> That is stupid, no software vendor can harden consumer software meant to run on a desktop internet connected computer to the point that a large government age

> That is stupid, no software vendor can harden consumer software meant to run on a desktop internet connected computer to the point that a large government agency can't find a vulnerability. I don't buy this. If the vulnerability is in the OS or some other program, those parts are to blame. But it's perfectly possible to avoid the mistakes that are typically employed for such intrusions (usually they are in the OS anyway - you know, the OS with no warranty, no accountability, but a monopolist price). When they aren't, it was usually some mediocre C programmer's sloppy coding (there are safer languages for mediocre programmers). The whole point of such regulations would be to put some pressure on developers so they must choose proper tools, languages, methodologies to keep customers from harm, whereas now they simply do what they like with no consequences.