‹ BackHN Continuity

Thread

Xray-core concealed a certificate verification bypass vulnerability

83 points · 11 comments · timbill

  1. eriwang915 · · focus · HN ↗
    Xray-core's pinnedPeerCertSha256 treated an inserted leaf as the pinned cert, and the fix commit never called it a vulnerability.
    1. LoganDark · · focus · HN ↗
      Your LLM left out the clear hypocrisy and the part where the fixed version still had a vulnerability
      1. ddtaylor · · focus · HN ↗
        His comment actually added value, but yours doesn't seem to have the same value.
Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.