Hacker News Reader

Oh, you're right; I managed to miss that the vuln was from 2023. I do wonder how widely used the wuffs version is now that it exists, though.

View on HN

wuffs has the same story as rlbox in firefox. They made the tool, they proved it could work with one library, and then proceeded to ignore it for all the other libraries.

https://hacks.mozilla.org/2020/02/securing-firefox-with-weba...

rlbox is used for more than one library: "Now, we’re bringing that technology to all supported Firefox platforms (desktop and mobile), and isolating five different modules: Graphite, Hunspell, Ogg, Expat and Woff2"

https://blog.mozilla.org/attack-and-defense/2021/12/06/webas...

Reply on news.ycombinator.com