caltrops

4 ms·

1. 1.▲
   by caltrops 9y ago

   This isn’t one of those. Handing large amounts of unvalidated user input to these libraries is particularly dangerous.
2. 2.▲
   by caltrops 9y ago

   How much does a hack of all your data and/or a major outage cost? I also recommended a mitigation strategy for unsafe code. Complaining that security is too hard is the reason for the situation we find ourselves in as an industry.
3. 3.▲
   by caltrops 9y ago

   I’d be very worried about a security issue with the unsafe C++ code. You really have to run this kind of complex parsing in a disposable containerized environment to do it safely. Or do everything carefully and in a memory safe language.