@dalias It's a misconception that `goto`s must not be used. There are usecases - especially in C which lacks the 'defer' statement - where it's just needed to write non-awful code.
Another lesson I learned throughout my career: Don't write code that can be easily changed. You'll develop a mental model what changes you expect. Turns out, these are very rarely the changes you need to do. Instead write code that can be easily deleted.
@ska in my spare time, I'm preferring C because it's fun to me. If I'm being paid, I owe it my clients to not waste their money on debugging segfaults, weird posix edge cases and race conditions. Also I don't want to be paid to implement linked lists for the 100th time.
A thing I wasn't aware of: systemd switched to dlopen'ing compression libraries on demand, rendering the #xz attack useless with one of their next releases. That's why apparently the attackers tried to push distributions to include the new xz version on their stable releases before the mitigation in systemd was included.
@dalias utf8/16, fontrendering and terminal escape codes are my candidates for the next big security issues. They are widely considered simple and non-issues but are in fact complex beasts.
@ariadne chimera at least starts the stuff, that alpine failed to do. I don't know if it will succeed, as it is a small project, but I see steps in the right direction.