&gt; In the case of danger&#x2F;damage to human lives a la direct physical injury, there should be a much higher standard.<p>Agreed. In some jurisdictions, people rely on security software to keep them from being identified, and then tortured and&#x2F;or killed by their governments.<p>If a given piece of security software that claims to protect its users instead makes them <i>substantially</i> more vulnerable to attacks that would reveal information stored on their machines and&#x2F;or permit the attacker to install arbitrary software of their own choosing, that is both a breach of trust <i>and</i> -in some jurisdictions- tantamount to handing that user over to the jurisdiction&#x27;s Inquisitors.<p>&gt; This is what courts have upheld as well.<p>Courts have <i>repeatedly</i> upheld that members of the American public don&#x27;t have standing to challenge the NSA&#x27;s dragnet domestic surveillance program. While the notion of standing has <i>great</i> value in <i>helping</i> to prevent groundless suits from wasting everyone&#x27;s time and money, [0] it&#x27;s pretty clear that the courts<p>* Are slow to adapt to rapid changes in the nature of the activities they&#x27;re supposed to adjudicate<p>* _Often_ fail to be as infallible as they wish they were<p>While it may not be illegal to be an incompetent security software vendor in America, I -and <i>many</i> others [1] in the industry- think it&#x27;s entirely reasonable to name, shame, and disparage companies that deem it acceptable to ship &quot;security software&quot; that contains vulnerabilities that anyone with a <i>year</i> of relevant experience [2] under their belt would be able to spot and fix.<p>&gt; ...it is not reasonable to expect a Therac or NASA level of diligence.<p>While it would be <i>ideal</i> for security software companies to adopt avionics-software-style design and QA procedures, the errors found by Ormandy are things that would have been <i>obvious</i> to <i>anyone</i> with more than a year in the industry... It&#x27;s obvious to anyone who reads that bug report that Trend Micro couldn&#x27;t be arsed to do the industry-standard level of QA and have one of their mid-level guys spend a couple of hours reviewing this part of their consumer-level security software.<p>While Trend Micro might not be legally liable for it, that&#x27;s <i>still</i> negligence.<p>[0] Yes. I&#x27;m <i>very</i> aware that court is expensive, slow, and often used as a cudgel against regular folks by people who have rather deep pockets. The requirement to prove standing likely prevents <i>far</i> more nuisance suits than it kills suits that <i>should</i> be heard and judged.<p>[1] Frankly, I hope that <i>most</i> folks in this business hold this opinion.<p>[2] In this case, web development experience.