> I wouldn't consider the remediation costs as being the costs of the exploit - that's more just a measurement of how widely used something is Maybe you won't

> I wouldn't consider the remediation costs as being the costs of the exploit - that's more just a measurement of how widely used something is Maybe you won't in general, but we're chatting on a thread about the threats of supply chain attacks. Reading upthread, some GG...P thread espoused the idea that maybe the trade-off in using a memory-safe language with almost frictionless thirdy-party dependency might not always be worth it compared to a memory-unsafe language with very high friction for third-party dependencies. In this context, the specific comment I replied to made a frankly asinine comment about how "this wouldn't happen in Rust", to which I felt compelled to point out that a) More expensive breaches have occurred in memory safe languages, and b) Supply chain attacks have large dollar impacts anyway. To add, there's also c) The majority of breaches are occurring irrespective of tech stacks.