How should modules/distributions be handled when severe security issues are discovered?

[lizmat]

How should different groups (ecosystem, tooling, core, etc) handle insecure code that is being distributed through community / default channels?

What if there's a tool in the ecosystem that is subject to shell injection and thus running arbitrary code?

[lizmat]

@codesections said:

This is definitely something we should decide/address – I'm glad you opened this issue.

#229 might be a subset of this issue, in that (like the code execution method mentioned above) it's a security issue that arises out of the ecosystem and tooling rather than from a single package.

[lizmat]

@JJ said:

I would opt for retiring it from the ecosystem. I would say also that periodic static checking for know issues (or simply errors) would help find these issues (and others). Wait, I see what what you're saying is not really a tool that's distributed through the ecosystem, but a tool in the ecosystem. Fixing it would be a good start, I guess. If it's in the ecosystem, it's not that easy to fix, I guess. Static code analysis is not really something we can really do.