Certificate Transparency Log Compromised via Salt Vulnerability

Re:Certificate Transparency Log Compromised via Salt Vulnera... by tialaramex on Sunday May 03, 2020 @11:20PM (#23064222)

I feel like the resident agent thing is the wrong focus.

Goofing RSA is a more troubling sign, because it means there probably isn't anybody who understands how this stuff works in the room where plans to use it are made, and that means there will be security bugs forever.

Presumably other people don't agree with me or else there wouldn't be important stuff running on Salt?

[ Parent | on HN ]

Re:Certificate Transparency Log Compromised via Salt Vulnera... by tptacek on Sunday May 03, 2020 @11:27PM (#23064267)

I don't even know if they still use the transport protocol they came up with. I remember more clearly the Red Hat security guy claiming, on the same Github issue thread, that e=3 RSA was dangerous because of GPUs, which is almost an equally fucky thing to say.

The agent thing, though, would squick me out almost no matter which team implemented it.

[ Parent | on HN ]