Russ Cox on Mythryl: “Despite popular usage to the contrary, I would argue that memory…”

Copy Fail? Also looks like memory safety, but is actually complexity. xint.io/blog/copy-fa... I am going to link to this while rejecting changes to Go crypto for years. Anyway, feeling pretty validated in my "ssh in as root, only gVisor or Firecracker are an actual security boundary" approach.

xint.ioCopy Fail: 732 Bytes to Root on Every Major Linux Distribution - XintXint Code disclosed CVE-2026-31431, an authencesn scratch-write bug chaining AF_ALG + splice() into a 4-byte page cache write. A 732-byte PoC gets root on Ubuntu, Amazon Linux, RHEL, SUSE. | AI for Se...

Filippo Valsorda@filippo.abyssdomain.expert

There are only two bug classes left: complexity and memory safety. CurveBall (CVE-2020-0601)? Complexity. BigSig (CVE-2021-43527)? Memory safety. Log4Shell (CVE-2021-44228)? Complexity. BlueKeep (CVE-2019-0708)? Memory safety. Heartbleed looks like memory safety, but it's actually complexity.

Post