Ask HN: The government of my country blocked VPN access. What should I use?

Totally agree with this take. That said, you must account for the size of the codebase and associated attack surfaces and compare that with frequency of a particular bug class consistently popping up on every CVE.

In other words, you shouldn't use vulnerability counts, but you can discern patterns of vulnerability to intuit something about the nature of the codebase.

For example, RCE vulnerabilities on Chrome, especially under V8 while not very common they happen commonly enough to suspect that maybe there is some code quality issue. However, if you look at the sheer size of V8, and how much scrutiny and research it undergoes, it is surprising there aren't even more critical vulns being found all the time. JIT is inherently a risky endeavor.

mouse_ · 9h ago

There is no objective way to measure the security of an inherently insecure system.

Assume breach.

dentemple · 3h ago

Okay, but my boss still demands I give him a metric. I'm not allowed to tell him, "Just trust me bro" when I'm asked how much our security has improved over the past sprint. I'm supposed to give hard numbers, and the OP at least offers an alternative for that.

DANmode · 2h ago

Pick something that resembles a vuln→patch interval,

not just a context-less number that means they're popular, audited, or reviewing their OWN code all the time.

Instances where 0-days can't be used in isolation are a perfect example of where nontechnical people absolutely need to "just trust" someone to triage, and perform threat modeling for them.

Ask HN: The government of my country blocked VPN access. What should I use?

Ask HN: What to learn for math for modeling?

Ask HN: What to do when you suspect your interview is with a state operative?

Best up-to-date guides on Vibe Coding

Ask HN: Why hasn't x86 caught up with Apple M series?

Staying up to date on the best AI dev workflow?

Ask HN: How much better can the LLMs become assuming no AGI

Ask HN: Anyone working on bringing software back from US clouds?

Ask HN: Services for Shutting Down a Startup?

Ask HN: How can I recover and run my old mobile game from the 2010s?

Ask HN: Where can I see a live octopus in Maine?

Ask HN: How to teach a 4 year old to code?

CompactifAI Inference API

Ask HN: Did modern AI's coding abilities make you lose interest in programming?

Ask HN: What are the best Google alternatives in 2025?

Anthropick.com Redirects to ChatGPT

Ask HN: GitHub Copilot down?

Ask HN: What to Do with Old iPads?

Petition to stop Google from restricting sideloading and FOSS apps

Ask HN: Best codebases to study to learn software design?

Units of Economics of LLMs. Reply to Ed Zitron's "AI Is a Money Trap"

Ask HN: Does sentience put stress on the brain?

Ask HN: Is there a temp phone number like temp email?

Ask HN: Windows 11 Update Fail – Linux Distro Suggestions?

Ask HN: How to Learn to Build Agentic AI Systems (Like Claude Code)

Out of curiosity: what kind of people use this "forum" (I mean Hacker News)?

Ask HN: Why are so many services rejecting Google Voice numbers for signups?

Ask HN: What measures are you taking to stop AI crawlers?

Ask HN: Is backlink trading still a problem worth solving?

Ask HN: What should I use to run React Native tests on a device?

Stop squashing your commits. You're squashing your AI too

Ask HN: Are AI filters becoming stricter than society itself?

Ask HN: I just abandoned my PyCharm subscription, what should I use now?

Ask HN: Any experienced devs who use AI extensively in their work?

Ask HN: How do you find early stage startups to join

Stop Using Vulnerability Counts to Measure Software Security

Comments (4)