the defects in software like Firefox are finite
That’s a optimistic take. I don’t think that a software as large as Firefox/Chromium can ever be 100% secure. Especially not with the fundamental design errors ( js-sandboxing) of the modern web.
Software has usually between 15 and 50 defects per 1000 lines of code.
Some say it is larger - from the above link:
This observation is very old, and comes from a very venerable source, namely Fred Brooks in his book “The Mythical Man Month”. He was a top manager at IBM, and managed many programming projects including the milions-of-lines operating system OS/360. In fact he reported that the number of bugs in a program is not proportional to the length of code, but quadratic!
Firefox 20 has about 4 millions of lines of code.
Using the rough and perhaps optimistic estimate from above, it could have between 60,000 and 200,000 bugs, and perhaps much more.
So, while this is a finite number, in practical terms, the number of bugs is unlimited.
And bugfixes can introduce new bugs, especially in large + compkex codebases.
In other words: at any given time, only one of [sandbox or renderer patches] needed to compromise the browser would be available in the patch gap
That’s clever.