> because one should count all CVEs. That is debatable, and I think untrue. It sometimes takes years to find CVEs in C code, and I don’t know of an argument wh

> because one should count all CVEs. That is debatable, and I think untrue. It sometimes takes years to find CVEs in C code, and I don’t know of an argument why that would be different for Rust. The fairest comparison, I think, would be with other new code of similar complexity in the kernel, and track #of CVEs per equivalent functionality (per line of code might be sufficient, but if one language is verbose than the other, you should correct for that)