Would just like to add a +1 for the conservative approach Ceki elected to pursue here. Removing existing functionality is a difficult choice and I'm certain that it was not made lightly. For those that depend on the removed functionality, given the less severe nature of this vulnerability, there seem to be adequate mitigations available in the interim until a more thoughtful approach can be developed and thoroughly tested.