[angelbob]

I'm hoping there's an easy way to turn this off for the foreseeable future, to avoid all the obvious security holes this is likely to introduce.

[dvirsky]

You don't have to use it, and you should not use modules you don't trust.

[angelbob]

In an ops-type capacity, I support developers. I keep up with news like this specifically to avoid winding up with modules somebody else trusts, but didn't inspect.

[dvirsky]

What would be a must and should probably be a default, is not allowing to load modules using the network API, only via config file.