3 ms·

I understand your worries as they were one of my reasons to join these government organized briefings. It seems very unlikely that such a lib in itself has any

I understand your worries as they were one of my reasons to join these government organized briefings. It seems very unlikely that such a lib in itself has any cyber security risk as long as it itself does not query an external database through a network connection. The users of the lib have to asses that it has no security risk. Did you sign any formal agreement with the users of the lib? Is there still any obligsation on your side with respect to the lib? If you would discover some security issue, like a buffer overrun, would you fix it? Then just mentioning it, would be enough. The users of the lib bear the greatest responsibility. They have to regularly check your lib for security problems.

x0x0 2y ago
> It seems very unlikely that such a lib in itself has any cyber security risk as long as it itself does not query an external database through a network connection. It almost certainly has tons, because it was not designed to read attacker-controlled images or data files. If someone uses it that manner, I would be absolutely shocked if it doesn't. The testing suite focuses exclusively on correctness and speed. > If you would discover some security issue, like a buffer overrun, would you fix it? No. I don't use this work; I no longer work in science; etc. It's just a gift to other people of several years of work and a ton of time in vtune making it go fast.