They say as much here [1]. > Fastly is a shared infrastructure. By allowing the use of inline C code, we could potentially give a single user the power to read

They say as much here [1]. > Fastly is a shared infrastructure. By allowing the use of inline C code, we could potentially give a single user the power to read, write to, or write from everything. As a result, our varnish process (i.e., files on disk, memory of the varnish user's processes) would become unprotected because inline C code opens the potential for users to do things like crash servers, steal data, or run a botnet. Personally, my hypothesis is that somebody uploaded a configuration for their domain `https://IVCL_{raise(SIGSEGV)}.com https://IVCL_{raise(SIGSEGV)}.com` (edit: the preceding URL used to contain a heart emoji between I and VCL, apparently HN prefers ASCII, too) in a way that, rather than converting to Punycode, passed a few bytes that weren't in the 96 legal characters accepted by the VCC compiler and caused some kind of undefined behavior. [1] https://docs.fastly.com/en/guides/guide-to-vcl#embedding-inline-c-code-in-vcl https://docs.fastly.com/en/guides/guide-to-vcl#embedding-inl...