On Tue, Sep 8, 2026 at 9:08 AM Ilija Tovilo <[email protected]> wrote:
> > As such I'd like to hear the opinions of Internals on if we can come to > a consensus (ideally without an RFC...) that registering callbacks that > mess around with state in non-intended ways is Undefined Behaviour (UB). > > I'd still very much be in favor of fixing these issues, mainly because > they are a big time sink for the security team as well, due to > false-positive reports. Arnaud and I were planning on proposing an RFC > that mitigates at least a large portion of them, before we got occupied > with other things. > That is absolutely the ideal fix for this class of issues. > > I absolutely do not think each case should be considered individually, > because we already tried this and the issues never stop coming. > True, but UB exists outside that class and those issues are worth the attention imho. -- Ilia Alshanetsky Technologist, CTO, Entrepreneur E: [email protected] T: @iliaa B: http://ilia.ws
