Why counting CVEs to compare Rust and C++ is a trap, in one curl example

The argument: who owns the mistake

In How memory safety CVEs differ between Rust and C/C++, the author argues that comparing raw CVE counts across the languages is misleading because the two ecosystems draw the line of responsibility in different places. His worked example: curl_getenv(NULL) segfaults in C, but that's not filed as a curl CVE — it's "wrong usage," the caller's fault. The equivalent in Rust lands differently. As he puts it:

"If the called function is not marked with unsafe, then the answer is simply YES. It is impossible to use it incorrectly."

So in safe Rust, a memory bug implies a soundness hole in the library, which gets a CVE; in C/C++, an identical mishap is classified as misuse and never enters the count. Same bug, different ledger.

"The second someone compares CVE counts, I ignore them"

The thread's loudest agreement was with the meta-point.

"a rule of thumb i follow is that the second someone starts comparing or talking about the number of CVEs, i just ignore whatever they say next. its hard to think of a more useless metric." — a commenter on the metric itself

But the author's premise drew fire too. One reader worried it cuts against Rust: if any type-safety glitch counts as a vulnerability, then an unexpected panic! from a library could be filed as a denial-of-service bug — "impossible to tell in isolation." A MediaWiki contributor drew the distinction back: a Rust function taking an Option "is essentially advertising that it can handle None values," which is not the same as handing a C function a null pointer and watching it freak out.

Stroustrup's ghost enters the chat

The C++ side arrived with a heavyweight citation. A reader relayed Bjarne Stroustrup's recent interview: memory-safety issues are "almost all" either C, or C-style C++ that ignores Modern C++, and hardened libraries close most of the rest. Others piled the caveats on Rust: it trades memory-safety bugs for supply-chain risk, and unsafe isn't the only door to UB — the standard library, dependencies, and soundness holes all count. A stats-minded reader tried to right-size the stakes: a small fraction of vulnerabilities are memory-related in ordinary code, and only some of those are the use-after-free class the borrow checker targets.

The point survives the fight

Even the C++ defenders mostly conceded the narrow thesis: CVE counts compare two different bookkeeping systems, not two levels of safety. Rust pushes the contract into the type system, so violations surface as library bugs; C/C++ leave it with the caller, so violations surface as user error or not at all. The number you can google is a measure of how each community files paperwork — and a real-world data point sits next to it: a browser engine reporting its Rust HTML parser ran 10% faster than the C++ it replaced.