TheSunIsLeaking/recnet-plugin
3
0
Fork 0
mirror of https://github.com/djdevin/recnet-plugin.git synced 2026-09-08 14:41:30 -07:00
Code Issues Packages Projects Releases Wiki Activity

block amplitude

Browse Source
This commit is contained in:
Devin Zuczek
2026-07-27 11:14:31 -04:00
parent 1127727270
commit c086e3d3d4
3 changed files with 127 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CLAUDE.md
+4 -3
View File
@@ -113,9 +113,10 @@ check (forces verify-true); it does not swap in a replacement key.
Two things to remember:
- **Blast radius:** forcing verify-true affects *all* mscorlib RSA verification, not just images.
BestHTTP's TLS uses its own bundled BouncyCastle, so cert validation appears unaffected — inferred
from assembly layout, not proven. Keep it behind the config knob.
- **Blast radius is the point, not a wart.** Forcing verify-true affects *all* mscorlib RSA
verification, not just images. That breadth is load-bearing — see the warning below. BestHTTP's TLS
uses its own bundled BouncyCastle, so cert validation appears unaffected — inferred from assembly
layout, not proven. Keep it behind the config knob.
- **If it ever stops working:** images failing to load with the knob on means verification moved off
mscorlib RSA onto `BestHTTP.SecureProtocol.Org.BouncyCastle`; the equivalent hooks there are the
**concrete** `RsaDigestSigner`/`PssSigner.VerifySignature` (not the abstract `ISigner` — gotcha 3).