[tor-talk] Cancelled black hat talk

Wed Jul 30 22:05:20 UTC 2014

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

>> I think I have a handle on what they did, and how to fix it.
>> We've been trying to find delicate ways to explain that we think
>> we know what they did, but also it sure would have been smoother
>> if they'd opted to tell us everything. The main reason for trying
>> to be delicate is that I don't want to discourage future
>> researchers from telling us about neat things that they find. I'm
>> currently waiting for them to answer their mail so I can
>> proceed.
> 
> I have timed out on them and put out two new releases plus a
> security advisory: 
> https://blog.torproject.org/blog/tor-security-advisory-relay-early-traffic-confirmation-attack

thanks!

Surprised
> 
to see the fix of a bug that was worth a tor security
advisory to be in the "Minor bugfixes" section of the changelog.

> o Minor bugfixes: - Warn and drop the circuit if we receive an
> inbound 'relay early' cell. Those used to be normal to receive on
> hidden service circuits due to bug 1038, but the buggy Tor versions
> are long gone from the network so we can afford to resume watching
> for them. Resolves the rest of bug 1038; bugfix on 0.2.1.19.

So I guess "Minor bugfixes" can have quiet an impact as well then.
Will watch 'minor bugfixes' closer in the future ;)