mean software that is less vulnerable? (Incidentally, this is the premise upon
which the whole source code analysis tools industry is based.)
Of course one can reasonably argue, as Bellovin has, that even a single
implementation fault, if exploited, can compromise the software. Even were