[santaragolabs]

As someone who spent a lot of time in the past 5 years at MSFT and also at tons of other firms doing security work / SDL-work on code bases; there are very few companies where a giant C/C++ code base is getting even close to the quality of Microsofts.

And indeed; very few companies spent as much money as Microsoft on their entire SDL. Sadly never had the chance to get a look into Google's kitchen but I'm hearing that they're great too.

They're also not dealing with the kind of backwards compatibility that Microsoft is dealing with which helps them out a lot too.