4 ms·
- Excellent of the author to call these things out. - All 3 things are show stoppers for any real use. An unstable format which trusts input is a CVE and data
by cogman10 3mo ago
- Excellent of the author to call these things out.
- All 3 things are show stoppers for any real use.
An unstable format which trusts input is a CVE and data loss magnet.
- vardump 3mo agoThat is a bit too harsh. Not all applications require those guarantees. It’s fine if you can trust the inputs.
- monster_truck 3mo agoThe inputs can never be trusted
- CodesInChaos 3mo agoIf inputs are part of the application bundl3, they can be trusted as much as the code itself.
- nonadhocproblem 3mo agoI'll be resolving issues 2 and 3 in the next couple of weeks (adding a safe decoder and doing a lot of fuzzing). The format, however, might continue to change for some time because I want to push performance even further.
- cogman10 3mo agoWhich is great and please don't take this as me being critical of the approach you are taking. I think it's perfectly reasonable during early development have your compressed stream in flux. I've been bitten in the past with other libs that weren't as explicit about their stability.