[Lemos] [Martin2007a], it seems like there’s no end in sight. The same high-profile
software continues to be battered. There is now enough history to try to compare
products based on the number of disclosed vulnerabilities [Jones] [Cox], but these crude
metrics have a number of important limitations, such as the varying skills of the