As mentioned in the article, the attack only works on TLS 1.0 (and below). Now the question would be, why are we still stuck with TLS 1.0 (at least with Mozilla's NSS) and not migrated to newer versions of the protocol,