&gt; I also object to the presupposition that there is secure software and non-secure software.<p>I&#x27;m with you 100% here.  Especially without a more precise definition of what we mean by &quot;secure&quot;.<p>&gt; In most practical cases, it is impossibly hard to tell in which class an application falls, so it would be better not to make that distinction at all.<p>Unfortunately, it seems that it&#x27;s really quite easy to tell.  Unless you have overwhelming evidence [1] that says the software is &quot;secure&quot;, it&#x27;s almost certainly going to turn out to be insecure.<p>[1] For example: seL4 and its proofs of correctness <a href="http:&#x2F;&#x2F;sel4.systems&#x2F;" rel="nofollow">http:&#x2F;&#x2F;sel4.systems&#x2F;</a>