This library was originally written to parse GNOME configuration XML files. It was never intended for parsing untrusted data. From GNOME's perspective, if you c

This library was originally written to parse GNOME configuration XML files. It was never intended for parsing untrusted data. From GNOME's perspective, if you can crash the XML parser with a malformed config file, that's just a regular bug. If an attacker is able to write to arbitrary files in your home directory, he's already won. I agree with the maintainer's perspective that it's irresponsible for Apple, Microsoft, and Google to rely on this library for parsing untrusted data in products that they make billions of dollars off of, not provide him any monetary or other support, and expect him to prioritize fixing "security bugs" that don't impact security for his use case. If I was the maintainer, I'd make the same decision he made.