> > Since most of our CVE type problems are usually programming mistakes nowadays, the lack of review could contribute to an increase in programming fault type

> > Since most of our CVE type problems are usually programming mistakes nowadays, the lack of review could contribute to an increase in programming fault type bugs which aren't forbidden by the safer memory model. > That's an odd statement. What CVEs aren't due to programming mistakes? I guess they meant as opposed to higher level design mistakes.