In message <[email protected]>, Artur Bergman writes:
>> They contacted me up front, I told them we don't consider it a security >> problem, because Varnish has to trust the backend being sensible. >> >> We'd be just as hosed if the backend started sending only 1TB objects. > >Thank you for that very pragmatic and mature view of the world. I didn't say I don't consider those issues problems, I do, I just don't consider them security problems. I do realize that Fastly's usage of Varnish is different from pretty much everybody else in the world, but that is a risk Fastly has chosen to take and the consequences are theirs to bear. -- Poul-Henning Kamp | UNIX since Zilog Zeus 3.20 [email protected] | TCP/IP since RFC 956 FreeBSD committer | BSD since 4.3-tahoe Never attribute to malice what can adequately be explained by incompetence. _______________________________________________ varnish-dev mailing list [email protected] https://www.varnish-cache.org/lists/mailman/listinfo/varnish-dev
