Quoting https://bsky.app/profile/baldurbjarnason.com/post/3mgcpckb5qk27 :

[elilla@transmom.love]

Quoting https://bsky.app/profile/baldurbjarnason.com/post/3mgcpckb5qk27 :

As @davidgerard has posted elsewhere, the maintainer of the library HarfBuzz has gone all-in on vibe-coding.

(see: https://typo.social/@behdad/116172838540880597 )

A note on why this is a worry in the thread ->

Fonts are a lucrative target. They require a complex parser, usually written in a language that isn't memory safe, and often directly exposed to outside data (websites, PDFs, etc. that contain fonts). This means a flaw could lead to an attack worst case scenario: arbitrary code execution

HarfBuzz is pretty much the only full-featured library for that takes font files, parses them, and returns glyphs ready to render. It is ubiquitous. A security flaw in HarfBuzz could make a good portion of the world's user-facing software (i.e. that renders text) unsafe.

Irrespective of the vibe-coding issue (code review is not an adequate defence against "agent" bugs) this is a piece of software that, due to its position in the industry, should be MORE conservative than the rest. Core infrastructure is not where you want experimentation

[elilla@transmom.love]

in one day I learn both about HarfBuzz guy and Donald fucking Knuth being one-shotted by code waifu psychosis (not to mention the bcachefs case from before https://poc.bcachefs.org/ ) (not to mention continued cases of murderous psychosis https://www.wsj.com/tech/ai/gemini-ai-wrongful-death-lawsuit-cc46c5f7 )

I swear if I don't find comrades to declare full-blown Butlerian Jihad soon I'll just find some other job and retire from computers altogether, permanently

[mawhrin@circumstances.run]

@elilla frankly, if i had means to leave my job rn, i'd probably do that and just start supporting any ethical distro or system that deliberately avoids the autoplags.

[srazkvt@tech.lgbt]

@elilla @davidgerard if anyone wonders why code review isn't good enough, it's because code review is meant to see if there's any obvious mistake in the code, and if it looks right. that's not useful when you have something that creates potentially flawed code that looks fine

[elilla@transmom.love]

tfw then only ones with the political will to blow up datacenters is the fascist Iranian dictatorship

[astraleureka@social.treehouse.systems]

@elilla wait what happened to knuth

[elilla@transmom.love]

@astraleureka

I am so sorry.

https://www-cs-faculty.stanford.edu/~knuth/papers/claude-cycles.pdf

[fiee@literatur.social]

@astraleureka

Is a fan of Claude’s now:

https://cs.stanford.edu/~knuth/papers/claude-cycles.pdf

@elilla

[jaredwhite@indieweb.social]

@elilla There are lots of us comrades! We've just been abandoned by all the institutions we thought were there to protect open/libre software and civil rights thereof, so it's taking a while to figure out alternatives 🤪

[medeavanamonde@beige.party]

@elilla
Sign me up, butter cup.
Even though I am technically disabled