> pete uses some kind of mutant brocoli for a computer.
"Compiling your OS from open source components is lame, your entire computer sucks."
The xz vulnerability should have cured you of this.
Anyway, this is a regular Linux machine, and everything on it (except for a walled-off region) came from acquiring and building the code. I don't install things that are suspect, like new meme formats or anything written by Google. Video codecs in particular are full of holes and they come and go and are forgotten: it's not worth caring about video codecs that haven't ended up in firmware on a set-top box (as the format can be expected to survive once that happens).
> Everyone always calls me crazy when I blow off new meme formats but shit like this happens way less frequently in older projects: bugs have been worked out, the formats are stable, and someone that has been running a project for 20 years is less likely to let dumb shit like this happen. (I have updated libwebp but I still have image.webp.enabled=false in Firefox.) A new stupid thing happens, it's all "CHANGE TO THIS NEW RETARDED FORMAT NOW" and almost overnight, everyone's distributing their tarballs in .xz.
You might also recall the "Update liblzma to new version ASAP! Old version sucks!" sockpuppets in Debian and Fedora discussions. This is a bad idea. The "USE NEW MEME FORMAT, OLD MAN" refrain was obviously unwise from the beginning, but after that vulnerability and the analysis of the vector and the way the compromise spread by people chanting "NEW VERSION NEW VERSION NEW VERSION", the thing you are saying has moved from "obviously unwise" to "demonstrably pernicious, with very recent examples of why that is the case, what the eff are you doing". xz_meme_formats.png