News for hackers. Stuff that matters.

A comment on CVE-2023-40547 – avoid incorrectly trusting HTTP headers. Parent comment

Re:CVE-2023-40547 – avoid incorrectly trusting HTTP headers by baobun on Thursday January 25, 2024 @03:12PM (#39134555)
Not exactly. AshamedCaptain gets it. If the device can be configured to trust a user-supplied key instead of or in addition to Microsoft's, there is no need to provide any keys. This is up to the hardware supplier.

https://news.ycombinator.com/item?id=39134059

https://news.ycombinator.com/item?id=39133999

[ Parent | on HN ]
Re:CVE-2023-40547 – avoid incorrectly trusting HTTP headers by nailer on Friday January 26, 2024 @09:26AM (#39142929)
I did reply to this, but had to reply in my existing comment above due to the rate limit.
[ Parent | on HN ]