4 ms·
There will always be one, so "it only takes one" is meaningless and invalid. That leaves less is better than more, and any form of less is as good as any other
by Brian_K_White 3mo ago
There will always be one, so "it only takes one" is meaningless and invalid. That leaves less is better than more, and any form of less is as good as any other form of less.
- deleted 3mo ago[deleted]
- inigyou 3mo agoSome Rust programs also had RCE CVEs.
- Ygg2 3mo agoSome is doing heavy misrepresentation. Latest batch of LLM's Linux had 423 vulnerabilities. Out of which 10 were Rust*. Would you prefer more or less CVEs? But it's like seat belt analogy. It's a helper not a panacea. * Granted Rust isn't in the entire kernel yet. D
- inigyou 3mo agoThat sounds like Linux has more vulnerabilities per line of Rust code than line of C code, given the language ratio...
- Ygg2 3mo agoSure, but C code is way older so most of the bugs there should have been excised by now...
- ssokolow 3mo agoHere's a better exploration of defect rates: https://security.googleblog.com/2022/12/memory-safe-languages-in-android-13.html https://security.googleblog.com/2022/12/memory-safe-language...
- himata4113 3mo agoThis is pretty hard to argue since for example: WireGuard is a finished piece of software. It gets: no feature updates, was designed in-full before a single line of code was written and has stood the test of time. You cannot compare that to some desktop application that has a thousand features with 100's more added every year.
- fmajid 3mo agoAnd its transition to post-quantum cryptography is going to be a migration challenge.