Conversation

This Tweet was deleted by the Tweet author. Learn more
👻🎃 Status Quo 🎃👻
@KardOnIce
Replying to
@vyodaiken
@RichFelker
and 7 others
For the explicit use-cases I'm listing though, that is an expectation. People post proteomics files online for public use, so randomly uploading and downloading files for people to run on a local application is an expected use, much like it is with Word documents.
1
This Tweet was deleted by the Tweet author. Learn more
Daniel Micay
@DanielMicay
Replying to
@vyodaiken
@KardOnIce
and 7 others
Sharing image editing documents / word processing documents, etc. is irresponsible? What about media files? It's certainly a design objective of SQLite to handle untrusted files properly and they put far more effort into that than most alternative file format implementations.
2
1
Daniel Micay
@DanielMicay
Replying to
@DanielMicay
@vyodaiken
and 8 others
They are also far more successful at avoiding vulnerabilities in practice. Still, there are occasional memory corruption bugs. It doesn't make sense to blame on them rather than the tooling. I would certainly rather open an untrusted SQLite database than an MP4 file with FFmpeg.
1
1
This Tweet was deleted by the Tweet author. Learn more
Daniel Micay
@DanielMicay
Replying to
@vyodaiken
@KardOnIce
and 7 others
Except that we know how to write software that's decently secure and has these capabilities. Many people are doing it. There are implementations of formats like mp4 in memory safe languages without dynamic code exec. They're perfectly usable already today too.
1
1
Daniel Micay
@DanielMicay
Replying to
@DanielMicay
@vyodaiken
and 8 others
Telling users not to exchange files, visit untrusted sites, etc. is not viable. If the software is exploited, that's the fault of the software. That's never actually the fault of the user. The software industry can do much better and needs to do much better to keep users safe.
1
1