack surface is mostly in an unprivileged context, rather than root.
