3 ms·
Using math/rand seeded with a timestamp to generate crypto materials does not instill high confidence in the skills of the team. But their lack of interest in a
by jrpelkonen 3y ago
Using math/rand seeded with a timestamp to generate crypto materials does not instill high confidence in the skills of the team. But their lack of interest in addressing the issues raised here is perhaps even more worrying.
If I was a user of this plugin, I’d start looking for alternatives pronto.
- mholt 3y agoTo be clear, "the team" you refer to is one burnt-out developer (and not the Caddy maintainer team). Having been through burnout myself several times, I can understand the lack of response. I'm sure the project would benefit greatly if the community and companies who use it could bolster it up.
- lifthrasiir 3y agoI do feel the pain as well, but the OP specifically says "confirmed" (i.e. there indeed was a response) without no further qualification. If the plugin author did say the underlying reason, I believe the OP should have reproduced the reason as well because it's an even bigger security risk in my opinion.
- devwastaken 3y agoRipe for a PR.
- blinded 3y agoExactly!