Can you comment on this: https://news.ycombinator.com/item?id=48752294 ?

To me it seems, at least in this instance there is not even an exploit needed and the feature apparently is just broken beyond belief.