The first reason, I think, is that it's because the developers of the commercial software systems aren't doing it or at least not doing it enough and I think it's pretty clear that the kind of bugs found, for example, in the fuzzing papers, or in Charlie Miler's talk would'nt have been there in the software if the developers of Adobe Acrobat or the Unix utilities have had a reasonably aggressive random testing program, and remember that some of those bugs Charlie Norris was talking about were secured liabilities. 