Hector Martin

The PGP vector is bad enough.

Also: let me be clear. “I can fully decrypt your encrypted PGP emails with almost no user interaction” is not FUD. If you doubt the vuln exists, say so. But don’t say it’s not extremely serious for a crypto vuln.

"I can fully decrypt your encrypted PGP emails with almost no user interaction" is FUD. "I can fully decrypt your encrypted PGP emails if I can guess some plaintext and the zlib stars align and you enable HTML and and you're running outdated TB and Enigmail and blah blah" isn't.

1. You can almost always guess some plaintext. That’s a key point of the paper. 2. Zlib is tough but it’s 1/3 not 1/100,000. Not a huge ask. 3. By outdated, do you mean “a version that was current for the past N years prior to this disclosure” because duh.

The EFF said “disable or uninstall plugins until there’s a patch”. That’s pretty straightforward advice. Not panic.

Except there had been a patch for months already.

That seems on the EFF. But I saw some threads from 5/14 re: Enigmail saying that some modes were still vulnerable. So I’m a bit skeptical about this.

No, mostly it's on the researchers, who seemed to be completely lost as to what was being mitigated when and where, and who were entirely responsible for feeding the info to the EFF as far as I can tell (and on the EFF for buying it).