6 ms·
That is like saying you can't get a virus on your computer because Facebook doesn't allow viruses to be posted to the internet. Differential parsing is a whole
by dsl 3mo ago
That is like saying you can't get a virus on your computer because Facebook doesn't allow viruses to be posted to the internet.
Differential parsing is a whole class of security bugs and they matter a lot. Take a look at HTTP Request Smuggling for examples.
Also, I am pretty sure there are more non-web x509 certificates out there than all the "browser trusted CAs" combined have signed. :)
- woodruffw 3mo agoTo be clear, the differential here occurs because OpenSSL does the wrong thing. Go is correct to fail closed here, and it’s very hard to imagine a setting in which Go failing closed is a relevant security differential.
- briansmith 3mo agoJust to be clear, OpenSSL isn't doing the wrong thing, based on the description in the blog post. The specification allows and even requires behavior similar to that.
- briansmith 3mo agoIf differential parsing of X.509 certificates is a material security concern for something, then that's a bug in that thing.