3 ms·
There is no "refusal" as far as I can tell. The issues were reported [1] in September 2023 (as was this blog post) and the simplest one has been fixed (insecure
by tadfisher 3y ago
There is no "refusal" as far as I can tell. The issues were reported [1] in September 2023 (as was this blog post) and the simplest one has been fixed (insecure random seed). I'm not aware of any public statements from the plugin maintainers, and there is no hostility in the issue comments.
[1]: https://github.com/greenpau/caddy-security/issues?q=is%3Aissue+label%3Asecurity+ https://github.com/greenpau/caddy-security/issues?q=is%3Aiss...
- b112 3y agoIf there isn't a refusal, fair enough. Yet leaving high impact, publicly disclosed security issues unresolved for 6 months means the code is abandoned. I'll consoder stable code fine without new releases for years even, but security issues? Responses and fixes need to be measured in days, not months. (Some may say "but what about"..., and note all rhe conditions I listed above. Publicly disclosed + timefame. Doesn't matter who it is, big or small, 6 months means the software maintainers show no serious commitment to security, and one should run to other solutions.)
- blinded 3y agoPRed welcomed