[lucb1e]

> "modern" as a value seems pretty loose, and it's often at least arguable whether it's objectively better!

Well, there is research on this!

https://security.googleblog.com/2024/09/eliminating-memory-s... writes:

> vulnerabilities decay exponentially. They have a half-life. [...] A large-scale study of vulnerability lifetimes² published in 2022 in Usenix Security confirmed this phenomenon. Researchers found that the vast majority of vulnerabilities reside in new or recently modified code

Where ² goes to https://www.usenix.org/conference/usenixsecurity22/presentat...

A study limitation is that they looked only at security-relevant bugs (vulnerabilities). As someone who writes code, I would tend to think that this also goes for bugs without a direct security impact, but I don't have the data to back that notion up

[Aeolun]

Feels kinda obvious to me? As time goes on bug density can only go on direction, and making no changes to a codebase certainly doesn’t make it go up.

[lucb1e]

For bugs, perhaps, but for vulnerabilities, new attacks and techniques are being found. Or just nobody is looking at most things most of the time and it's not really correlated with age that clearly. Imo it's good to have the data of what actually happens