1
OpenSSL bug exposed up to 255 bytes of client heap and existed since 2011
Silently sends up to 255 bytes of the client's heap to the server . The server must support NPN , and the heap data is encrypted in transit.
Joe Birr-Pixton
What do I mean by that? Well, I view GHA runners as public, unsecured shell boxes that I can run scripts on. They can check out and build public code, but at no point should they be given any kind of privileges or secrets.
- Popular posts
- 2
- Total points
- 258
- HN comments
- 63
- Rank
- #10,269 personal
Visit jbp.io → RSS feedOn Hacker News Jun 2020 – Jul 2024
2
Third-Party Audit of Rustls
In May and June 2020, Cure53 completed an audit of ring , webpki , and rustls . Their report ( PDF ) fully describes the audit, and makes for interesting reading.