<i>I'm not saying that Microsoft ships perfect software, because what I'm saying is that it's impossible to ship perfect software.</i><p>When you write it in C/C++, anyway.<p>(I think Microsoft has almost solved this problem, though, with their heavy investment in the CLR and languages like F# on top of the CLR.  Even C# is fine, compared to C or C++.  You can still write insecure software in managed languages, but it will be because of a careless design, not forgetting to tack a "\0" on the end of a block of memory.)