@swick Thanks for your detailed response. I appreciate it.
If there is a database library with an API based on string manipulation instead of prepared statements, you would never touch the project. You could equally argue that lots of people write software which uses databases but never have to care about malicious inputs.
That's a very incorrect analogy. Not caring about something is very different than not having to care about something. The issue is question does not affect the vast majority of the software out there.
Opaque handles to filesystem objects are not particularly hard to abstract in a cross-platform manner. In the worst case that handle is internally just a path.
If that's the case, it should be easy for folks who think this is a very serious issue, to create an RFC issue with suggested API instead of complaining endlessly and expecting others (who likely work in spaces this issue doesn't apply to) to do all the work? 😉
You didn't address my question about any other security issues in std than this. Talking of which, are there any statistics that back up this claim that this issue is a lot more serious than all the security and safety issues Rust eliminates by its mere presence?
🇺🇦
. he/him My opinions are purely my own and do not represent that of my employer or FOSS communities I happen to work with.
