Home | Notifications | New Note | Local | Federated | Search | Logout

Note Detail

Reply to @sun@shitposter.world
Only 3 Easy Payments of $19.95@feld@friedcheese.us (2026-09-24 09:01:03)
@sun @icedquinn @anemone @romin it's not like Debian or RHEL have ever fucked up something like that before

I know somewhere in the hall of shame is a completely new CVE caused by Debian trying to backport an Apache CVE fix and they did it wrong
---Reply---
Q.U.I.N.N.@icedquinn@blob.cat (2026-09-24 09:03:35)
@feld @anemone @romin @sun i feel like something like heartbleed is a very different story to "auth=none."

the JWT style breaches are so absolutely catastrophically bad in that they are so well documented that literally just asking claude to look at your code would have probably gotten you slapped. it's a special kind of incompetence.

---Replies---

Q.U.I.N.N.@icedquinn@blob.cat (2026-09-24 09:06:15)
@feld @anemone @romin @sun that being said when i read about ECC crypto i think djb had a comment that a common newbie failure is not checking points on the curve first. the whole point of the curvesafe stuff was to find ones that were hard to scuff. since ECC contains many curves, and its easy to forget to check a point in a domain somewhere, and this is one of those pwns that can even just legitimately be a simple mistake at 4am.

the part thats bonkers is they're using frameworks that already do all this for you. :blobcatwaitwhat: they correctly didn't roll their own, but they still just. failed to bother to put the data in the saltpack box in the first place.

i dunno how you even use libsodium wrong like this. it's hard to do. its specifically designed so you can't fuck it up. :cirno_for_reals: