> The C (or other "old" lang) programs typically have very few dependencies apart from the OS, with absolutely glacial release cycles. Very few by number, but

> The C (or other "old" lang) programs typically have very few dependencies apart from the OS, with absolutely glacial release cycles. Very few by number, but that's more an artifact of C's poor package management than a true reflection of how much third-party code you're actually pulling in. Something like APR is the equivalent of hundreds of Rust packages, and comes with a similar security risk. Sure, maybe there's someone who signs off on each release, but do you think they personally know and validate each of the dozen or more mostly-independent projects that actually make up their library? No, they delegate to separate maintainers - that information just isn't surfaced in the package management system.