[programminggeek]

I think it is because people are terrible at considering hidden complexity and the odds of something unexpected happening.

My biz partner has a philosophy of "there is no such thing as a simple app." Hidden complexity is everywhere.

Consider user login. A form with username and password right?

Do you show the password as they type it or obfuscate it? What if the user forgets username or password? How do you handle password reset? Did you make sure you are sending over https? What about captcha? Do you use one at all? Do you have password strength requirements? How do you want to store the password data? What about security questions? What about error handling? Do you support oauth like facebook login? Will this work for login via api? How are you going to test login? Will you write feature specs, unit tests, etc?

Now, how often do people think through features in that kind of detail when estimating? Look at the above questions. All of a sudden the last 20% starts to look like 80%.