4 ms·
Except that, according to Microsoft, this change had absolutely nothing to do with the report, which they still consider to be not-a-vulnerability.
by chias 11y ago
Except that, according to Microsoft, this change had absolutely nothing to do with the report, which they still consider to be not-a-vulnerability.
- addicted 11y agoMaybe I'm missing something, but if the URL shortening feature doesn't exist anymore, how can it be a vulnerability? Edit: The issue would be with existing links, but it's difficult to change existing links for obvious reasons. Both MS And Google at this point have calculated that deleting existing vulnerable links would be worse than the security issues presented here.
- ignoramous 11y agoTo give them the benefit of the doubt, what they could have meant was that it was an onerous feature that swapped privacy for convenience. Besides, scanning of URLs should be prevented by bit.ly in this case, no? What's MSFT to do?