3 ms·
It only solves the exploit path, not the vulnerability. The true issue is that their hashing algorithm sucks. Any patch that doesn't fix the hashing algorithm
by subwindow 15y ago
It only solves the exploit path, not the vulnerability.
The true issue is that their hashing algorithm sucks. Any patch that doesn't fix the hashing algorithm is a band-aid and not a true fix.
- nikic 15y agoIt is somewhat risky to fundamentally change the hashing algorithm late in the release cycle (RC4). It is bound to cause problems. The ini-Option prevents the obvious threat without doing deep changes to the core.