Google assigns a CVE for libwebp and gives it a 10.0 score
1–10 of 235 posts
Re: Google assigns a CVE for libwebp and gives it a 10.0 score
#2[flagged]
Re: Google assigns a CVE for libwebp and gives it a 10.0 score
#3The point about Android is particularly important. I wouldn't like to estimate the proportion of Android phones that are in regular use that no longer receive security updates.
Re: Google assigns a CVE for libwebp and gives it a 10.0 score
#4[flagged]
Until governments give an helping hand, it is going to take a while.
However we are going into the right direction.
Microsoft also has put this into place for all those codebases that aren't being rewritten any time soon,
https://learn.microsoft.com/en-us/cpp/code-quality/build-rel...
Re: Google assigns a CVE for libwebp and gives it a 10.0 score
#5[flagged]
Who do you nominate as the arbiter of what qualifies as critical software?
Re: Google assigns a CVE for libwebp and gives it a 10.0 score
#6[flagged]
There are more "safe" languages than rust, especially if it's only "critical" software, not drivers.
Re: Google assigns a CVE for libwebp and gives it a 10.0 score
#7[flagged]
Downvotes of course. Programmers like to think they can write secure code with no guardrails. The fact that CVE lists are full of memory errors in 2023 says otherwise.
Even if you can write secure code in unsafe languages, it’s still a problem. Bugs creep in over time as more people work on a project, changes are merged, it’s ported to other platforms, etc.
If your project has any longevity you can’t bet on your pristine C code staying pristine.
There are more safe languages than Rust though.
Re: Google assigns a CVE for libwebp and gives it a 10.0 score
#8[flagged]
Downvotes of course. Programmers like to think they can write secure code with no guardrails. The fact that CVE lists are full of memory errors in 2023 says otherwise. Even if you can write secure code in unsafe languages, it’s still a problem. Bugs creep in over time as more people work on a project, changes are merged, it’s ported to other platforms, etc. If your project has any longevity you can’t bet on your pris…
Downvotes because we are tired of the rust spam.
Re: Google assigns a CVE for libwebp and gives it a 10.0 score
#9[flagged]
Rust is not the only memory-safe language (not even the first).
Re: Google assigns a CVE for libwebp and gives it a 10.0 score
#10[flagged]
This is a needlessly aggressive take IMO, and hailing Rust as the be-all and end-all for secure software lacks nuance, giving the language and its adherents a bad reputation.