> This is about CVEs. CVEs are about exploitable vulnerabilities, and most of useful software in that area is in C/C++. I'm not sure what you're getting at her

> This is about CVEs. CVEs are about exploitable vulnerabilities, and most of useful software in that area is in C/C++. I'm not sure what you're getting at here. The claim isn't that 70% of CVEs are memory vulns, but that 70% of CVEs in C/C++ are memory vulns. So how much or how little C/C++ is used is irrelevant. > If anything, I'd be interested in the numbers of the internal ad-critical C++ code in Google or a HFT bank. Do you think that Google wouldn't be pushing as hard as they are for improvements in this space if they thought things were fine and dandy?