[cartan]

They just made the keyspace two bits smaller. That in itself is not such a big deal; however, once such a flaw has been found in a cipher, others, more serious ones usually follow in short order. So, we better get ready to find a decent replacement.

[glorgau]

Even if the algorithm is good, there may still be flaws in the implementation. The bid example this year was crypt_blowfish - the popular open source library used in implementation for the last 13 years turns out to have been only using every 4th character of a given password when creating hashes of said password. The fix turned out to be changing a simple cast of a char (which is default a signed integer) to an unsigned integer.

The flaw was out there for 13 years and nobody noticed!