Fundamentally is precisely the wrong word to use here.
It may be the case that this particular attack is not an issue -- I doubt it given the authors track record -- but the paper marshray links to is an actual real issue even if this particular practical exploit of it is flawed.
Fundamentally, TLS 1.0 is not secure ( formally INDCPA II). The correct thing to do is use something that is secure. Allegedly, TLS 1.1+ fits this bill (if one trusts Hugo Krawczyk proof that assumed fresh IVs).
Anyone working on an SSL/TLS stack should be working to get this supported and should know enough to realize that supposedly theoretical issues with crypto systems can quickly become real easily (e.g, bleichenbacher's attack against ssl in the 90s)
It may be the case that this particular attack is not an issue -- I doubt it given the authors track record -- but the paper marshray links to is an actual real issue even if this particular practical exploit of it is flawed.
Fundamentally, TLS 1.0 is not secure ( formally INDCPA II). The correct thing to do is use something that is secure. Allegedly, TLS 1.1+ fits this bill (if one trusts Hugo Krawczyk proof that assumed fresh IVs).
Anyone working on an SSL/TLS stack should be working to get this supported and should know enough to realize that supposedly theoretical issues with crypto systems can quickly become real easily (e.g, bleichenbacher's attack against ssl in the 90s)