3 ms·
Maybe, we don't know. I'm guessing that @agl can't respond in detail, because he's likely bound by whatever disclosure agreement the Chrome team entered into,
by moxie 15y ago
Maybe, we don't know. I'm guessing that @agl can't respond in detail, because he's likely bound by whatever disclosure agreement the Chrome team entered into, but he's a smart cookie and I'm inclined to trust his assessment.
I obviously have no way to know whether this is a big deal or not. These guys have a "proven track record" from the ASP.net thing, but remember that attack came after a number of less-than-earth-shattering releases from them around padding oracles in other circumstances.
- marshray 15y agoYeah. But something that might look like an insignificant corner case to a browser vendor might mean that your own SSL/TLS app is 100% pwned. These guys need to publish the details now. Let the baby be born and not try to prolong the delivery for their own personal reasons.
- aortega 15y ago> but remember that attack came after a number of less-than-earth-shattering releases from them around padding oracles in other circumstances. So, that attack is less valid because it was gradually developed. That phrase doesn't make any sense.