[naturalmovement]

Sounds like a lot but compare it to Edge also being patched for 428 Chromium CVEs this month.

If 20 years ago you told me a single piece of software had 428 vulnerabilities I wouldn't have believed it.

If Chromium has that many security bugs, perhaps the move fast and break things approach of spraying diarrhea masquerading as code into a keyboard — in a rush to add new features no one asked for — needs to be reexamined.

[sellmesoap]

20 years ago a malformed packet to winsock would crash the computer, 5 years later installing win2k on my buddies computer (no router/firewall) a few minutes after we finished the install "windows will reboot in nn seconds" whelp time to re-install without a network connection... we've added a lot of layers since win2k, mostly in the name of ease of development, and I don't feel like we've met that goal but we sure found a way to get a million monkies behind a million typwriters, and now we're aiming to replace the monkies with simulated monkies. Time to smell my fingers and fall out of the tree ;-D

[georgemcbay]

> If 20 years ago you told me a single piece of software had 428 vulnerabilities I wouldn't have believed it.

For something as complex as an operating system or a web browser, even one from 20 years ago (say, Windows XP or IE/Firefox) I wouldn't have believed there were 428 vulnerabilities either, I would have assumed there were much more than that.

[Cthulhu_]

Chromium is a three-decades-long project (origins coming from Webkit, which comes from KHTML, which was 1998) - I can assure you that does not meet the "move fast and break things" phrase you're trying to smear it with.

[tokioyoyo]

20 years ago software wasn't as much battle tested as today, had way less feature set, was less connected to the internet, and etc. 428 CVEs looks small, assuming not all have CVSS 9.8 or something.

[lousken]

It was more tested as real testers were testing it. Nowadays, AI just checks the code.

[pixl97]

I guess we should find some of this old source code and test it for exploits to see what is true.

[fragmede]

https://github.com/microsoft/ms-dos

[Cthulhu_]

Is that true or an assumption? I don't think Chrome and co would discard their decades worth of automated testing practices in favor of AI.

Actually I don't need to think / assume, it's an open source project.

[lousken]

Chrome? That is a younger project and it was much less automated back in the day.

[Cthulhu_]

20 years ago was 2006, I can assure you we were very consciously aware of things being permanently connected to the internet by then.

That said, sure, it had a fraction of the features back then, and only a fraction of the world population was connected to the internet.

[HeatrayEnjoyer]

>That said, sure, it had a fraction of the features back then, and only a fraction of the world population was connected to the internet.

And the world was better for it. Connectivity and internet are not inherent goods. They can be used for good purposes but it is hard to argue that has been the mean.

[hilariously]

Chromium is probably 30 million+ lines of code, and we generally see that as things get more complex its even easier to accidentally write code which can be exploited.

If it has 1 vulnerability in every 10k loc of code we'd be talking about 3,000 vulns (with no churn) - we used to care about defect density, and most software wouldn't go more than a few hundred lines without SOME bug, whether that's a "vulnerability" is often a layered question.

[encom]

>features no one asked for

Google asked for them. That's all that matters.

[dylan604]

Even if it had the Microsoft logo attached? Windows was always known to not be the most secure of products. I can't imagine anything else from the same company would be any better