I still wonder why there are no dramatization movies about this story.

Android reports 1000x lower memory safety defect density in Rust than in its C and C++ code, with fewer rollbacks and less review time. Manufacturers can show commitment by publishing a memory safety roadmap.

These defects are not primarily a developer skill problem. They are a language and tooling problem. Memory-safe languages like Rust, Java, and Python eliminate this entire class by construction.

Memory Safety: Memory safety defects like buffer overflows and use-after-free account for most security defects in C and C++ code.

* Quality Planning: define what security means for your product * Quality Control: monitor whether processes meet those goals * Quality Improvement: continuously analyze failures and near misses Fun fact: Juran also popularized the Pareto Principle in quality control in the 1940s.

Quality by Design: Security is a quality outcome — and should be built that way. In 1986, J.M. Juran presented the Quality Trilogy, a model for building better products:

If only someone had warned us decades ago...

AI agents are making reverse engineering faster and more accessible. Some people are predicting the death of proprietary software. I'm more interested in what happens to all those vulnerabilities devs assumed nobody would find. Your source code might be proprietary. Your vulnerabilities aren't.

We used to! If you knew your new car was dangerous in tight turns, you could, at your own time and expense (if you had the tools and skill), buy/install a camber compensator to reduce the chance of rollover. 😱 We don't do that anymore, and we don't have to live with unsafe software, either. 🔐

The CWE field names the defect class. A class that keeps recurring after a manufacturer says it was fixed is the number worth tracking (see UV-01).

Counting CVEs tells you little. A rising count can mean a worsening product or a maturing discovery program. A low count can mean a safe product or a manufacturer that isn't looking.

CVE: A CVE (Common Vulnerabilities and Exposures) is a public record of a known security defect, and a shared language for discussing defects. A record can include a description, severity score, and links to fixes.

In secure-by-design software, security isn't an afterthought. It's part of the blueprint from the beginning. Customers don't need after-market tools, heroic configurations, or hope. Good security should be a customer right, not something customers add at their own expense.

Secure by Design: Secure-by-design software has protections baked in, not bolted on. Modern cars have integrated airbags, crumple zones, and anti-lock brakes. Those features cannot be added after the product ships — they're built from the ground up.