Embed Notice

Don’t just take my word for it; the Chromium project makes this pretty clear with their “rule of 2”. Pick no more than two of:

- code which processes untrustworthy inputs
- code written in an unsafe language
- code which runs with no sandbox

The inputs and outputs to programs are typically fixed to the domain and cannot be changed. Meaning: if C++ code cannot be replaced with a memory-safe language, and cannot be rewritten to be memory-safe, the only remaining option is to sandbox it.