4 ms·
> It must be because if anyone abuses these issues, someone might wake up and care enough to fix them If anyone knows they are being abused, anyway. I conclude
by jrochkind1 2y ago
> It must be because if anyone abuses these issues, someone might wake up and care enough to fix them
If anyone knows they are being abused, anyway. I conclude that someone may be abusing them, but those doing so try to keep it unknown that they have done so, to preserve their access to the vulnerability.
- ChrisMarshallNY 2y agoDidn't Jon Postel do something like this, once? It was long ago, and I don't remember the details, but I do remember a lot of people having shit hemorrhages.
- iscoelho 2y agoCertificate Transparency exists to catch abuse like this. [1] Additionally, Google has pinned their certificates in Chrome and will alert via Certificate Transparency if unexpected certificates are found. [2] It is unlikely this has been abused without anyone noticing. With that said, it definitely can be, there is a window of time before it is noticed to cause damage, and there would be fallout and a "call to action" afterwards as a result. If only someone said something. [1] https://certificate.transparency.dev https://certificate.transparency.dev [2] https://github.com/chromium/chromium/blob/master/net/http/transport_security_state_static.json https://github.com/chromium/chromium/blob/master/net/http/tr...
- hinkley 2y agoIt’s like the crime numbers. If you’re good enough at embezzling nobody knows you embezzled. So what’s the real crime numbers? Nobody knows. And anyone who has an informed guess isn’t saying. A big company might discover millions are missing years after the fact and back date reports. But nobody is ever going to record those office supplies.