Michael Howard, the “father of the SDL,” is using Jeff Jones vulnerability counts as proof that the Security Development Lifecycle (SDL) works. Microsoft decided to change its development practices to enforce greater security discipline. Robert Hensing has to go and “second that emotion” by acting insulted that people don’t believe the SDL works: “It’s insulting to me” Microsoft could have revolutionized the way we think about vulnerabilities. And they give us trash*. It’s not really that bad, but in context it is truly frustrating to see this stuff*”]
Source: https://spiresecurity.typepad.com/spire_security_viewpoint/2008/04/microsofts-sdl.html