Hacker News Reader

Comment by himata4113 | Hacker News Reader

It had one bad cve it seems, but that's exactly what I mean. It only takes one mistake, of course you can learn and never make those mistakes again, however, that is an unrealistic expectation in software that receives hundreds of feature updates a year especially when it comes to core applications as basic as communication when it wants to support image previews, reels and whatnot.

View on HN

There will always be one, so "it only takes one" is meaningless and invalid. That leaves less is better than more, and any form of less is as good as any other form of less.

This is pretty hard to argue since for example: WireGuard is a finished piece of software. It gets: no feature updates, was designed in-full before a single line of code was written and has stood the test of time. You cannot compare that to some desktop application that has a thousand features with 100's more added every year.

And its transition to post-quantum cryptography is going to be a migration challenge.

Some Rust programs also had RCE CVEs.

Some is doing heavy misrepresentation.

Latest batch of LLM's Linux had 423 vulnerabilities. Out of which 10 were Rust*. Would you prefer more or less CVEs?

But it's like seat belt analogy. It's a helper not a panacea.

* Granted Rust isn't in the entire kernel yet. D

That sounds like Linux has more vulnerabilities per line of Rust code than line of C code, given the language ratio...

Here's a better exploration of defect rates:

https://security.googleblog.com/2022/12/memory-safe-language...

Sure, but C code is way older so most of the bugs there should have been excised by now...

Reply on news.ycombinator.com