I'm not trying to say that the person who discovered the variable did anything wrong, but I'd love to know why someone didn't dig deeper into the matter before going public with it. I'm starting to lean toward the latter. The company consults on matters related to public-key infrastructures. Oh, I see. These security guys are always making mountains out of molehills.
Nothing is safe.
So I'll just forget security. It's not that they're comfortable, guys, it's that we haven't offered them a viable, secure alternative. He understands vested interests. A few years ago, when I worked at a company that built smartcard systems, we were overwhelmed with customer calls when someone announced a theoretical vulnerability in smartcard systems. About a week later, when the ruckus was dying down, we got a letter from the company that had publicized the vulnerability, offering us consulting services to see if our system needed fixing.