The Terrible State of Software Security