Rob Lucas comments on What can we learn from insecure domains?