Post #1971054

@slomo @zeenix @pid_eins general statistics are meaningless when we're talking about system level software. I think it's more useful to look at the kind of CVEs that projects like GNU coreutils get, since that is more relevant to decisions made for similar projects.