Why is Java so insecure? Buggy open source components take the blame