You can find why it was complicated [0] and why it took so long [1] on GitHub. I do wish I had been faster on it. That said, the RCE required the user to be using a vibe-coded web-based chat overlay that didn't properly sanitize chatter inputs, so has a (hopefully) limited scope.
[0] https://github.com/obsproject/obs-studio/discussions/3853#di...
[1] https://github.com/obsproject/obs-studio/discussions/3853#di...
Thanks for chiming in and linking that, that was an interesting read. As much as I understand CEF's reasoning for making this shift, it's baffling that they don't provide a universal way to implement what you now had to implement yourself.
My vibe coded apps tend to over sanitize inputs. Not sure what was the point of blaming LLMs.
LLMs weren’t blamed, vibe coders were blamed.
If you don’t know what you are doing any tool can be dangerous
>>> vibe-coded
>> My vibe coded apps tend to over sanitize inputs. Not sure what was the point of blaming LLMs.
> LLMs weren’t blamed … If you don’t know what you are doing any tool can be dangerous
If we're not talking about LLMs but instead about humans (who might be coding by hand, or from stackoverflow, or who might be using an LLM regardless of whether it frequently sanitizes by default), then shouldn't the original comment have more accurately referred to humans, as vibe-coding specifically refers to LLM use, right?
Does this even remotely matter? What’s the issue here?
Did you mean to reply to my comment? Was your issue with the original claim that lack of sanitization *"required"* "vibe-coded" functionality, or with the counterclaim that lack of sanitization can and has occurred even for code that is 0% related to vibe-coding or LLMs (let alone "requiring" vibe-coding for it to occur)?