4 ms·
That data point doesn't say much before accounting for some confounding variables: - the complexity of the code base - the attack surface - the amount of eff
by rhn_mk1 4y ago
That data point doesn't say much before accounting for some confounding variables:
- the complexity of the code base
- the attack surface
- the amount of effort to find the CVEs
- CraigJPerry 4y agoSure - and i wouldn't put too much weight on my examples, i picked them as a direct refutation to the GP's claim "Well, empirically, no, that's not the case". That said - 2 & 3 in your list seem like they'd lend further weight to Postifx rather than Rust in this scenario. Postfix is a network service forced to accept any and all input from remote attackers. Postfix has been around longer and has marketed itself as secure, that's meant it's attracted the attention of capable attackers keen to demonstrate their prowess. I think the rust code base is more complex than postfix though. Postfix's architecture borders on a work of art.