thus very reluctantly conclude that security metrics are chimeras for
the foreseeable future.We can develop probabilities of vulnerability,
based on things like Microsoft’s Relative Attack Surface Quotient, the
effort expended in code audits, and the like, but we cannot measure