4 ms·
Isn't [1] (one of) the patches fixing the issue? The solution doesn't need to be a server patch, in fact it appears it was a client-side patch to handle 508 err
by cyphar 6y ago
Isn't [1] (one of) the patches fixing the issue? The solution doesn't need to be a server patch, in fact it appears it was a client-side patch to handle 508 errors properly as well as doing exponential backoff.
[1]: https://github.com/signalapp/Signal-Android/commit/c95f0fce6ee3b78ff82fde865b2ee49288e1303f https://github.com/signalapp/Signal-Android/commit/c95f0fce6...
- fsflover 6y agoDoes it mean that I can create a malicious client without that patch and break the server again?
- cyphar 6y agoThe reason it was a DDoS was that every single Android Signal client in the world was retrying the API without an exponential backoff. If you intentionally try to DDoS the API yourself, then that's just a DDoS and you don't need a custom Signal client for that.