3 ms·
Nginx, the open source project, wasn't "safe". It was merged, released, came with documentation, and it had public use. I think that's all that matters. How el
by dns_snek 3y ago
Nginx, the open source project, wasn't "safe". It was merged, released, came with documentation, and it had public use.
I think that's all that matters. How else do you propose that users are informed about vulnerabilities in their installation? That's what CVEs are for.
- kuschku 3y agoWhether you develop new features on main gated by compile flags or on separate branches shouldn't have an effect on CVE assigments. I'm pretty sure that setting arbitrary compile flags is enough to cause vulnerabilities in most software. I personally ran nginx without this feature enabled because it was explicitly marked as experimental and potentially unsafe.