I honestly thought there would be some elaborate chain there, not "we forgot to use encryption"...
pixl97•25m ago
Honestly issues like this crop up pretty commonly. JWT alg:none for example. Or even older people forcing SSL to downgrade to encryption null.
In any system that provides security it should only be designed to run if the security is in use, and to fail immediately with no further action if the security is not used.
Velocifyer•20m ago
My main wish is if radicle had a way to make issues online, without installing the software. Runing a piece of software is a high barrier of entry to make a bug report, which the entire reason I use codeberg instead.
john_strinlai•8m ago
>This was reported to us by Konstantinos Maninakis on 2026-06-24.
announcement 3 months later is not super great, considering that the current advice is "Stop using private repositories (over the network) until the security update is released."
Tiberium•28m ago
pixl97•25m ago
In any system that provides security it should only be designed to run if the security is in use, and to fail immediately with no further action if the security is not used.