Another, similar, take, from ALE2014: https://docs.google.com/presentation/d/1rXyl_YF-0lg3W8yY9mSo4UaoUrEWo8hKAng-GsF9XeI/pub?start=false&loop=false&delayms=30

Another, similar, take, from ALE2014: https://docs.google.com/presentation/d/1rXyl_YF-0lg3W8yY9mSo4UaoUrEWo8hKAng-GsF9XeI/pub?start=false&loop=false&delayms=3000#slide=id.g376b8bd03_011 https://docs.google.com/presentation/d/1rXyl_YF-0lg3W8yY9mSo... Security problems are, first and foremost, about CORRECTNESS. If you find an issue, most probably something has been done in an incorrect way by somebody who didn't really understand something. It's much harder to find out some security bug which is not a functional bug (for some part of the domain, not just the sweet spot). Of course that doesn't really apply to C or C++, where it's easy to do dumb mistakes by chance.