jason_oster

A few weeks ago, I discovered that my public IPv4 address had been blocked across all of the Stack Exchange network. That was surprising. My IPv4 rarely changes and I hardly visit any of the sites (who does? lol). I submitted a report to the email address listed. Never heard back from them, but a week later I randomly learned I was unblocked when another Stack Overflow answer appeared in a search. Just checked my IPv4, and yep, same one in the email I sent.

Stack Exchange is toast... I mean, cooked. They've been falling apart for years. Unlike the top comments, I stopped posting there in 2014.

Wait, you consider that abusive? I have only used NFSN as a registrar for two decades. Always had hosting and DNS managed elsewhere.

Therefore explaining why the bug hadn't been hit in practice for 11 years.

Even if you could be trusted to do that, we still need languages like Rust and tools like ASAN and Valgrind. Trust but verify. Trust alone is not enough.

True. I can no longer fly coach since I got used to the first class experience.

> You are picking on 1 bullet point out of 7.

We are observing the Gell-Mann amnesia effect in practice.

Glad to hear it! Thanks.

What I'm trying to get at is that age and stability are only loosely correlated with correctness. I'll give you credit for calling out the tautology, and I don't think there is a way around it. Any code that is written without rigor is going to be buggy. The age/stability thing is a category error.

The only thing I can conclude is that a more rigorous methodology for authoring code is more valuable than cleaning up after oneself later.

> the effect of awareness increases over the decades is very visible in my work as security tester

This absolutely matches my own feeling on the value of experience. Knowing what not to do is where practically all of my efficiency comes from, having learned that the hard way.

A literal interpretation of the claim is, quoted directly, "old code has fewer bugs than new code". Now you've clarified that you meant "stable code", which is fair. But stability is not a guarantee of correctness. Perhaps you meant "correct code", and not necessarily "old" or "stable" code.

I admit it is difficult to infer your intention on the classification of "old code vs new code". I don't see evidence that new code is inherently worse than old code, including in the cited study. There is correlation that people forget lessons learned in the past, but that's as far as I would evaluate the data.

> vulnerabilities decay exponentially.

Because they get fixed over time. That isn't controversial. They also persist over time. The quoted observation depends on proactive maintenance. But proactive maintenance is also the only cause of new bugs by definition. "Recently modified code" stands out in the last paragraph. This study is not talking about stable code.

I'm ashamed to admit I had trouble reading this, because I came here to say it.

Stop making sense! This is HN, for crying out loud.