Yes, the FOSS industry needs to grow up about software quality. It is natural to have very expensive checks in development and test-environments, they help and

Yes, the FOSS industry needs to grow up about software quality. It is natural to have very expensive checks in development and test-environments, they help and aid development and QA to no end, and of course they should be disabled in production. But the run-of-the-mill assert which documents integer ranges, pointer non-null-ness, data structure relationships and so on, cost nothing in performance and should be left in production code. And as I said: We developed Varnish Cache to prove this point, and we overwhelmingly have: One bad CVE since 2006, and "only" about 20% of all web-traffic goes through Varnish at some point or other. Re Huawei: The report claims that there where no checks at all, and I'm saying they have not documented evidence for that claim, because the lack of checking code could be either disabled asserts in production code or the compiler reducing it as dead code.