2 ms·
This is definitely NOT a vulnerability in curl. I hate it when security people treat everything black and white. There ARE other things to consider.
by kyberias 14y ago
This is definitely NOT a vulnerability in curl. I hate it when security people treat everything black and white. There ARE other things to consider.
- tptacek 14y agoSuch as what? When VERIFYHOST=1, curl has basically turned the security part of SSL/TLS off. That seems like kind of a big deal for an HTTPS/SSL API.
- wisty 14y ago> I hate it when security people treat everything black and white. That's because experience shows if things are "grey" then someone can almost certainly break in.