Why developing secure software is like playing Marble Madness