vanschelven

Are we tired of the news-cycle yet? This one seems pretty serious on first reading.

It's not my intention to spew hate on Brotli every other day but I just stumbled upon this yesterday evening and couldn't resist claiming my 8-year-old CVE <<shrug emoji>>

Wow it's even more insane than I thought. That actually expands into 3 more relevant dates, all of which I've added to the timeline.

I don't know what a "real security audit" is in this context but I think I shared enough pain (with links) from my personal perspective to give a head start I suppose.

I agree security is always context dependent but "passes untrusted input through a package built in C which takes over a year to make security releases when the changelog already references those" makes the set of contexts in which something passes the test very small

One better alternative is presumably the Rust crate (mentioned in the article) it just happens that there's no Python bindings available for that.

All online discussions these days are like those chain email forwards of the last generation. <= this is the original point

This statement that AI researchers are taking up smoking was made by Alexander Karp (CEO of Palantir) <= this is is a wrong statement as per the link in the article I very much did read.

The original quote was from Shyam Sankar, CTO of Palantir, not Karp. <= this is someone that points out the statement is wrong, thereby proving the original point.

Clear now?

Thus proving the original point: it's hearsay all the way down

Never let the truth get in the way of a good story.

BTW in this case we happen to know one of the chains in the game of Chinese Whispers was the CTO of Palantir... this may or may not influence your beliefs

but even in a gold rush selling shovels _at a loss_ would not seem to be the best strategy, unless there would be some kind of shovel lock in effect.

_these_ programs not _all_ programs