@joshbressers@infosec.exchange
Post #1590307
2026-04-12 16:10 UTC
@ancoghlan @hugovk @yossarian
In the case of a documented unsafe feature it’s a vulnerability in the caller
But I also think such features should be removed instead of just documented. Especially now as lots of developers are using an LLM and not reviewing the code
Replies (1)
-
@yossarian@infosec.exchange 2026-04-12 16:11
@joshbressers @ancoghlan @hugovk it gets tricky when it's something that's contextually secure, e.g. `http.server` is secure under my attacker model when I'm running it on localhost, and I like that Python has it. but I'm sure the CPython folks are very tired of getting vuln reports for it!