3 ms·
> An ini setting seems like a terrible and incomplete fix to the problem. Why? It solves the problem entirely.
by maratd 15y ago
> An ini setting seems like a terrible and incomplete fix to the problem.
Why? It solves the problem entirely.
- subwindow 15y agoIt only solves the exploit path, not the vulnerability. The true issue is that their hashing algorithm sucks. Any patch that doesn't fix the hashing algorithm is a band-aid and not a true fix.
- nikic 15y agoIt is somewhat risky to fundamentally change the hashing algorithm late in the release cycle (RC4). It is bound to cause problems. The ini-Option prevents the obvious threat without doing deep changes to the core.