om2

Praising a murderer for committing a murder is not incitement and is protected speech. Under Brandenburg v. Ohio (1969), speech loses protection only if it is directed at inciting or producing imminent lawless action and is likely to produce it. A comment on a murder after the fact can’t meet this standard unless the comment is “go do another murder right now!”

Kimmel also did not praise the murderer. He implied (incorrectly as it turns out) that the killer was right-wing.

Your misstatements of the well-known facts and law in this case cast doubt on the effort you put into researching the other issues mentioned.

That article doesn’t explain why acupuncture works, just gives a hint of a possible mechanism. It also doesn’t contain any evidence that acupuncture works at all (other than as a placebo).

- and + operators have the same precedence. And a similar bug is possible if the operators were the same (both -). So I’m not sure it’s right to blame this on operator precedence or mixed operators. It’s just that, ultimately, the “consume” needs to be subtracted, not added.

> They also have the option to not spend resources finding the bugs in the first place.

The Copenhagen interpretation of security bugs: if you don’t look for it, it doesn’t exist and is not a problem.

The codec is compiled in, enabled by default, and auto detected through file magic, so the fact that it is an obscure 1990s hobby codec does not in any way make the vulnerability less exploitable. At this point I think FFmpeg is being intentionally deceptive by constantly mentioning only the ancient obscure hobby status and not the fact that it’s on by default and autodetected. They have also rejected suggestions to turn obscure hobby codecs off by default, giving more priority to their goal of playing every media format ever than to security.

Nation-states are a very relevant part of the threat model.

In this world and the alternate universe both, attackers can also use _un_published vulnerabilities because they have high incentive to do research. Keeping a bug secret does not prevent it from existing or from being exploited.

Take it up with the parent of my comment, who compared them directly.

Implementing it without tons of security bugs is apparently pretty hard.

It doesn’t scale well to content that changes dynamically on the client side very well. Dynamic manipulation of the post transform XSL-FO is confusing and difficult, retransforming the whole document from source is too slow and loses state. This is a big part of why CSS won.

Fetch API is a pretty recent addition to the web platform. Back in the day, you could absolutely embed images of stylesheets from ftp: URLs. You could even use it with XMLHttpRequest (predecessor of Fetch). Even further back, gopher: was integrated with the web. URL schemes were invented for the web with the idea that http: is not the only one. These other protocols were really part of the web until they weren’t.

XSLT is also a really problematic feature from an implementation perspective (albeit in a different way than showModalDialog or MutationObservers).

I’m not a Chrome dev but I think they have decent reasons for going this way.

We have contributed a number of upstream fixes

  $ cd gnome-libxml2.git
  $ git log --oneline [email protected] | wc -l
      43

The main reason we have a fork at all is that upstream libxml2 has broken source and binary compatibility in various ways, and we can't take those changes because libxml2 is public API on our platforms. We do make an effort to upstream all security fixes, though we sometimes get to it only after we ship.

This study accounts for missing ordinary matter, not dark matter. The linked article makes this clear in the first paragraph. Sometimes I wonder if the first commenters (and often top commenters) on HN read the article at all or just respond based on the headline, because these comments often seem barely related to the actual article content.