alt Hacker NewsIt is a largely a skill issue. My first litmus test is: is the codebase using the standard library? If so, it's probably insecure garbage. Nothing in libc is usable in a high quality code base, hell not even the humble sin() function is sensible with its retarded errno nonsense.
Yea, one of the reasons I rolled my own libc equivalent is how actually awful glibc (and the STL) are. If you actually read the glibc source you'll find countless comments such as "TODO: we need to account for X failure state" or ridiculous UB prone codepaths (signal trampolines, TLS, threading for instance). As in, these are things that can and SHOULD be guarded by the libc itself instead they just allow plain UB to occur.
The STL is awful by extension because it delegates ALL of this work to libc (anything that interacts with the OS) and they integrate this deeply into every single container.