Sorry, it's you. You basically told people that they should expect bugs in old code and shot down the proposed fix without offering any other solution; that's non-constructive by definition.
Which options are there, really? There is re-write, fixing, and mitigation.
We have a lot of legacy code that probably contains many bugs that could be exploited.
We could either stop using that legacy code, i.e. re-write and move to a newer library / package. Or fix the old code.
I now believe that "fixing" the code is actually in reach for an organization such as Google, which has deep pockets, frontier AI models, and a history of working on open source. Spend a few billions to walk through every package that runs on a common Linux installation, find potential issues and robustify the code.
[–] dvdkon 22 hours ago
[–] cowlevel 17 hours ago
[–] grumbelbart2 17 hours ago
We have a lot of legacy code that probably contains many bugs that could be exploited.
We could either stop using that legacy code, i.e. re-write and move to a newer library / package. Or fix the old code.
I now believe that "fixing" the code is actually in reach for an organization such as Google, which has deep pockets, frontier AI models, and a history of working on open source. Spend a few billions to walk through every package that runs on a common Linux installation, find potential issues and robustify the code.
[–] awesome_dude 13 hours ago
The inspection/discovery part is what has accelerated; the fix, patch or rewrite, has not.
People smugly yelling on the internet to rewrite because they have a new toy isn't constructive - why aren't they out there doing it already?