There's another addendum to this: an another issue that is incredibly relevant to software per se. Most of the time when we build software, the only source of

There's another addendum to this: an another issue that is incredibly relevant to software per se. Most of the time when we build software, the only source of truth, that defines the way a given software must behave - is it's own source code. Thus even when we can prove for sure, that the source code that is being executed is the source code we had just written - we might be missing the cases when we were the ones responsible for introducing the behaviour that we ourselves had not expected. I think the only way to fix that is to introduce even more constraints on the already built system. We use exactly the same mechanics in out legal systems: while there's a single source of truth for most of the laws - there's always the court that checks every single day, if these laws still hold true for a given moment in time, or if they hold true for a given specific scenario. I believe a set of closed-source tests provided by different providers for open-sources software, for example - could work really well. E.G. every time you push a new commit to nginx repository - there's organisations A, B and C which would also report their independent findings on the possible exploitation of the new code. Those findings do not need to be aiming for the same bugs. One of them might be more people-oriented, and another one would be incredibly technical, reaching for the bugs that happen due to compiler design.