> The problem is behind the keyboard and the chair. The human will make mistakes, as that is what humans do. That's not fundamentally fixable: even the savant

> The problem is behind the keyboard and the chair. The human will make mistakes, as that is what humans do. That's not fundamentally fixable: even the savant will make the occasional error. Compilers and static code analysis can help mitigate the human factor, as can code reviews and any number of other variables. Static code analysis and "safe" languages seek to mitigate the problem. They are not the only variables in the security equation, but holding everything else constant, given three codebases written in C, C++, and C#, I'll just outright assume the first two will have at least one buffer overflow that's potentially exploitable for arbitrary code injection. The third, at least, has a chance of said overflow being "merely" a potential DoS vulnerability.