3 ms·

I think the "counterpoint" here is that that makes an amount of sense >0. While it's far from a complete story, and there are plenty of edge cases where it can

• laumars 5y ago
  Some researchers get paid per CVE and thus are encouraged to release hundreds of frivolous reports. Some companies publish frivolous ones in order to raise their own profile. Also the software in question is a complicated subsystem to write on a platform that’s guaranteed to get many eyeballs on. So the fact that those CVEs span roughly once per year might also be a demonstration that there are relatively few bugs (if we knew the number of people and time spent researching vs CVEs published then maybe we’d have a more meaningful statistic). CVEs do also demonstrate that active research is happening. There are plenty of common libraries out there that never get audited. Does fewer CVEs mean they’re more secure? Or does it just mean that nobody has checked? Thus on its own, that data is pretty meaningless in terms of deriving a trend. The reason the LoC comparison was made is because measuring lines of code doesn’t tell you how long a developer has spent debugging, reading documentation, or doing other research required. It doesn’t tell you how secure, performant, or even buggy the code is. All it tells you is the number of lines written and literally nothing more can be derived from that figure. Likewise with CVEs submitted.