Yeah, I was joking. But not completely. Even if you leave a codebase alone in the sense that you only fix security bugs, you’ll end up with a slow trickle that

Yeah, I was joking. But not completely. Even if you leave a codebase alone in the sense that you only fix security bugs, you’ll end up with a slow trickle that never quite ends. There are the RCEs that get reported plus a bunch that don’t. So, if you: - project into the future, assuming that if there still has been a trickle of bugs being found then more bugs will also still be found in the future. - take into account that there are some number of unreported bugs. Maybe for every reported one there is one that isn’t. Dunno the ratio there. Put all that together and it’s not hard to imagine a 1RCE/100LoC rate. But still I’m kinda joking. But only slightly. Maybe if I had a way to bet money on this and it was a testable bet (it’s not because of the unreported RCEs) then I’d throw some cash down.