What makes some open source updates so difficult? Help Net Security