Until recently, Ozment’s question was valid—reputation was not enough
to motivate software vendors because it was not enough to motivate software
buyers. As with buyers of used automobiles, buyers of software had no way to
ascertain that software actually was secure. They had to accept the vendors’