On Tue, 31 Oct 2017, Ryan Schmidt wrote:
Today's curl (7.56.1) automatically enables the use of libidn2, unless
explicitly disabled via the --without-libidn2 configure flag.
Do I take this to mean that curl with libidn2 is not considered dangerous
anymore, and that it is now recommended for package maintainers to ship curl
with libidn2 support enabled by default?
Well yes. libidn2 was never vulnerable for this problem so once we added
support for that and dropped libidn, we could again support IDN fine in curl.
libidn2 is another library than libidn.
If so, is there a reason for us to give the user a way to disable that
support or should we just enable it all the time? (In MacPorts, we prefer to
limit user choices to the essentials; we don't expose every configure flag
just because it's there.)
No, there's no known security reason to avoid enabling libidn2 in curl builds.
For generic curl builds I would recommend building with it so that users can
use international domain names in URLs.
--
/ daniel.haxx.se
-------------------------------------------------------------------
Unsubscribe: https://cool.haxx.se/list/listinfo/curl-library
Etiquette: https://curl.haxx.se/mail/etiquette.html
