3 ms·
It seems to be a wordpress site, so you can geht the archive for a month like this https://www.zerotier.com/2021/06/ https://www.zerotier.com/2021/06/ That said
by m4lvin 5y ago
It seems to be a wordpress site, so you can geht the archive for a month like this https://www.zerotier.com/2021/06/ https://www.zerotier.com/2021/06/
That said, there is no blog post from June and there also was no release arouns that time: https://github.com/zerotier/ZeroTierOne/releases https://github.com/zerotier/ZeroTierOne/releases
- api 5y agoThe issue was fixed entirely on the root side. No release was necessary. It was a private disclosure and we fixed it within a few hours. No release is technically required now, but we have one coming that contains an endpoint-side mitigation that renders the attack and others like it impossible even if the root is misbehaving. A 1.6.6 patch release is currently being built as we speak and it will also be in 1.8, which is delayed to fix some issues with the new UI.
- testplzignore 5y agoWhy are there further mitigations being put in now, rather than this all being in place before the public disclosure?
- api 5y agoThe root fix renders this exact attack impossible with current nodes, but we think it's a good idea to close the gap in another way that renders this entire class of attacks impossible just in case someone figures out some other way to accomplish something similar. We found a way to do that so we are releasing it. I don't think security should be done by just playing whack a mole. You want to try to get ahead of it. If there's an opportunity to harden something, do it.