Hacker News new | ask | show | jobs
by petee 637 days ago
I think Java's CVE list should say enough. Point being humans can muck anything up, regardless of safeguards
3 comments

The point of the person you're replying to is that JVM software has far fewer vulnerabilities than it would have otherwise.

The number of CVEs reveals that there is a lot of Java software and that there's a strong culture of importing dependencies. But we also care about the nature of them, the normalized relative frequency of very serious flaws like RCE exploits.

A CVE list says nothing. I made my own language which has no CVEs, that obviously doesn't mean it's secure. The relevant metric is "CVEs per unit of functionality".
Also, popularity directly affects the number of CVEs.
This is a nonsense statement unless you note the Java runtime. Java is a language. The runtime is the software that runs the Java code. There's more than one runtime.