lemme show you 140,000 (!) places in code where certificate verification is switched off when using libcurl: https://github.com/search?q=CURLOPT_SSL_VERIFYPEER%2C+FALSE&type=code - ThreadSky

About ThreadSky

bagder.mastodon.social.ap.brid.gy • 24 days ago

lemme show you 140,000 (!) places in code where certificate verification is switched off when using libcurl: https://github.com/search?q=CURLOPT_SSL_VERIFYPEER%2C+FALSE&type=code

Comments

tbroyer.ltgt.net•23 days ago

And this misses those that set it to 0; 37 000 more of them: https://github.com/search?q=%22CURLOPT_SSL_VERIFYPEER%2C+0%22&type=code

jweiss.io•24 days ago

FWIW, I think it would be a good idea to deprecate `-k` too. It's too easily missed and I'd prefer if users had to type `--insecure-disable-peer-verification`. Seen too many scripts where a debugging `-k` was still in and it didn't scream loudly enough as it's just one letter...