Boost.regex was peer reviewed in 2001, the same year XP was released and three years before Firefox was released. Modern C++.
Let's talk about the state of security back then if you want and compare.
The disappointing thing in this is that they haven't done a security review and put a plan in place for handling security. Par for the course in the world of software development, sadly.
Boost is peer-reviewed and receives more scrutiny than most C++ in the wild. Its peer review is its major selling point, in fact.
> Oh come on, you can't be serious given your advocacy for Rust.
I think it's possible for me to be able to express opinions in favor of memory safe programming languages in general (which is what I'm doing here) while also having worked on one.
If someone were to say "this illustrates why you should use Go for untrusted regexes", I'd agree with them!