oss-sec mailing list archives

Re: Thoughts on Shellshock and beyond


From: ArkanoiD <ark () eltex net>
Date: Wed, 8 Oct 2014 20:03:37 -0700

I think there was one and simple way to prevent heartbleed, renegotiation
bugs etc altogether: STOP inventing and enabling by default useless "cool"
features. Leave TLS functionality alone, it is overengineered enough
already. If you think it would be "cool" to teach it a few new tricks, make
it disabled by default for users who never need it.

Current thread: