3 ms·
Nice one, given that this probably went down to the diff level it would be interesting to see it weighted by LOC changed, e.g. 10 lines in file A and 1 line in
by treffer 3y ago
Nice one, given that this probably went down to the diff level it would be interesting to see it weighted by LOC changed, e.g. 10 lines in file A and 1 line in file B would mean file A gets 1/11th of the money assigned because it was the majority of the bug.?
Or perhaps a LOC changed / file LOC based distribution. That would be how buggy each file is, with a $$$ tag.
- initplus 3y agoThis would show the effect you want. Code like tests are likely to be very verbose, while often the actual vulnerability will come down to a handful of characters.
- treffer 3y agoDepends on which effect you are after. I was thinking of ROI for reading code. Regularly having a one line issue in a 100 LOC file is very different from a two line issue in a 10'000 LOC file. And yes, tests need to be excluded, of course. But looks like that's done?