I literally know them in person. It's a guy. They have a signal and an email right there, you can message them and talk it's not that deep

Can you tell them that they're acting recklessly here then?

Are they, though? I seriously doubt some sysadmin is going to look at this and say "Maintainers said to patch, but clearly _this guy_ knows better, so I won't."

Besides, he's got a point. The initial PoC that kept popping up on Mastodon (the ones he linked in the post as well) simply didn't work. One of them even posted an updated exploit later that still didn't work, but supposedly meant the vulnerability went from CVSS 10 to CVSS 4.

I know someone who hacked his own site using the exploit and managed to obtain a database dump.

Well, tell him from me, he'll probably regret writing the article when he reaches his thirties.

One of the reasons is high resilience, practically state of the art as far as writing to a single storage device allows. You're less likely to end up with corrupted files with sqlite. This is much more difficult to get right when manipulating files yourself than you might think.

For your consideration (I'll add that I used to think similarly as you, and I still wouldn't use sqlite for everything, but it's shockingly effective):

https://www.sqlite.org/transactional.html

https://www.sqlite.org/fasterthanfs.html

https://www.sqlite.org/atomiccommit.html

https://www.sqlite.org/aff_short.html

https://www.sqlite.org/testing.html

https://danluu.com/file-consistency/

This library is great, and recently saved a project of mine. Figuring out what was going on with some of python's sqlite3 quirks was too much of a hassle, meanwhile this more or less just worked the way I expected it to. Because of this experience I started defaulting to it over sqlite3 for other projects as well.

(This documentation page explains the library's intent: https://rogerbinns.github.io/apsw/pysqlite.html)

what quirks did you bump into with sqlite3?

I don't recall exactly, other than having a hard time making sense of the transaction management.

You might want to note that "this particular user" is "extremely active" on this website.

(Nothing against it, I'm always happy to hear what Thomas has to say)

Apologies, you're probably right, I don't post much on HN so I don't really know the regulars.

Disappointed at the lack of replies here, I've had a similar thought before and I'd be curious to hear about the technical viability of this

This was done in the past[1] and was widely regarded as a "cryptojacking" scheme serving "malicious" content to users.

[1] https://krebsonsecurity.com/2018/03/who-and-what-is-coinhive...

If it was for profit. Here it's in response to abuse by AI companies.