snaxxx

They already do this to a certain extent. Sometimes it's after the vulnerability has already been exploited by them or a sister agency. But other times it's soon after discovery.

> Do you literally mean "nobody" here? As in if I wanted to hire you to put a team together to reliably ship secure commercial software, you couldn't do it either?

It's fundamentally impossible given that you won't control everything about the operating environment of the software, and can't see into the future.

I mean, even if you could create a perfect piece of software with no bugs present at the time, that's still not enough, because vulnerabilities in dependent components will arise which were unknown at the time.

For example, if you'd written the perfect web browser a few years back, how would you prevent vulnerability to CPU-level attacks such as Spectre and Meltdown discovered later on?

Or consider if you write the perfect wireless networking firmware, but then end up being subject to vulnerabilities in the protocol standards (WEP was a good example of this)?

This is on top of software development being such a complex process that even the best of its practitioners write code strewn with bugs.