No, I never suggested "I expect all software to be bug-free". Google software has bugs too. You're completely muddying the waters with a strawman like this. What I'm saying is that it that calling a massive security incident a "bug" doesn't suddenly erase it. Maybe it was pure dumb bad luck that could've happened to Google too, maybe it was because CloudFlare is just younger and still learning about the whole "defense-in-depth" thing that prevents 1-2 bugs from massively screwing everything up, or maybe it's just the lack of money and/or being able to attract as much top talent... I can't know for sure, and maybe I'd even sympathize with them, but I'm not trying to determine guilt and figure out whom to throw in jail here—I'm just trying to decide whose service to trust, pay for, and use. I'd be completely nuts to disregard actual severe past mistakes and solely look at my impressions of their intentions and hypothetical scenarios. You might look at intentions when figuring out whom to blame, but you definitely need to look at the cold, hard facts when figuring out whom to trust. The fact that they did actually make a system that actually screwed up in keeping private data private simply has to be taken into account when figuring out how much I can trust them with private data, however good their intentions and post-facto reactions to it were.