I think Colin Percival put it best in his blog post about Heartbleed: "The most secure code in the world is code which is never written; the least secure code

I think Colin Percival put it best in his blog post about Heartbleed: "The most secure code in the world is code which is never written; the least secure code is code which is written in order to comply with a requirement on page 70 of a 100-page standard, but never gets tested because nobody enables that option."