Though many comments here speak of engineering flaws, but to me it was a cultural flaw. The most outstanding anecdote I have to illustrate this is when I told my manager that &quot;I can&#x27;t &lt;note that I say &quot;can&#x27;t&quot;, not &quot;won&#x27;t&quot;&gt; run that internal test tool (the insect farm thing, for those that were in DevDiv around 2003-ish) that runs 24&#x2F;7 with complete network access because it requires &lt;but did not <i>need</i>&gt; admin privileges.&quot;<p>That nearly got me fired. You read that right: when I point out that a sloppily written application that someone wanted the entire developer division to run was insecure, my manager basically told me to run it or else. If the dev can&#x27;t even be bothered to not write to PROGRAM_FILES (which is the only reason it needed admin privileges), what other holes does it have? Well, I&#x27;m not about to find out on my dev box that&#x27;s hooked to the corpnet.  Running on an internal-only alpha version of the early .NET runtime to boot; what could possibly go wrong? (And as it turned out, nothing went wrong, but still...)<p>And this was <i>after</i> Valentine&#x27;s mail was sent. SQL Slammer had already happened. What, you thought the whole company just jumped on the security bandwagon? Yeah, I thought a new day had dawned, too. You can make &#x27;em quit blindly using <i>strcpy</i>, but you won&#x27;t change their minds with an email even after Valentine asks the whole company to come in and take Slammer support calls.