[astine]

I think that prioritizing fixing bugs, especially security related bugs, over new features makes sense for most software projects. The problem comes from defining bugs. Is a bit of unexpected behavior a bug if it doesn't impact users? The article defines bugs as unmet product requirements but if that's the case I don't think the difference between a bug-fix and a new-feature is that clear because new features also help meet product requirements. Perhaps what they mean is that a bug is any regression from what they currently believe the system to be doing.

I do think a lot of this has to do with the size of the project. In smaller projects with fewer requirements, it's easier to define what is considered "working", but as projects grow that becomes harder and harder, partly because meeting all of the requirements becomes harder but also because the requirements interact with each other in unexpected ways making it harder to even figure out what even is required. And of course the volume of bugs increases, eventually making it impossible to completely stay on top of them even if you give up on new features altogether. A bug-tracker becomes necessary eventually.