I'm asking this here and not on the security related site because this one is a question about software architecture and development methodologies, which are both covered by the FAQ.EDIT: I'm talking about purely remote root / admin software exploits.  Not about insider physically breaking into labs / companies / houses / networks / machines.Everytime there's a blog entry or article about a new security exploit there are lots and lots of people basically writing that: No software shall ever be secure, every single software out there can be exploited. Give any pirate sufficient time and he'll eventually exploit any high-target software.  This is a constant. These type of comments always get modded like crazy and most people seems to accept it as a fact.And it really gets me wondering: can any software architecture and development methodologies be used to ever come up with secure software or is there something technical that prevents us from writing secure systems/programs/OSes/servers?The more I think about it, the more I don't understand why we couldn't, technically, build 100% secure software.  All the way down from the OS and then up: browsers, plugins...Note that I'm not interested in a discussion here: I want to know if technically there is something or not that can prevent, say, an OS, to be written in a 100% secure way and why it's that way.Now if there's nothing technically that prevents us from writing a 100% secure OS and from then writing a 100% secure server, why hasn't it been done?  Does it means our architecture and development methodologies (and tools?) are deeply flawed?
Are security exploits a fatality?
architecture;security;development methodologies