So the point is to avoid firing an async request to a server you control, since that server could be shut down? Surely SmptJS would kill the token if requested to, why is this any better?
This drives me nuts. It feels the same as the insurance company's phone menu asking if you're interested in purchasing a policy or submitting a claim, where the former choice get you an instant human being and the latter a 45 minute wait. In other words, it signals that you're more interested in signing up new customers than serving your current customers.
Does anyone else remember putting the plastic tab into the tamagotchi and pulling it out repeatedly in the hope of glitching the device into giving you a powerful monster? I definitely succeeded more than once, I would love to know the explanation of why it worked!
I was expecting this to be about introducing strange bugs and then claiming to fix them in order to get a publication. But the publication is titled "On the Feasibility of Stealthily Introducing Vulnerabilities in Open-Source Software via Hypocrite Commits"! So I guess it's less feasible than they imagined, at least in this instance.