Oh sorry, that might have been projecting - it’s what I want to believe.

That’s true. If they’re not, though, or if they’re easy to generate yourself, then you are kinda forced to pay attention though, if you care about the security of your project.

I don’t have the expertise or experience to say whether that is true. But GregKH seems to think so, and other prolific projects seem to be coming to the same conclusions.

I get that it’s attractive to think that AI isn’t capable of it. But it’s important that what you believe to be true is, and stays, based on reality rather than on what I wish is true. And it’s especially important to be wary of when you really want something to be true.

If these tools are indeed finding security issues, then ignoring them means someone else will find those issues - and abuse them.

It’s not so much that they’re blocking it, as it is that they’re not implementing it. In GNOME, as I understand it, the Emoji picker is implemented by the toolkit (GTK). That means that apps that don’t (fully) use that toolkit, such as Chrome and Firefox, will need to add the implementation themselves. That is now done for Firefox.

Yes, but that didn’t work in Firefox before this change. The whole point of this change is to make that work in Firefox as well. (Likewise, it still doesn’t work in Chrome, Chrome-based browsers, and Electron apps.)

So the situation in which this makes sense is when you’re using Gnome.

What would it mean for you to call it yourself? This change is just so that if you press Ctrl+. in Firefox, the native emoji picker shows up, so at least in that sense you’re invoking it yourself? (Before this change, Ctrl+. would do nothing in Firefox, even though it would show the emoji picker in normal GTK applications.)