milkshakes

not sure why this was flagged, it's completely on point.

> It's a Bad Idea (TM) to compile a regular expression from an untrusted input.

i agree with you!

nevertheless,

> where we nevertheless treated a double free in Regexp compilation as a vulnerability after a comprehensive assessment

not sure what sort of comprehensive assessment is still called for at this point?

also it was under hn load which makes this much harder

this take will not age well.

consider where "AI" was just two years ago, pre claude and codex. what do you think the next two years will bring?

fair

really?

1. there's no actual evidence that the key to the wallet is on this machine at all. it would be trivial to add a service that would sign challenges to prove so

2. a working RCE against PHP is worth much more than $1000, attacking this machine would easily burn that

> created: 54 days ago

lol.

> I wouldn't be surprised

yeah i am not surprised you're not surprised. you seem to have already made up your mind. that said, every single guess you have made here is completely incorrect and not based in facts at all.

literally you have no idea what you're talking about! but don't let that stop you from having an opinion

what makes you so sure these would be publicized? what incentive does an adversary have to be loud about it?

with more productive teams you can have smaller teams and better communication