News for hackers. Stuff that matters.
Re:Alpine Linux Security advisory: OpenSSH-server password a... by orf on Thursday November 05, 2026 @05:15PM (#50385256)
> but it does not change the amount of bugs per line of code

You are really uninformed: different programming languages have very different volumes of bugs per line of code

Re:Alpine Linux Security advisory: OpenSSH-server password a... by pheggs on Thursday November 05, 2026 @06:28PM (#50386053)
With all the respect but I don't think I am: https://arxiv.org/html/1901.10220v2
Re:Alpine Linux Security advisory: OpenSSH-server password a... by slopinthebag on Friday November 06, 2026 @01:35AM (#50388931)
that only tries to show a single study is flawed, nothing else

do you think bugs/loc is the same between brainfuck and rust?

Re:Alpine Linux Security advisory: OpenSSH-server password a... by pheggs on Friday November 06, 2026 @04:00AM (#50389875)
> that only tries to show a single study is flawed, nothing else

no the study failed to show any difference in bug count for a specific set of common used languages, where C and Python were both part of the dataset.

I don't think programming languages have a big impact on bugs per line when every line is written by a human. Now given that I was talking about bug counts, not severity.

Re:Alpine Linux Security advisory: OpenSSH-server password a... by slopinthebag on Friday November 06, 2026 @06:36AM (#50391114)
it showed errors in the methodology of an earlier study, it did not produce a novel result.

kind of reminds me how the "research" suggests that there are no practical differences between dynamically typed and statically typed languages...except we know from practical experience that there is, and the literature there is horribly flawed.

we have real-world evidence that rust leads to significantly less bugs in the real world

https://blog.google/security/rust-in-android-move-fast-fix-t...

Re:Alpine Linux Security advisory: OpenSSH-server password a... by pheggs on Friday November 06, 2026 @08:26AM (#50392028)
> it showed errors in the methodology of an earlier study, it did not produce a novel result.

It showed that there's no big difference. From the link:

> Combining corrections for all of these aforementioned items, the reanalysis revealed that only 4 out of the original 11 languages correlated with abnormal defect rates, and even for those the effect size is exceedingly small.

--

> we have real-world evidence that rust leads to significantly less bugs in the real world

no, we only have evidence for memory bugs, that's not what I was talking about