Writing the product would make it confusing how they ranked them. Just ranking them would work but wouldn't represent the relative risk very well.

It seems fine to me, and it's just a multiplication of two numbers, that's not overwhelming.

The product indirectly tells you the criteria for accepting the risk as-is, but it doesn't give you any insight into how to reduce the risk. That's what severity and likelihood are for. You need all three together.

I am fine with guesstimates for likelihood and severity, but the product doesn't make sense. When two guesstimates are multiplied like that, you choose the terms to give the product you want, or vice versa. The concept of trying to do a distillation of a risk assessment to a number is flawed.

You're right that the product number is not a very meaningful value.

https://en.wikipedia.org/wiki/Risk_matrix

Take a look at this risk matrix. It's divided into cells that are each assigned a category. If you assigned numbers to it, you'd get conflicting results:

1. Possible (3) x Catastrophic (4) = Very High (12)

2. Likely (4) x Critical (3) = High (12)

In this case, 12 can mean either High or Very High. Therefore the category is more important than the product.

So basically, the product is only meaningful if the categories are defined in terms of it, which I don't think is common. Really, I should have said you need the category, rather than the product.

Iirc there are people within the rust community that think this approach to using GCC is suboptimal, and that the reason this project survives is that some professors have decided to use this as an assignment.

If this is true , it wouldn't surprise me if this is the effect of them cargo-culting one of their Software-Engineering course

> there are people within the rust community that think this approach to using GCC is suboptimal,

This is true. There are also some (like me) who think both are great.

> the reason this project survives is that some professors have decided to use this as an assignment.

I am not sure that this is true.

There are also those of us who are thrilled that a total alternative Rust parser is being written. A systems language should never be centralized to the degree Rust is.

why not