You get bug bounties if you report the kind of bugs Mythos identified. There's a reason no-one collected bounties from the "5000 defects" Coverity identified.

The Mythos reports have several examples of chaining a whole bunch of logic in different parts of the program together to exploit something very subtle. The Coverity reports aren't anything like that. These tools aren't remotely in the same league or even universe.

If it's only hit once by a random person, memory starts being more likely.

(Unless that LOC is scanning memory or smth)

From what he's saying they run an actual memory test after a crash, too.

But they have?

I read the parent post as saying that this is the problem, i.e. that "complete" support is a mess, because AFAIK even the reference implementation is incomplete and buggy, and that then getting angry at the consumers of it is besides the point and won't lead anywhere (which is what we see in practice).

Browsers supporting a format "a little" is almost worse than not supporting it at all, because it makes the compatibility and interoperability problems worse.

(You can check the files I linked and see audits between deltas for minor version updates)

You need to be in the right kind of company - the one where waiting for the external vendor to fix their shit is too slow.

* https://chromium.googlesource.com/chromiumos/third_party/rus...

* https://searchfox.org/mozilla-central/source/supply-chain/au...

It's quite likely that most of your dependencies were already audited.

It makes for some funny reading if you're familiar with the field. (This should not be construed as legal advice as to the validity of the pool)

The existence of a patent pool does not mean there are valid patent claims against it. But yes, you may be technically correct by saying "patent free" rather than "not infringing on any valid patents". That said historically Opus has had claims against it by patents that looked valid but upon closer investigation didn't actually cover what the codec does.

Just looks like FUD to me. Meanwhile, the patent pools of competing technologies definitely still don't offer indemnification they cover all patents, but have no problem paying a bunch of people to spew exactly this kind of FUD - they're the ones who tried to set up this "patent pool" to begin with!