| ▲ | 3kahg 2 hours ago | |||||||||||||||||||||||||||||||||||||||||||
It is the opposite. Security people focus on curl, sudo because they are code bases that contained a lot of features and unused code from the 1990s. They don't focus on projects where they find nothing. They certainly don't advertise when they find nothing. Getting a lot of scrutiny is not the recommendation that it appears to be. What is the new standard? Projects that never have bugs are deemed to be suspect because they "have not been scrutinized" (they have, but null results never go public)? So Mythos only finding one issue after other tools have found 300 this year is embarrassing. Mythos was supposed to be better and novel. | ||||||||||||||||||||||||||||||||||||||||||||
| ▲ | tptacek 2 hours ago | parent [-] | |||||||||||||||||||||||||||||||||||||||||||
It is definitely not the case that curl has been or is now a marquee vulnerability research target. It's a CLI HTTP fetcher. It's the same with sudo. It's a big deal if a sudo vulnerability gets found, because it's an extremely load-bearing piece of software, but sudo is itself not a prime target, because it doesn't do much. | ||||||||||||||||||||||||||||||||||||||||||||
| ||||||||||||||||||||||||||||||||||||||||||||