3 ms·
Regardless of what the "cause" of this is (ie bug or bad design), it's obvious nobody even took a look at this after it was coded up and merged in. The larger p
by mrguyorama 2y ago
Regardless of what the "cause" of this is (ie bug or bad design), it's obvious nobody even took a look at this after it was coded up and merged in. The larger packets and double server ACKs are very clearly obviously giving the game away. This feature just doesn't even come close to what it supposedly does, was it even shipped as a feature or something that wasn't yet done?
Not exactly encouraging, to see a system so integral to security seemingly shipping code without even a minor test of intended function.
- tedunangst 2y agoI think it's worth asking how important the feature is in the grand scheme of things. But what about the CIA timing my keystrokes is more of a nerd forum thing than an actual attack vector you read about in intrusion post mortems.
- talkin 2y agoWell, or it is important, and then you add the countermeasures. These countermeasures are quite easy to mess up, so doing the validation (on an ongoing basis!) MUST be part of the deal. Or if you think it’s not important enough to do those assertions in CI, then it might be better to just reject the obfuscation attempts. There’s no middleground: doing the implementation without checks, means you added complexity, you dont know if security improved (or worsened!), and the the release note might come down to a false sense of security.