Look, some attacks are just going over the RFC, finding each MUST in the text (or MUST NOT or a SHOULD that really should have been a MUST, etc.), understanding

Look, some attacks are just going over the RFC, finding each MUST in the text (or MUST NOT or a SHOULD that really should have been a MUST, etc.), understanding that this "MUST" means (usually) a requirement for the presence of an "if" statement in the code [1], and then looking for that if statement in the code. If it is possible to interoperate with real world endpoints (basically Apache on openssl 1.0.2 and IIS on SChannel on latest Windows for servers, Chrome and MSIE as clients) with a codebase that lacks that if statement, someone has deployed in production a codebase that lacks this if statement. So unless someone already found it (that someone is probably Hanno Böck), you're going to be the first to find it. Now you can look for protocols that use the same construction as other protocols but did not copy-paste the MUST sentence. If the spec forgot to say the MUST sentence, you're going to find many more implementations that lack the corresponding if statement. 1 - instead of an if statement, sometimes it means "fill this buffer by reading X bytes from /dev/urandom" but the code just does memset with 0.