It only solves the exploit path, not the vulnerability. The true issue is that t... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

subwindow on Dec 29, 2011 | parent | context | favorite | on: Supercolliding a PHP array (inserting 65536 elemen...

It only solves the exploit path, not the vulnerability.

The true issue is that their hashing algorithm sucks. Any patch that doesn't fix the hashing algorithm is a band-aid and not a true fix.

nikic on Dec 30, 2011 [–]

It is somewhat risky to fundamentally change the hashing algorithm late in the release cycle (RC4). It is bound to cause problems. The ini-Option prevents the obvious threat without doing deep changes to the core.

Consider applying for YC's Winter 2027 batch! Applications are open till November 2.
Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact