Old code never dies: why legacy software is often safer than new code