And by the way, the fact that I had to come out and make this explanation is *yet again* another example of the sorry state of tech security reporting, by both media and infosec folks themselves. Like every single article about this bug is wrong and makes no sense.https://twitter.com/marcan42/status/1217803207084134401 …
-
Prikaži ovu nit
-
I don't understand how everyone is falling into the trap of talking about "validating" ECC params or using the wrong ones or whatever, and completely handwaving the way this actually works. If you *think* about how this should work, it doesn't make sense.
1 reply 1 proslijeđeni tweet 8 korisnika označava da im se sviđaPrikaži ovu nit -
It just goes on to show that in the absence of detailed official information, people are perfectly happy to make up an explanation without never mind verifying it, but not even trying to see if it is consistent or reasonable! This is wrong.
4 proslijeđena tweeta 21 korisnik označava da mu se sviđaPrikaži ovu nit -
Odgovor korisniku/ci @marcan42
To me this is partially due to an interesting property of this bug: you don't need to know *exactly* what goes wrong in order to produce a (kind of) working exploit. Oh, and people love talking about seemingly cool textbook crypto instead of software engineering (bad) practices.
1 reply 0 proslijeđenih tweetova 6 korisnika označava da im se sviđa
Yeah, it's a lot more impressive to talk about how you can use a quirk of ECC math (even though it literally involves no math, just copying a value from A to B) than to talk about how MS messed up the moral equivalent of an .equals method.
Čini se da učitavanje traje već neko vrijeme.
Twitter je možda preopterećen ili ima kratkotrajnih poteškoća u radu. Pokušajte ponovno ili potražite dodatne informacije u odjeljku Status Twittera.