Re: Retrospective by 'gpg.fail' authors
oss-security follow-up to a gpg.fail authors' retrospective argues that GnuPG's unmaintained, forgotten code is a security liability and should be deleted.
On the oss-security mailing list, Soatok Dreamseeker responds to a retrospective published by the gpg.fail authors, asking why unmaintained code is retained and stating that forgotten, unmaintained code is a liability and effectively unmaintained by definition. The visible reply addresses Werner Koch and concerns GnuPG code maintenance. No specific CVE, flaw, or exploitation is described in this snippet.
- Reply to a retrospective by the gpg.fail authors on oss-security
- Commenter urges deleting unmaintained GnuPG code as a security liability
- No concrete CVE or flaw detailed in this thread message
- Vendors
- GnuPG
From the original article
Posted by Soatok Dreamseeker on Sep 16 Hi Werner, So... why not delete it? Unmaintained code is a liability (and, categorically, forgotten about code is not being maintained).
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.