Ask HN: Is the CVE surge about finding old bugs or writing new ones?