News for hackers. Stuff that matters.

A comment on The most dangerous code in the world. Parent comment

Re:The most dangerous code in the world by kyberias on Thursday October 25, 2012 @12:22AM (#4696361)
This is definitely NOT a vulnerability in curl. I hate it when security people treat everything black and white. There ARE other things to consider.
[ Parent | on HN ]
Re:The most dangerous code in the world by tptacek on Thursday October 25, 2012 @12:36AM (#4696396)
Such as what? When VERIFYHOST=1, curl has basically turned the security part of SSL/TLS off. That seems like kind of a big deal for an HTTPS/SSL API.
[ Parent | on HN ]
Re:The most dangerous code in the world by wisty on Thursday October 25, 2012 @01:50AM (#4696539)
> I hate it when security people treat everything black and white.

That's because experience shows if things are "grey" then someone can almost certainly break in.

[ Parent | on HN ]