I am reminded of JWZ&#x27;s &quot;On Toolkits&quot; (<a href="https:&#x2F;&#x2F;www.jwz.org&#x2F;xscreensaver&#x2F;toolkits.html" rel="nofollow">https:&#x2F;&#x2F;www.jwz.org&#x2F;xscreensaver&#x2F;toolkits.html</a>):<p>&quot;Let&#x27;s suppose that down in the bowels of some particular version of some particular toolkit library, there lurks a bug. Let&#x27;s suppose that the nature of this bug is something relatively obscure: say that it&#x27;s something like, if you hold down 5 keys on the keyboard for 10 seconds then drag the middle mouse button, the text entry widget gets a SEGV. (In fact, I&#x27;m not making this up: I saw this very bug once, years ago.)<p>Now, that&#x27;s the sort of bug that is not likely to be noticed or fixed, because it&#x27;s the sort of thing that people &quot;never&quot; do. If that bug was reported against, say, a web browser, nobody would much care: User: &quot;I can crash my web browser by doing this crazy thing!&quot; Developer: &quot;Uh, don&#x27;t do that then.&quot; And that&#x27;s not a totally unreasonable response.<p>However, in the context of security software, it matters, because then it&#x27;s not merely a cute trick that crashes the program: now it&#x27;s a backdoor password that unlocks the screen.&quot;