> This amounts to saying that we should accept codebases continuing to contain exploitable vulnerabilities indefinitely. Right, why shouldn't we? I have a CLI

> This amounts to saying that we should accept codebases continuing to contain exploitable vulnerabilities indefinitely. Right, why shouldn't we? I have a CLI application for storing TODOs. It never accesses the network, I don't really care if it crashes, it does not have an expiry daye. I have a constant amount of time to work on it. To me it is more value to put that time into new features that save me a couple of seconds here and there as a daily user, than to put all the time allocated for months or a year of working on the app to re-write it in a different language to remove the occasional monthly crash I don't care about. For me, the decision is a no brainer: my time is better spent in the stuff that adds more value, and "avoiding exploitable vulnerabilities" is not it. I suppose that this is the situation for many apps. You are claiming that this is wrong. Prove your claim.