> The vulnerable code was released in January 2011, so it took well over a decade for this vulnerability to be found. It would have already been a big deal for

> The vulnerable code was released in January 2011, so it took well over a decade for this vulnerability to be found. It would have already been a big deal for the past five years, if anything. Furthermore you have to induce a bufferoverflow first. I’m no security researcher, but to my mind that means you’re either (a) trusting idiots to write sensitive code without a IT Sec team reviewing it, or (b) you’ve got a malicious actor on the inside, who can slip it past review. I’m sure there are plenty of other scenarios, but I’m saying it doesn’t feel likely by gut.