News for hackers. Stuff that matters.
Re:Google assigns a CVE for libwebp and gives it a 10.0 score by chlorion on Tuesday September 26, 2023 @07:41PM (#37667473)
Apple has actually measured the impact of adding bounds checking to commonly used libraries including media libraries and found no impact on overall power use. Audio and video encoding libraries took around a 1% performance impact.

https://llvm.org/devmtg/2023-05/slides/TechnicalTalks-May11/...

Re:Google assigns a CVE for libwebp and gives it a 10.0 score by pjmlp on Wednesday September 27, 2023 @03:48AM (#37671459)
There is no technological reason to not use bounds checking as the default mode of operation since ALGOL exists.

My favourite quote, C.A.R Hoare's "The 1980 ACM Turing Award Lecture"

"A consequence of this principle is that every occurrence of every subscript of every subscripted variable was on every occasion checked at run time against both the upper and the lower declared bounds of the array. Many years later we asked our customers whether they wished us to provide an option to switch off these checks in the interests of efficiency on production runs. Unanimously, they urged us not to--they already knew how frequently subscript errors occur on production runs where failure to detect them could be disastrous. I note with fear and horror that even in 1980 language designers and users have not learned this lesson. In any respectable branch of engineering, failure to observe such elementary precautions would have long been against the law."

-- https://www.labouseur.com/projects/codeReckon/papers/The-Emp...