100 percent security of software is not possible, i.e., one cannot measure what
cannot possible exist. During the software security metrics track that followed
Bellovin’s keynote (and the very fact that there was such a track implicitly
refuted Bellovin’s argument), Jeremy Epstein of webMethods implicitly agreed