4 ms·
There is a whole class of security issues where fixes are worse that the issues themselves. Case in point, the OpenSSH itself that sends 100 packets on each key
by sam_lowry_ 3mo ago
There is a whole class of security issues where fixes are worse that the issues themselves. Case in point, the OpenSSH itself that sends 100 packets on each keystroke to avoid timing attacks.
- fragmede 3mo agoWhy is that worse than the issue itself? If someone could figure out, say, my root password via an ssh timing attack, that seems bad. Sending 100 packets for each keystroke to protect against this seems cheap in the face of that.
- sam_lowry_ 3mo agoBecause it breaks our mental model of how things work.
- skinfaxi 3mo agoOr it means it is time to update the model. Models need to change as the world they model changes, right?
- sam_lowry_ 3mo agoThe OpenBSD developers could have opted for a warning, like the one you see about post-quantum encryption when connecting to old servers. Instead, they just sneaked the change upon the world.
- eviks 3mo agoThe example doesn't seem worse, but more importantly - are these issues part of the class (and why)?