• Bene7rddso@feddit.de
    link
    fedilink
    arrow-up
    2
    ·
    8 months ago

    If you do examine what it’s doing you will catch this as soon as an attacker exploits it, and can disable it. Also, you should maybe not run the entire production with experimental features enabled. In a stable feature this would absolutely be a CVE, but this is marked experimental because it might not work right or even crash, like here

    • ysjet@lemmy.world
      link
      fedilink
      English
      arrow-up
      1
      ·
      8 months ago

      Correct, I agree you run it with an eye on it (which you should probably do anyway) instead of firing and forgetting (which, to nginx’s credit, is typically stable enough you can do that just fine).

      That said, nginx treats experimental as something you explicitly run in production- when they announced they added it into experimental they actually specifically say to run it in prod in an A/B setup.

      https://www.nginx.com/blog/our-roadmap-quic-http-3-support-nginx/

      • Bene7rddso@feddit.de
        link
        fedilink
        arrow-up
        2
        ·
        8 months ago

        If you run large‑scale Internet services,

        That means if you’re large enough that A can pick up the slack if B shits the bed. The only impact would be that you have to use HTTP2