> Apparently it's crazy to think that your configuration files shouldn't be issuing HTTP requests. Depends on what language runtime can do with those responses

> Apparently it's crazy to think that your configuration files shouldn't be issuing HTTP requests. Depends on what language runtime can do with those responses. Arbitrary code execution in a config (a la Django settings and indeed OP’s idea) can do much more damage, but even that doesn’t scare many people as this kind of configuration is considered an inherently trusted source.