That wasn't the claim. The claim is that stable code (that isn't changed except to fix bugs) has
fewer bugs than code someone newly wrote and we haven't had as much time to run into or otherwise uncover flaws. I never meant that all old C code is bug-free craftsmanship or something xD
Found the reference (bless bookmark managers): https://security.googleblog.com/2024/09/eliminating-memory-s...
Relevant bits:
> vulnerabilities decay exponentially.
> A large-scale study of vulnerability lifetimes² published in 2022 in Usenix Security confirmed this phenomenon. Researchers found that the vast majority of vulnerabilities reside in new or recently modified code: [plot]
> This confirms and generalizes our observation⁴, published in 2021, that the density of Android’s memory safety bugs decreased with the age of the code, primarily residing in recent changes.
² https://www.usenix.org/conference/usenixsecurity22/presentat...
⁴ https://security.googleblog.com/2021/04/rust-in-android-plat...
Citing from [4]:
> The above analysis of the age of memory safety bugs in Android (measured from when they were first introduced) demonstrates why our memory-safe language efforts are best focused on new development and not on rewriting mature C/C++ code. Most of our memory bugs occur in new or recently modified code, with about 50% being less than a year old.
Found the reference (bless bookmark managers): https://security.googleblog.com/2024/09/eliminating-memory-s...
Relevant bits:
> vulnerabilities decay exponentially.
> A large-scale study of vulnerability lifetimes² published in 2022 in Usenix Security confirmed this phenomenon. Researchers found that the vast majority of vulnerabilities reside in new or recently modified code: [plot]
> This confirms and generalizes our observation⁴, published in 2021, that the density of Android’s memory safety bugs decreased with the age of the code, primarily residing in recent changes.
² https://www.usenix.org/conference/usenixsecurity22/presentat...
⁴ https://security.googleblog.com/2021/04/rust-in-android-plat...
Citing from [4]:
> The above analysis of the age of memory safety bugs in Android (measured from when they were first introduced) demonstrates why our memory-safe language efforts are best focused on new development and not on rewriting mature C/C++ code. Most of our memory bugs occur in new or recently modified code, with about 50% being less than a year old.