Ævar Arnfjörð Bjarmason <avarab@xxxxxxxxx> writes: > The receive.fsckObjects variable only kicks in when someone pushes to > you, not when you fetch something malicious and someone then fetches > from you. > ... Yes, that is what was described in the release notes as the server side support. If you want to avoid fetching from contaminated sources, that protection applies to both leaf clients and intermediate relays, and I tend to agree that it is worth helping those who want to use fetch.fsckObjects (or the blanket transfer.* variant) the same way. > Unlike documentation, when we change something in the code we're forced > to take notice that the test suite changes, ... But then the test you want to have is not the one you posted, which is "when disabled, the feature should not kick in and should not protect you". That, even together with hot-sounding word "exploit" in the title, does not have enough sensational value to grab people's attension as you seem to be hoping to do here. A test that checks "when enabled, the feature kicks in as expected and protects you" does make sense. So is (maybe) additional description around fetch.fsckObjects if we currently lack one.
