Note that I didn't claim all bugs/vulns would be solved by a sweeping use of memory-safe languages. (Just that a distressingly large proportion of the ones in t

Note that I didn't claim all bugs/vulns would be solved by a sweeping use of memory-safe languages. (Just that a distressingly large proportion of the ones in this security bulletin would be) The log4j bug fits in the "other" category. Also, it's a fallacy to believe that memory-safe languages aren't that much better because their bugs are worse. All languages can have the worse bugs, it's just that memory-safe languages solved the easier type of bugs, so there isn't as much of them to bring the average down. It's like thinking that flying is riskier than driving, because plane crashes are so devastating. Driving kills more people overall, but they're spread across more, smaller events, so we're not as aware of them.