vulnerability

I have lost all trust in GitHub, and not because of the vulnerability, but because of their response.

Github should pay him for finding the vulnerability instead!

Is anyone else laughing at how ridiculous this vulnerability is?I just spent a few hours last week hacking through the Stripe CTF game.

Note to security response teams everywhere: Not all vulnerability reporters speak perfect English, nor are they all experienced in writing up details on how to exploit issues.

SNI operated the world's first commercial vulnerability research team, and had a very close relationship with Theo; we had a full time employee who had essentially led the first OpenBSD security audit.

This vulnerability can also be mitigated trivially by using bigger RSA keys, making the protocol Telegram-secure.

The CPU would be an obvious choice as well -- could there be some sequence of instructions that enables privilege escalation?On protocols, the best sort of vulnerability for the NSA would be the kind that is still somewhat difficult and expensive to exploit.

The student actually volunteered his free time to work with the school's IT department, he brought the vulnerability to the attention of the IT department, and only did what he did after bringing it to the attention of the IT department and they failed to take action.

Has anyone actually read the steps required to exploit this vulnerability?You do know that to be able to exploit it you have to know the application's secret key, so you can create your own malicious encrypted session cookie that includes hashes instead of strings for the auth token lookup?You do know that if someone has your app's secret key they can just write whatever they want into the session cookie, instantly compromising a large number of apps anyway?