While I'm generally in favor of innovation for secure computing, I think this category of "vulnerability" is not that bad. Applications have managed to use nati

While I'm generally in favor of innovation for secure computing, I think this category of "vulnerability" is not that bad. Applications have managed to use natively compiled plugins for decades without much in the way of `rm -rf /`ing users machines - and those that do don't get installed. Like for example I haven't yet seen a post that decries the security vulnerabilities of VST plugins or Unreal engine plugins, but they actually have slightly worse surface areas that are harder to secure than something running on top of a JS engine. At a certain point you have to accept that running code someone else wrote may do bad things. Zero trust doesn't have zero cost. Don't run random programs you download off the internet without accountability.