@0xabad1dea's excellent sketch analysis[0] explains the root cause of the problem better than the confusing gitorious UI with the diff[1].<p>[0] <a href="http://imgur.com/UqAkZS7" rel="nofollow">http://imgur.com/UqAkZS7</a><p>[1] <a href="https://www.gitorious.org/gnutls/gnutls/commit/6aa26f78150ccbdf0aec1878a41c17c41d358a3b" rel="nofollow">https://www.gitorious.org/gnutls/gnutls/commit/6aa26f78150cc...</a>
I find the language "how to mitigate the attack" completely offensive.<p>How about "how to verify a certificate?" Or better "how to write C code"<p>This is a scandal. Stop.