> First is its extreme mutability: you can endlessly patch it, and often have to when vulnerabilities or flaws are discovered. Sometimes, instead of patching,

> First is its extreme mutability: you can endlessly patch it, and often have to when vulnerabilities or flaws are discovered. Sometimes, instead of patching, the software should be decommissioned. Search in the news for planes which were grounded when serious flaws are found. > Second, if you want to be cost-effective you must leverage many existing components of mostly unknown providence and quality. There're different components for different kinds of requirements. You won't use components for two story buildings, to build a skyscraper. > Finally the security aspect is extremely difficult because both the cost and risk of mounting an attack are extremely low. If the risks are high, systems shouldn't be deployed. There's a reason we don't allow people to have machine guns for self defense.