3 ms·

A bit more[1] on consequences of this attack, gist from the same author. [1] https://gist.github.com/rjhansen/f716c3ff4a7068b50f2d8896e54e4b7e https://gist.git

• ComodoHacker 7y ago
  Wow, there's much more: >Special criticism goes to the Electronic Frontier Foundation, which paid Micah Lee to publish premade attack tools to exploit these design misfeatures in the keyserver network ... >January of last year — January 16, 2018 — one user threatened to do what pretty much happened this week.
• Forbo 7y ago
  This seems a bit "shoot the messenger" to me. If anything I think those efforts should be applauded as the signal flares they are: "this is broken and it's only a matter of time until it has real world consequences".
  • alasdair_ 7y ago
    Seriously. The original post states at least three times they knew about the issue for over a decade. At what point does "full disclosure" become valid if not after over a decade of warning?
    • roywiggins 7y ago
      The fact that the chosen keys in this attack were not Mozilla or whoever and instead maintainers suggests to me that this "attack" is someone who, having seen this vulnerability left unresolved for a decade, decided to force the issue before someone used it for really nefarious purposes. It's a black hat solution and not a nice thing to do at all. It's probably the wrong thing to do. But, is this really worse than waiting for someone to use this in earnest? I'm not sure.