It's actually mildly worse than that. The hub sends an if-modified-since request and is happy to take a 304, so that's all an attacker would need to send. But it's not clear what it would be meaningfully able to do if an attacker just inserted 404s instead, so I suspect the answer remains "Don't lose control of your DNS"
Power management, mobile and firmware developer on Linux. Security developer at Aurora. Ex-biologist. mjg59 on Twitter. Content here should not be interpreted as the opinion of my employer. Also on Mastodon.
![[personal profile]](https://www.dreamwidth.org/img/silk/identity/user.png){kind=small}
no subject
Date: 2017-04-09 09:23 am (UTC)