News for hackers. Stuff that matters.

A comment on OpenAI and Hugging Face partner to address security incident. Parent comment

Re:OpenAI and Hugging Face partner to address security incident by friendzis on Thursday July 23, 2026 @10:37AM (#49022366)
The point is lost somewhere. Prepared statements for SQL, innerText for HTML and similar do not show tractability of escaping, they sidestep the escaping problem altogether.

Those are interfaces where escaping is no longer needed precisely because they deinterlace instructions from data. Escaping problem inherent to instruction+data channels. Yes, deinterlacing is not solution, not futile attempts to escape.

[ Parent | on HN ]
Re:OpenAI and Hugging Face partner to address security incident by insanitybit on Thursday July 23, 2026 @12:26PM (#49024244)
innerText escapes the text, that's the whole point of Trusted Types. Escaping isn't just "needed", it's literally how those features work.
[ Parent | on HN ]