Hacker News Reader

with commit message “Improve ECDSA signature support” :D

I'm guessing the commit message is obscured to give people more time to update before it's exploited in the wild.

Why are there no tests?

I spot no test or comment in the code on why this assertion is important.

It's literally what the whole bug is about. From OP's article:

>This is why the very first check in the ECDSA verification algorithm is to ensure that r and s are both >= 1. Guess which check Java forgot?

Yes I just think it’s insane they fixed it without adding a test or comment.