Metricon 1.0, [119] was held in Vancouver, British Columbia, Canada. Steve
Bellovin, one of the “greybeards” of the information and network security
community, summed up the problem nicely in his keynote address to Metricon.
He argued that for software, meaningful security metrics are not yet possible: