4 ms·
> "modern" as a value seems pretty loose, and it's often at least arguable whether it's objectively better! Well, there is research on this! https://security.
by lucb1e 2y ago
> "modern" as a value seems pretty loose, and it's often at least arguable whether it's objectively better!
Well, there is research on this!
https://security.googleblog.com/2024/09/eliminating-memory-safety-vulnerabilities-Android.html https://security.googleblog.com/2024/09/eliminating-memory-s... writes:
> vulnerabilities decay exponentially. They have a half-life. [...] A large-scale study of vulnerability lifetimes² published in 2022 in Usenix Security confirmed this phenomenon. Researchers found that the vast majority of vulnerabilities reside in new or recently modified code
Where ² goes to https://www.usenix.org/conference/usenixsecurity22/presentation/alexopoulos https://www.usenix.org/conference/usenixsecurity22/presentat...
A study limitation is that they looked only at security-relevant bugs (vulnerabilities). As someone who writes code, I would tend to think that this also goes for bugs without a direct security impact, but I don't have the data to back that notion up
- Aeolun 2y agoFeels kinda obvious to me? As time goes on bug density can only go on direction, and making no changes to a codebase certainly doesn’t make it go up.
- lucb1e 2y agoFor bugs, perhaps, but for vulnerabilities, new attacks and techniques are being found. Or just nobody is looking at most things most of the time and it's not really correlated with age that clearly. Imo it's good to have the data of what actually happens