On Linux side, these slides I got from Alex Gaynor illustrate your point really well: https://events.linuxfoundation.org/wp-content/uploads/2017/11/Syzbot-and-

On Linux side, these slides I got from Alex Gaynor illustrate your point really well: https://events.linuxfoundation.org/wp-content/uploads/2017/11/Syzbot-and-the-Tale-of-Thousand-Kernel-Bugs-Dmitry-Vyukov-Google.pdf https://events.linuxfoundation.org/wp-content/uploads/2017/1... There hasn't been much in terms of changes. Languages immune to classes of vulnerabilities by default and/or sound checkers that can catch all of them seem necessary. And by seem necessary, I mean massive, empirical evidence that most developers can't code safely without such alternatives even on critical, widely-used, well-funded projects.