the defects in software like Firefox are finite
That's a optimistic take. I don't think that a software as large as Firefox/Chromium can ever be 100% secure. Especially not with the fundamental design errors ( js-sandboxing) of the modern web.
this post was submitted on 01 Nov 2026
29 points (100.0% liked)
Programming
29187 readers
125 users here now
Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!
Cross posting is strongly encouraged in the instance. If you feel your post or another person's post makes sense in another community cross post into it.
Hope you enjoy the instance!
Rules
Rules
- Follow the programming.dev instance rules
- Keep content related to programming in some way
- If you're posting long videos try to add in some form of tldr for those who don't want to watch videos
Wormhole
Follow the wormhole through a path of communities !webdev@programming.dev
founded 3 years ago
MODERATORS
Software has usually between 15 and 50 defects per 1000 lines of code.
Some say it is larger - from the above link:
This observation is very old, and comes from a very venerable source, namely Fred Brooks in his book "The Mythical Man Month". He was a top manager at IBM, and managed many programming projects including the milions-of-lines operating system OS/360. In fact he reported that the number of bugs in a program is not proportional to the length of code, but quadratic!
Firefox 20 has about 4 millions of lines of code.
Using the rough and perhaps optimistic estimate from above, it could have between 60,000 and 200,000 bugs, and perhaps much more.
So, while this is a finite number, in practical terms, the number of bugs is unlimited.
And bugfixes can introduce new bugs, especially in large + compkex codebases.
In other words: at any given time, only one of [sandbox or renderer patches] needed to compromise the browser would be available in the patch gap
That's clever.