> there's a trade-off between reinventing the wheel vs. being open to 0-days that take down a lot of projects at a time. I have come to think about it more as

> there's a trade-off between reinventing the wheel vs. being open to 0-days that take down a lot of projects at a time. I have come to think about it more as comparative advantage of different programmers and their training / skill set. Not everyone has the skills to write a complex state machine for stream encoding (I haven’t read up on libvpx, so forgive me if I mischaracterized it). We shouldn’t expect a huge diversity of available libraries to do this task. But we should have more tools to inform the consumer of libraries to see their risk from any individual library and there should be more transparency about alternatives/substitutes to make sure we don’t see a monoculture around an inferior library if a superior option exists. We should expect specialists to write specialized code. But we should also have QA specialists (and hopefully lots of automation) review the code. And the more systems a library is installed on, the more verification/scrutiny should be put on that code. This is the strategy of Project Zero (Google’s 0day hunting project) and lots of other organizations should contribute similar efforts.