Most programmers don't spend their time bug-hunting in crappy codebases. Most programmers wouldn't recognize a security bug, unless there were making a point o

Most programmers don't spend their time bug-hunting in crappy codebases. Most programmers wouldn't recognize a security bug, unless there were making a point of thinking that way (and many wouldn't even then). Which takes extra mental effort. . Base-system and network-facing software should be written in a way that makes it fun to read and useful to learn from, so that it gets more people looking at it. Base-system and network-facing software should have open, friendly maintainers, who welcome questions from new learners trying to understand the code. . Some bugs would never be apparent from just reading code. Telnet over an untrusted network is insecure no matter how well written the code is. Priority inversion is only apparent looking at a system as a whole. An overly-concurrent system may work find on a single CPU, but start thrashing itself when run on a big NUMA machine. These would seem to require a higher understanding of the system, and more specialized skills to detect. I'm not really sure what aside from having good design documentation to do to make them easier to find.