<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><blockquote type="cite">. The design is just plain wrong.</blockquote><div><br></div>Is that statement the benefit of hindsight knowledge, or do you have a more intelligent thought process behind it? (I can imagine the all-knowing smirk in the background, but I'd really like to know :-)<div><br></div><div>- DM</div><div><br><div><div>On Apr 23, 2014, at 01:06 AM, Max Rottenkolber <<a href="mailto:max@mr.gy">max@mr.gy</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><blockquote type="cite">From what I understand about the bug (I have not seen the code) it sounds<br></blockquote>like data length information<br><blockquote type="cite">arrived both directly and indirectly in the client message and that a<br></blockquote>conflict between them was not<br><blockquote type="cite">scrutinized. <br></blockquote><br>No. The bug was that the keep alive protocol in SSL mandates the server to<br>echo arbitrary data back to the client. The bounds checks were wrong too,<br>but at that stage it really doesn't matter. The design is just plain wrong.<br><br><br><br>_______________________________________________<br>pro mailing list<br><a href="mailto:pro@common-lisp.net">pro@common-lisp.net</a><br>http://common-lisp.net/cgi-bin/mailman/listinfo/pro<br><br></blockquote></div><br><div apple-content-edited="true">
<span class="Apple-style-span" style="border-collapse: separate; font-family: Helvetica; border-spacing: 0px;"><div>Dr. David McClain</div><div><a href="mailto:dbm@refined-audiometrics.com">dbm@refined-audiometrics.com</a></div><div><br></div></span><br class="Apple-interchange-newline">
</div>
<br></div></body></html>