Quoting https://bsky.app/profile/baldurbjarnason.com/post/3mgcpckb5qk27 :
> As > [> @> davidgerard](https://circumstances.run/@davidgerard )> has posted elsewhere, the maintainer of the library HarfBuzz has gone all-in on vibe-coding.
(see: https://typo.social/@behdad/116172838540880597 )
> A note on why this is a worry in the thread ->
> Fonts are a lucrative target. They require a complex parser, usually written in a language that isn't memory safe, and often directly exposed to outside data (websites, PDFs, etc. that contain fonts). This means a flaw could lead to an attack worst case scenario: arbitrary code execution
> HarfBuzz is pretty much the only full-featured library for that takes font files, parses them, and returns glyphs ready to render. It is ubiquitous. A security flaw in HarfBuzz could make a good portion of the world's user-facing software (i.e. that renders text) unsafe.
> Irrespective of the vibe-coding issue (code review is not an adequate defence against "agent" bugs) this is a piece of software that, due to its position in the industry, should be MORE conservative than the rest. Core infrastructure is not where you want experimentation
elilla&, fibre crafts arc
npub18z…t45sm
2026-03-05 19:43:31 UTC
Author Public Key
npub18zk7axp57m7lle8nq7dttg34kdm75x7wan27704zev4297jykm9swt45smSeen on
wss://relay.momostr.pinkPublished at
2026-03-05 19:43:31 UTCEvent JSON
{
"id": "e2cd6a9255b4f40ab0c53b338e4377c4d0a032ad9258268688b6b58422b65107",
"pubkey": "38adee9834f6fdffe4f3079ab5a235b377ea1bceecd5ef3ea2cb2aa2fa44b6cb",
"created_at": 1772739811,
"kind": 1,
"tags": [
[
"proxy",
"https://transmom.love/@elilla/116178276299858011",
"web"
],
[
"content-warning",
"tech, \"AI\", bad news"
],
[
"proxy",
"https://transmom.love/users/elilla/statuses/116178276299858011",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://transmom.love/users/elilla/statuses/116178276299858011",
"pink.momostr"
],
[
"-"
]
],
"content": "Quoting https://bsky.app/profile/baldurbjarnason.com/post/3mgcpckb5qk27 :\n\n\u003e As \u003e [\u003e @\u003e davidgerard](https://circumstances.run/@davidgerard )\u003e has posted elsewhere, the maintainer of the library HarfBuzz has gone all-in on vibe-coding.\n\n(see: https://typo.social/@behdad/116172838540880597 )\n\n\u003e A note on why this is a worry in the thread -\u003e\n\n\u003e Fonts are a lucrative target. They require a complex parser, usually written in a language that isn't memory safe, and often directly exposed to outside data (websites, PDFs, etc. that contain fonts). This means a flaw could lead to an attack worst case scenario: arbitrary code execution\n\n\u003e HarfBuzz is pretty much the only full-featured library for that takes font files, parses them, and returns glyphs ready to render. It is ubiquitous. A security flaw in HarfBuzz could make a good portion of the world's user-facing software (i.e. that renders text) unsafe.\n\n\u003e Irrespective of the vibe-coding issue (code review is not an adequate defence against \"agent\" bugs) this is a piece of software that, due to its position in the industry, should be MORE conservative than the rest. Core infrastructure is not where you want experimentation",
"sig": "521c71a4675c94c3cfe092b982ae0d7c7cc6c1749db0af3d23e0d54572c741277ccb7b96e29dc446d376b43bd7b4c486c2c8215cc6e86ac97de900d99098a57c"
}