Thou shalt have no other gods before the ANSI C standard 1448

I thought about saying something like that, but came to the conclusion that in my opinion that "not caring" is part of the cost benefit equation. If your boss doesn't care, you better not ... if his boss ... recurse ...

Totally agree. The same for reliability, availability, fitness for use, etc.

In the executive suite they try to maximize shareholder return on investment. How this is done, and the style in which it is done, permeates down through the entire company (college, university, standards body, etc.) That said, the executives are usually driven by the market more than anything else. If you can't sell it and make a profit, then soon it won't be made by you ... you will be out of business.

Going further along this line of thinking brings me toward a societal or cultural view of all these issues. When I think about how easy or hard it might be for someone to hack my credit cards accounts, I find that I just don't care. I have near zero personal liability. Oh, there will be a small bother talking with the bank, but the last time this happened the conversation lasted about 5 minutes, the bank sent new credit cards overnight, and they ate the entire loss. I should note that the "hacking" involved mail theft, not computers.

To bring it back to buffer overruns, no, the mailbox was not full :-) It instead suffered from a minor underrun by one bit of mail.

So there is, perhaps, this societal element where there is little personal risk from most buffer overruns, thus J. Average Consumer does not choose to pay a little more money for a lot more secure web banking experience. Yes, counter-examples abound ... but even though the media plays things up as if the world was about to end, for the average person it isn't, and she knows it. Yes, there is a cost, and it is spread across all users much like a tax or insurance premium.

Now that I read what I just wrote, the realization sunk in thatBAH has been saying bits of this all along :-)

--

... Hank