|
@marcan42 | |||||
|
It just goes on to show that in the absence of detailed official information, people are perfectly happy to make up an explanation without never mind verifying it, but not even trying to see if it is consistent or reasonable!
This is wrong.
|
||||||
|
||||||
|
|
Hector Martin
@marcan42
|
17. sij |
|
And by the way, the fact that I had to come out and make this explanation is *yet again* another example of the sorry state of tech security reporting, by both media and infosec folks themselves.
Like every single article about this bug is wrong and makes no sense. twitter.com/marcan42/statu…
|
||
|
||
|
|
Hector Martin
@marcan42
|
17. sij |
|
I don't understand how everyone is falling into the trap of talking about "validating" ECC params or using the wrong ones or whatever, and completely handwaving the way this actually works. If you *think* about how this should work, it doesn't make sense.
|
||
|
|
||
|
Riatre
@_riatre
|
17. sij |
|
To me this is partially due to an interesting property of this bug: you don't need to know *exactly* what goes wrong in order to produce a (kind of) working exploit. Oh, and people love talking about seemingly cool textbook crypto instead of software engineering (bad) practices.
|
||
|
|
||
|
|
Hector Martin
@marcan42
|
17. sij |
|
Yeah, it's a lot more impressive to talk about how you can use a quirk of ECC math (even though it literally involves no math, just copying a value from A to B) than to talk about how MS messed up the moral equivalent of an .equals method.
|
||
|
|
||
|
Nyaa
@nyanotech
|
17. sij |
|
I'm still annoyed at how one of the early Spectre reports said "vm" (virtual memory) and everyone assumed it meant virtual machine
|
||
|
|
||
|
qwertymodo
@qwertymodo
|
17. sij |
|
File a CVE against HumanOS: In the absence of trusted roots, incoming information in incorrectly validated against *any* matching source. The failure is easily exploitable, and self-perpetuating.
|
||
|
|
||
|
TJ
@TJ_928374
|
21. sij |
|
Sounds like you're describing every binary analysis and DRM discussion ever
|
||
|
|
||