I suspect fewer than you think. At least in FAANG code. Google chrome has had a fair few CVEs over the years despite having a lot of the worlds best security r

I suspect fewer than you think. At least in FAANG code. Google chrome has had a fair few CVEs over the years despite having a lot of the worlds best security researchers working full time looking for security vulnerabilities. I think someone has tried reading the compiler warnings. There’s an old story about John carmack running a new static analysis tool on the quake3 source code. The code worked well. The tool apparently found a huge list of issues in the code - including a massive pile of real bugs. Then he tried another static analysis tool and it found more real bugs. And so on. The story is well worth a read. This is a great takeaway: > This seems to imply that if you have a large enough codebase, any class of error that is syntactically legal probably exists there. C++ is really hard to do “right”, at any scale in a real team. http://www.sevangelatos.com/john-carmack-on-static-code-analysis/ http://www.sevangelatos.com/john-carmack-on-static-code-anal...