There is simply no excuse for buffer overflows any more. The law should be changed to permit user/victims to recover damages from the software vendor for losses due to buffer overflows. Other vulnerabilities are tricky and hard to pin down legally, but overflows are easy, and it's time to make software houses pay for selling dangerous junk.

You might just get your wish, with the new Congress.

I think they could make legislation for the egregious cases; set a high bar by basing it on "gross negligence".

As for the argument that there are already mechanisms in place to recover for damages: only if DA(s) take the trouble to organize the numerous parties that are likely to be injured by such actions into class action suits. It could use to be more streamlined; otherwise, you get the "Pinto" decision-making process, where software manufacturers _sometimes_ willfully write bad code if it will turn a quick profit...