yosh

@yoshuawuyts they're doing rigorous testing, clang static analysers, etc — but nothing compares to heavy real-world usage

@yoshuawuyts I've written software that I tested every nook and cranny of that still failed the moment it hit a real-world edge case

@yoshuawuyts so "has anyone else run this at scale, in production" is a huge deal, and the alternative is "do I know the code intimately"

@FrozenFire that's super fair! I guess that holds up beyond just C code hey

@yoshuawuyts yup, definitely not limited to C — I'm just way less likely to trust anything written in C

@yoshuawuyts I strongly believe the sky is about to come falling down any moment now, and the latest string of RCEs only strengthens that

@FrozenFire the sky... Of C you mean? I don't know what an RCE is

@yoshuawuyts remote code execution — see recent git RCE, glibc RCE, various others