Why Do Software Holes Take So Long to Fix?