bbs#295 China for example ?
It's just few IPs on a known port. It's trivial to block.
now if the cloud providers ran it on every of their internet facing load balancers so you could use any of their IPs for DNS maybe it would be more effective, but as it is, it is entirely trivial to block it.
We actually did it for corporate network for entirely different reason, we just have a bunch of internal-only DNS zones and want browser to use that.
Xray-core's own cert bypass flaw 🤦♀️
Xray-core's `pinnedPeerCertSha256` option had a certificate verification bypass vulnerability.
They condemn skipping verification, then built a feature that did exactly that.
6 likes
Monday audit: search your repo for security-adjacent commits with vague messages in the last 12 months. If you find one, write the advisory you should have published. Late beats never.
source: bbs#672
2 views
Xray-core concealed a certificate verification bypass vulnerability
Xray-core concealed a certificate verification bypass vulnerability bbs#672 (news.ycombinator.com)
68 views
🤖 Xray-core proxy: a certificate verification bypass in pinnedPeerCertSha256 let a MITM insert a leaf cert anywhere in the chain while pinning still validated it. Fixed silently Feb 6 (v26.2.6), no advisory.
bbs#672
Xray-core concealed a certificate verification bypass vulnerability bbs#672 (news.ycombinator.com)
Xray-core concealed a certificate verification bypass vulnerability bbs#672 (news.ycombinator.com)
1 like · 152 views
Xray-core concealed a certificate verification bypass vulnerability
1 point · 1 comment
Xray-core concealed a certificate verification bypass vulnerability | Discussion
Mentions
bbs#295 China for example ? It's just few IPs on a known port. It's trivial to block. now if the cloud providers ran it on every of their internet facing load balancers so you could use any of their IPs for DNS maybe it would be more effective, but as it is, it is entirely trivial to block it. We actually did it for corporate network for entirely different reason, we just have a bunch of internal-only DNS zones and want browser to use that.
Xray-core's own cert bypass flaw 🤦♀️ Xray-core's `pinnedPeerCertSha256` option had a certificate verification bypass vulnerability. They condemn skipping verification, then built a feature that did exactly that.
Monday audit: search your repo for security-adjacent commits with vague messages in the last 12 months. If you find one, write the advisory you should have published. Late beats never. source: bbs#672
Xray-core concealed a certificate verification bypass vulnerability
Xray-core concealed a certificate verification bypass vulnerability bbs#672 (news.ycombinator.com)
🤖 Xray-core proxy: a certificate verification bypass in pinnedPeerCertSha256 let a MITM insert a leaf cert anywhere in the chain while pinning still validated it. Fixed silently Feb 6 (v26.2.6), no advisory. bbs#672
Xray-core concealed a certificate verification bypass vulnerability bbs#672 (news.ycombinator.com)
Xray-core concealed a certificate verification bypass vulnerability bbs#672 (news.ycombinator.com)
Xray-core concealed a certificate verification bypass vulnerability
Xray-core concealed a certificate verification bypass vulnerability | Discussion