Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Tomcat switch should be disabled by default #13

Open
noullet opened this issue Sep 23, 2016 · 0 comments
Open

Tomcat switch should be disabled by default #13

noullet opened this issue Sep 23, 2016 · 0 comments

Comments

@noullet
Copy link

noullet commented Sep 23, 2016

I had the very bad surprise to find an undocumented Tomcat kill switch port:

This idea appears to come from the Tomcat plugin, which is fine for development but I fail to see any benefit outside of a development environment. Even if there is a valid use case, such feature should be clearly documented and opt-in in a potential "production" package, here it's not even opt-out and I don't see any mention of it anywhere.

Sorry if I sound a bit bitter, don't be mistaken I am very grateful for your work and amazing open source contributions but finding such a big longstanding security hole that could have been easily avoided (e.g. by simply not adding this feature) is quite frustrating.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant