> addressed that problem a long time ago (in their own ad-hoc ways) I think it's becoming increasingly clear that "addressing the problem" in C and C++ means f

> addressed that problem a long time ago (in their own ad-hoc ways) I think it's becoming increasingly clear that "addressing the problem" in C and C++ means fixing all the memory safety issues you know about. Sqlite is the posterchild of careful testing in a C codebase, and they had a serious CVE last year. Realistically, the vast majority of C and C++ projects have more bugs than that, even if they're staffed by experts who take security seriously. But I agree with you about the cost-benefit analysis. It's not very often that security issues destroy an entire company, and trying to rewrite a large codebase might be existentially riskier more often than not.