the only secure computer is powered off
expressionsecurity
Gene Spafford's reductio: the only truly secure computer is off, encased in concrete, guarded - and useless.
The point is not despair but framing: security is not a reachable end state, it is a trade against usefulness, managed as risk. Every real system lives somewhere on the line between the concrete block and the open door.
The only secure computer is one that is unplugged, encased in concrete and buried, and even then you should not count on it. The joke is usually attributed to Gene Spafford, and the reason it is quoted so often is that it names the impossibility clearly enough to make the real question visible.
That question is not whether a system is secure but whether it is secure enough for what it does, against who is likely to attack it, at a cost proportional to what it protects. Perfect security is available and it costs all of the utility, which is why the buried computer is funny: it satisfies the requirement by destroying the purpose.
Air-gapping is the serious version of the same idea and demonstrates the same limit. Stuxnet crossed an air gap, and so have several documented campaigns since, because the gap is bridged by the humans and media that have to cross it for the system to be useful at all. The joke is therefore not cynicism. It is an argument for threat modelling, for accepting residual risk explicitly, and for spending on detection rather than only on prevention.