CERT advisories are evidence that skill is necessary but insufficient. There’s a lot of code. We get ping ponged between various sections of the code every few

CERT advisories are evidence that skill is necessary but insufficient. There’s a lot of code. We get ping ponged between various sections of the code every few weeks. Other people are contributing. There’s a ton of ways code can look like it’s probably correct and not be. There are non obvious bugs everywhere, and there’s an element of luck to whether you’re in the right headspace to catch them all.