Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz

[Bob Friesenhahn <bfriesen () simple dallas tx us>]

On Sat, 15 Jun 2019, Alex Gaynor wrote:
> I think you're quite right that the central challenge here is the mismatch
> between how Linux distributions operate and what their claims/people's
> expectations are.

Within four years, most users will encounter updated software which 
includes the fixes, assuming that an available developer did produce a 
fix.

If you are interested in improving the software, I suggest rolling up 
your sleeves and getting involved with implementing fixes.  Indeed, 
only a small fraction of involved people are working on implementing 
fixes.

> PS: I'd be remiss if I didn't at least mention that basically all the bug
> classes we're discussing are induced by C/C++'s memory unsafety and better
> programming language prevent them outright.

The "better" programming languages may prevent some of these problems 
due to not allowing direct access to memory, but they introduce 
new/different types of problems which can also be serious.  Indeed 
some popular languages like Python, Perl, or Javascript seem more 
dangerous than C/C++ programs.

Bob
--
Bob Friesenhahn
bfriesen () simple dallas tx us, http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer,    http://www.GraphicsMagick.org/
Public Key,     http://www.simplesystems.org/users/bfriesen/public-key.txt