3 ms·
It had one bad cve it seems, but that's exactly what I mean. It only takes one mistake, of course you can learn and never make those mistakes again, however, th
by himata4113 3mo ago
It had one bad cve it seems, but that's exactly what I mean. It only takes one mistake, of course you can learn and never make those mistakes again, however, that is an unrealistic expectation in software that receives hundreds of feature updates a year especially when it comes to core applications as basic as communication when it wants to support image previews, reels and whatnot.
- Brian_K_White 3mo agoThere will always be one, so "it only takes one" is meaningless and invalid. That leaves less is better than more, and any form of less is as good as any other form of less.
- deleted 3mo ago[deleted]
- inigyou 3mo agoSome Rust programs also had RCE CVEs.
- Ygg2 3mo agoSome is doing heavy misrepresentation. Latest batch of LLM's Linux had 423 vulnerabilities. Out of which 10 were Rust*. Would you prefer more or less CVEs? But it's like seat belt analogy. It's a helper not a panacea. * Granted Rust isn't in the entire kernel yet. D
- inigyou 3mo agoThat sounds like Linux has more vulnerabilities per line of Rust code than line of C code, given the language ratio...
- Ygg2 3mo agoSure, but C code is way older so most of the bugs there should have been excised by now...
- ssokolow 2mo agoHere's a better exploration of defect rates: https://security.googleblog.com/2022/12/memory-safe-languages-in-android-13.html https://security.googleblog.com/2022/12/memory-safe-language...
- himata4113 3mo agoThis is pretty hard to argue since for example: WireGuard is a finished piece of software. It gets: no feature updates, was designed in-full before a single line of code was written and has stood the test of time. You cannot compare that to some desktop application that has a thousand features with 100's more added every year.
- fmajid 3mo agoAnd its transition to post-quantum cryptography is going to be a migration challenge.