News for hackers. Stuff that matters.

A comment on Brave overhauled its Rust adblock engine with FlatBuffers, cutting memory 75%. Parent comment

Re:Brave overhauled its Rust adblock engine with FlatBuffers... by Cyph0n on Monday January 05, 2026 @08:34PM (#46507697)
Not sure I follow. Suppose you tore out a portion of libxml2 for use in your HTTP server. A CVE is filed against libxml2 that is related to the subset you tore out. Obviously, your server doesn't link against libxml2. How exactly would distro maintainers know to include your package in their list?
[ Parent | on HN ]
Re:Brave overhauled its Rust adblock engine with FlatBuffers... by saagarjha on Tuesday January 06, 2026 @12:12AM (#46508981)
You’d list it in your attribution?
[ Parent | on HN ]
Re:Brave overhauled its Rust adblock engine with FlatBuffers... by Cyph0n on Tuesday January 06, 2026 @07:27AM (#46511424)
I am unfamiliar with distro packaging. Does every distro use the attribution to route CVEs?

Regardless, the maintenance burden remains.

[ Parent | on HN ]
Re:Brave overhauled its Rust adblock engine with FlatBuffers... by BenjiWiebe on Wednesday January 07, 2026 @12:51AM (#46523063)
I believe some distros require un-vendoring before accepting the package.

If the code you vendored was well hidden so the distro maintainer didn't notice, perhaps the bad guys would also fail to realize you were using (for instance) libxml2, and not consider your software a target for attack.

[ Parent | on HN ]