3 ms·

And there is the track record: https://security-tracker.debian.org/tracker/source-package/systemd https://security-tracker.debian.org/tracker/source-package/s.

• happymellon 2y ago
  That looks not too bad considering what it does and the time range of CVEs
• mariusor 2y ago
  Maybe you can do a comparison to another well known open source project and see how well systemd fares: https://security-tracker.debian.org/tracker/source-package/linux https://security-tracker.debian.org/tracker/source-package/l...
  • shakna 2y ago
    Or OpenRC, which is closer to a competitor, than an entire OS. [0] [0] https://security-tracker.debian.org/tracker/source-package/openrc https://security-tracker.debian.org/tracker/source-package/o...
    • mariusor 2y ago
      Of course, the scope is different, the kernel is about 30 times as large as systemd (which is less than I was expecting frankly), but they both match the description "low-level large C language project". Therefore in my mind they should have a similarl density of CVEs per lines of code: Systemd has 4 open CvEs in ~1M lines of code. The linux kernel hash 18 open CvEs in ~30M lines of code.