Van knew that the CCIAB had many pressing problems on its agenda. These were serious political challenges innate to any reform in computer security: the distribution of security-certification logos, the establishment of baseline security standards, a wise judgment of the regulatory costs of compliance, the daunting difficulties of online patch distribution, the rating of potential flaws and vulnerabilities, even the awful discovery of certain flaws "too expensive to fix" . . . The list went on and on. Basically, these problems had one commonality: they couldn’t be programmed away or fixed by engineers. They could only be solved through sincere, extensive, fully briefed bargaining and negotiation among the power players. That was why nothing much had ever happened to resolve those problems.