For reference, the first is with an experimental feature, second is a local privilege escalation, and the third allowed a malicious server to read the clients k

For reference, the first is with an experimental feature, second is a local privilege escalation, and the third allowed a malicious server to read the clients keys. For comparison, here's some CVEs from software written in Go: Caddy CVE: https://www.cvedetails.com/cve/CVE-2018-21246/ https://www.cvedetails.com/cve/CVE-2018-21246/ Kubernetes CVEs: https://www.cvedetails.com/vulnerability-list/vendor_id-15867/product_id-34016/Kubernetes-Kubernetes.html https://www.cvedetails.com/vulnerability-list/vendor_id-1586... No silver bullets! Though some have less lead in them. OpenSSH, along with other software developed by OpenBSD, has earned the highest level of trust in something written in C. C can be dangerous, but there is a chasm between such careful works and the typical offenders like OpenSSL (OpenBSD's alternative is LibreSSL, confusingly).