4 ms·

The real issue is the effort required to rewrite everything without introducing new bugs resulting from a misunderstanding of the original code

• kevingadd 2y ago
  New (likely aesthetic only) bugs in font rendering are probably considered preferable to existing security vulnerabilities, I would hope.
  • arccy 2y ago
    if you have too many aesthetic bugs, nobody will use it. it then becomes the most secure code because it doesn't run anywhere so can't be exploited.
  • kortilla 2y ago
    “Aesthetic only” bugs for a project entirely for aesthetics can easily kill the usage of it. Nobody cares about a CVE-free rendering library if it can’t render things correctly.
    • adgjlsfhk1 2y ago
      that really depends. There are thousands of languages in the world in dozens of alphabets and I currently only have a hope of reading text in a latin alphabet. As such, even a rendering library that misrendered 99% of unicode but was CVE free would be a major win for me (and hundreds of millions of people)
  • kiicia 2y ago
    it's hard to argue that "occasional accent rendering issue" is better than "occasional zero-click issue", but rewriting code of any actual complexity is hard in practice... and we are talking about only one library here, with thousands libraries and utils to go