Google assigns a CVE for libwebp and gives it a 10.0 score

Re:Google assigns a CVE for libwebp and gives it a 10.0 score by diogenes4 on Tuesday September 26, 2023 @12:38PM (#37661879)

Kind of crazy we're still using monolithic kernels in 2023. Nothing about `io_uring` needs to happen with elevated privileges.

I would take a large—say, 2-5x—performance hit just to escape these kinds of vulnerabilities.

[ Parent | on HN ]

Re:Google assigns a CVE for libwebp and gives it a 10.0 score by hderms on Tuesday September 26, 2023 @01:17PM (#37662606)

but isn't the whole point of io_uring that it's more performant?

[ Parent | on HN ]

Re:Google assigns a CVE for libwebp and gives it a 10.0 score by eqvinox on Tuesday September 26, 2023 @06:16PM (#37666506)

A 2-5× performance hit is also a 2-5× CO₂ hit, and I wouldn't be willing to let myself or other people take that hit. We're throwing enough heat into the atmosphere already to make cats dance on our portable supercomputers as is.

[ Parent | on HN ]