“To date, our free OSS-Fuzz service has found over 5,500 vulnerabilities across 375 open source projects caused by memory safety errors, and our Rewards Program helps encourage adoption of fuzzing through financial incentives.”
Google is paying the group behind Let’s Encrypt to rewrite pieces of curl and Apache in Rust. Fuzzing finds memory bugs faster than anyone can fix them. Rewriting the parsers that face the internet is the only fix that sticks. A trillion-dollar company that runs on this code is funding two libraries. That is a start, not a rescue.