Comment by jason_oster
2 days ago
A literal interpretation of the claim is, quoted directly, "old code has fewer bugs than new code". Now you've clarified that you meant "stable code", which is fair. But stability is not a guarantee of correctness. Perhaps you meant "correct code", and not necessarily "old" or "stable" code.
I admit it is difficult to infer your intention on the classification of "old code vs new code". I don't see evidence that new code is inherently worse than old code, including in the cited study. There is correlation that people forget lessons learned in the past, but that's as far as I would evaluate the data.
> vulnerabilities decay exponentially.
Because they get fixed over time. That isn't controversial. They also persist over time. The quoted observation depends on proactive maintenance. But proactive maintenance is also the only cause of new bugs by definition. "Recently modified code" stands out in the last paragraph. This study is not talking about stable code.
Reading back, yeah I can see the alternative interpretation of what I wrote, that's fair
> Perhaps you meant "correct code", and not necessarily "old" or "stable" code.
That sounds like a circular statement to me: if the code is correct, it can't have bugs, because bugs are when it does something wrong. Calling it stable seems fair to me, idk which would be most precise and bestest choice of words but that hopefully conveys the concept of some software product that hasn't majorly changed but also isn't just abandoned (say, a part of Firefox that hasn't been rewritten in forever, but Mozilla continues to apply any fixes to it when bugs are reported), for which I think the statement holds
> The quoted observation depends on proactive maintenance.
Yeah, that's the issue with my original wording of "old", where I can totally see the other interpretation coming to mind first. It's not that people who lived longer ago wrote better code :p. Quite the opposite: the effect of awareness increases over the decades is very visible in my work as security tester
What I'm trying to get at is that age and stability are only loosely correlated with correctness. I'll give you credit for calling out the tautology, and I don't think there is a way around it. Any code that is written without rigor is going to be buggy. The age/stability thing is a category error.
The only thing I can conclude is that a more rigorous methodology for authoring code is more valuable than cleaning up after oneself later.
> the effect of awareness increases over the decades is very visible in my work as security tester
This absolutely matches my own feeling on the value of experience. Knowing what not to do is where practically all of my efficiency comes from, having learned that the hard way.