Hey Dan, thanks for responding. I can't address your first point because I agree with it - part of the reason I'm pessimistic is because there isn't a strong b

Hey Dan, thanks for responding. I can't address your first point because I agree with it - part of the reason I'm pessimistic is because there isn't a strong business model. However, I think that it's hard to know who to partner with. For all the organizations that you can partner with to produce fruitful research, you have many who are trying to make a quick buck on the trendiness of security. We don't have a lot of Mayhems. We have a lot of Acunetixes. I agree that the methodologies and tools required to write secure code already exist. However, I don't think it's fair to place all the onus on software developers. Even if they avoid C/C++, they still have modern pitfalls in just about any language. I think more research should be done on security software of course, which is why I wrote this blog post. What my post doesn't address however is that I also believe more research should be done in educating developers. It doesn't matter if all the tools to help them exist if few of them bother to look for them. Research could help in this regard - education. Finally, I think you're much more familiar with Mayhem than I am, but I call into question the bugs Mayhem found. How many were high severity and/or actually exploitable? (I'm actually asking because I've seen conflicting reports from both Mayhem and Michal Zalewski on the matter). When I say being used in the open, I mean in a similar way to Project Zero's activities. Mayhem was used once on Debian as far as I'm aware, and to my mind it looks more like publicity than an ongoing effort to find bugs.