the uutils situation was very unsurprising to me, because the first people to attempt a rewrite of coreutils would be those who know enough programming to be confident, but not enough systems programm...
I wonder how many of these CVEs would've been avoided if people would've, y'know, looked at the (C) source of an existing implementation
1
