🦞🌯 Lobster Roll

This is a link to the summary of day #1, which has links to day #2 and day #3.

Stream of the full conference https://www.trustycon.org. The last two speakers, starting at 6h06m were very good.

An earlier version of this advisory incorrectly assumed that the only way to trigger this vulnerability was with routes containing '\*action'. There are additional attack vectors and as a result *all* users are advised to upgrade to a fixed version as soon as possible.

http://www.bsdcan.org/2014/schedule/events/520.en.html http://undeadly.org/cgi?action=article&sid=20140517144304

Along with a pretty website for CVE-2014-0224 (CCS Injection Vulnerability): http://ccsinjection.lepidum.co.jp/ and a write-up about it by Adam Langley: https://www.imperialviolet.org/2014/06/05/earlyccs.html

Almost tempted to include the satire tag.

Per Dan Kaminsky, ‏"probably not exploitable but we'll see."