xtrapolate

> "If even SQLite can have a RCE vulnerability, I'm convinced that it is not feasible for anybody to write safe C code."

This has much less to do with C, than it has to do with the fact that sqlite is a huge codebase.

Software can be vulnerable regardless of the programming languages used.

> "you give Plaid your username and password, and Plaid scrapers on their servers log into your online banking account"

So your username and password are just kept in some internal database somewhere? The scrapers probably decrypt the credentials in-memory.

Also - "scraping" data off of an undocumented API sounds risky. How can I guarantee a "scraper" won't accidentally mess something up for me?

> "I'm partial to Iran because a multi-lateral treaty was signed. Iran stopped nuclear enrichment. In exchange, western countries pledged to provide economic relief and stop sanctions."

Iran stopped its nuclear enrichment program, so the sanctions were wavered. Iran continued working on a ballistic missile program (capable of carrying nuclear warheads), and continued destabilizing countries throughout the middle east (through proxy terrorism) - so the sanctions came back.

In other words - temporarily halting the nuclear enrichment program alone should not excuse Iran from being held accountable.

> "Did you read the entire article? The whole point was that "delay loading" a particular DLL prevents a static analysis in the compiler from inserting hooks to perform expensive operations."

I actually have read the entire article. Have you?

Your explanation has absolutely nothing to do with the performance gains observed. Moreover, in the context of delay-loaded DLLs, your explanation actually makes no sense whatsoever.

Delay loaded DLLs, a linker/loader optimization Microsoft has offered since the days of C++ 6.0 (1998), simply means most process invocations in OP's case won't actually end up loading said DLLs, reducing the amount of time spent in DLL_PROCESS_ATTACH/DLL_PROCESS_DETACH (and specifically during destruction, in the Kernel).

> "The first fix was to avoid calling CommandLineToArgvW by manually parsing the command-line."

> "The second fix was to delay load shell32.dll."

If your build pipeline is continuously spawning processes all-over, to the point "delay loading" makes a significant difference - it's time to start re-evaluating the entire pipeline and the practices employed.

> "SRI has been available for two years and it still isn't being used enough."

Two years is relatively fresh. There's probably a significant amount of customers with browsers that don't support this.

Can't we just implement a simple poor-man's SRI ourselves? Download the 3rd-party script, hash it, check hash, proceed to exec() if all is well? This should be supported by much older browsers.

> "When I was a college instructor I found that when I tried hard - putting a lot of thought into pedagogy, having weekly (open notes) quizzes, assigning challenging but fair homework - I got terrible evaluations, even though the average grade in my class was higher than other teachers who were teaching the same course. When I phoned it in, didn't really try, was very lax with the homework and often made the quizzes take-home, I got excellent reviews but the average grade in the class was worse."

It must've been a frustrating experience.

At the same time - you're making a very broad statement here based on a rather personal experience. You went from a certain regimen yielding certain results, to a different regimen yielding different results. There are way too many parameters here to draw conclusions.

> "isn’t it up to the universities to provide a majority their value in the form of education"

I'm not sure how this statement addresses my claims.

How do we measure/quantify the quality of education? I claim that the way students feel about the staff and the institution should be taken into account, rather than dismissed.

> "A teacher (also called a school teacher or, in some contexts, an educator) is a person who helps others to acquire knowledge, competences or values."

The target audience is a crucial part of the feedback loop. Removing the students from the equation sounds counter intuitive. What are the proposed alternative metrics? Who delivers the feedback? And what is the feedback based on, if not on the direct opinions of the people on the receiving end of the service?

> "gene is for CCR5, which currently doesn’t have known function"

It's in the article:

> "Even if editing worked perfectly, people without normal CCR5 genes face higher risks of getting certain other viruses, such as West Nile, and of dying from the flu. Since there are many ways to prevent HIV infection and it's very treatable if it occurs, those other medical risks are a concern, Musunuru said."