[prev in list] [next in list] [prev in thread] [next in thread] 

List:       oss-security
Subject:    Re: [oss-security] Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modu
From:       Moritz Bechler <mbechler () eenterphace ! org>
Date:       2023-05-03 20:40:30
Message-ID: 336b0af3-572e-b601-a856-b09d0930d40e () eenterphace ! org
[Download RAW message or body]

Hi,

> 
> A default is not a vulnerability.  There are reasons why defaults cannot 
> be changed in libraries once they are stable.  This is also why 
> documentation exists.
> 
> Revoke these CVEs, it's a stain on the process.


while one may criticize that CVEs have been assigned both for the 
insecure default and (some of the) insecure usages, at least one of 
these is a legitimate case, in terms of CVEs likely the latter. And when 
it comes to defaming projects, at least in my book, choosing, keeping 
and defending bad defaults speaks to much more than a CVE being assigned.


Moritz
[prev in list] [next in list] [prev in thread] [next in thread]