[Zope-Coders] FastCGI leaking Authorization header

[Shane Hathaway]

On Mon, 19 Aug 2002, Toby Dickenson wrote:

> On Monday 19 Aug 2002 4:07 pm, Casey Duncan wrote:
> > The point is that it is no more insecure then HTTP basic
> > auth itself which is the way many people authenticate over the web.
>
> So those 'many' dont need to install the hot fix! That doesnt make it
> any less important for administrators of a site that do use FastCGI,
> and who use Basic authentication in a secure manner.

Perhaps it's just a case of choosing the right words then.  We've released
a lot of hotfixes that were "highly recommended", when they really only
affected a few people, and didn't actually improve security much.  (The
folks over at Mandrake won't even look at Zope these days because of the
current perception.)

Can you think of a way to release a correction that wouldn't be
interpreted by people outside this community as "Zope is totally
insecure"?

Shane