The test was green. Every real connection would have failed.

This is a submission for DEV's Summer Bug Smash: Smash Stories powered by Sentry.

The setting

WebRTC-Direct in libp2p has a neat trick for connecting without a certificate authority: the peer's multiaddr contains a hash of its TLS certificate — /webrtc-direct/certhash/<...>. When you dial, the DTLS handshake presents a cert, you hash it, and you check it against the certhash in the address. No CA, no trust store — the address is the pin.

For that to work, py-libp2p has to make aiortc use our libp2p-generated certificate, not the one aiortc auto-generates for itself. So the code pins it:

config = RTCConfiguration(certificates=[rtc_cert])

The test was green. Every real connection would have failed.

Related reading

The /sdp endpoint that trusted its callers: fixing a memory-amplification DoS…

Nine green tests and a parser that never worked once

I wrote a test for prompt injection. It passed while the attack worked.

Smash Story: The Demo Script That Out-Debugged My Test Suite

Smash Stories: Mitigating Core EVM State Desyncs and Gas Latency Hurdles

One rented /24 could eclipse a Kademlia node. Now it takes ten.