4 ms·
Yes. Or more precisely, for a demonstration of how the bug can be exploited -- I'm not looking for something "weaponized". I think if someone manages to explo
by cperciva 11y ago
Yes. Or more precisely, for a demonstration of how the bug can be exploited -- I'm not looking for something "weaponized".
I think if someone manages to exploit this bug, the details will be very interesting, and I think it's worth paying for "interesting".
- tptacek 11y agoI also like the very public illustration of how not all memory corruption bugs are easily exploitable (or, occasionally, meaningfully exploitable at all). Also an illustration of how unlikely it is that serious exploit developers are going to spend time writing a complicated Tarsnap exploit. :)
- cperciva 11y agoYou may be right, but I hope people won't take away the message that bugs like this don't matter. Fix bugs! Update your systems! If in doubt, assume that potential vulnerabilities are exploitable!
- deleted 11y ago[deleted]
- aidenn0 11y agoMy takeaway has always been "It's easier to fix a memory corruption bug than it is to determine if the bug is exploitable"