You haven't seen the same kind of bugs I have, I guess.

This kind of thing takes more than 2 days to fix, unless you're really good.

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=217637

Or this one

https://security.stackexchange.com/questions/104845/dhe-rsa-...

I can find more of these that I've run into if I look. I've had tricky bugs in my team's code too, but those don't result in public artifacts, and I'm responsible for all the code that runs on my server, regardless of who wrote it... And I also can't crash client code, regardless of who wrote it, even if my code just follows the RFC.

I'm sure it has a lot to do with the complexity of the environment but I've fixed three bugs in a day easily.

Our software isn't serving millions of people though, it's a cli tool with a few hundred end users.