Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 3 May 2023 22:40:30 +0200
From: Moritz Bechler <>
Subject: Re: Perl's HTTP::Tiny has insecure TLS cert default,
 affecting and other modules


> A default is not a vulnerability.  There are reasons why defaults cannot 
> be changed in libraries once they are stable.  This is also why 
> documentation exists.
> Revoke these CVEs, it's a stain on the process.

while one may criticize that CVEs have been assigned both for the 
insecure default and (some of the) insecure usages, at least one of 
these is a legitimate case, in terms of CVEs likely the latter. And when 
it comes to defaming projects, at least in my book, choosing, keeping 
and defending bad defaults speaks to much more than a CVE being assigned.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.