The SMPY page is essentially an annotated bibliography: fulltext + abstract + commentary. Since the papers are of highly varied quality, it doesn't much make sense to try to put any particular confidence on it; I am convinced of some things, but definitely not others - particularly the early papers when they had little data and were still experimenting a lot. If I had an essay making a specific claim about SMPY then sure, but I don't really.
The fact that 'certainty' ratings don't make sense for pages like that is part of why these days, I wouldn't have a page like that at all. An annotated bibliography is not an 'essay' and shouldn't be shoehorned into my framework meant for that kind of opinionated writing. I realized that if I was going to 'annotate' a paper, I would either have to go without, or copy-paste it all around indefinitely and it'd violate DRY and be a nightmare. Long story short, https://gwern.net/doc/iq/high/smpy/index is closer to what that page should be, but it's a lot of work to sit down and convert the legacy page over to pure annotations, so, it is what it is. Maybe a LLM can do it for me soon - it seems within the ability of Claude Code.
Thank you! I've read much of the page now and it is fascinating.
I'm being facetious of course, but this recent rhetorical trend of people confidently vouching for "pet" in "pet vs. cattle" is not a sustainable decision, even if it's admittedly plain practical on the short to medium run, or in given contexts even longer. It's just a dangerous and irresponsible lesson to blindly repeat I think.
Change happens. Evidently, while we can mechanistically rule out several classes of bugs now, RCEs are not one of those. Whatever additional guardrails they had in place, they failed to catch this *. I think it's significantly more honest to place the blame there if anywhere. If they can introduce an RCE to Notepad *, you can be confident they're introducing RCEs left and right to other components too **. With some additional contextual weighting of course.
* Small note on this specific CVE though: to the extent I looked into it [0], I'm not sure I find it reasonable to classify it as an RCE. It was a UX hiccup, the software was working as intended, the intention was just... maybe not quite wise enough.
** Under the interpretation that this was an RCE, which I question.
[0] https://www.zerodayinitiative.com/blog/2026/2/19/cve-2026-20...