141–150 of 458 posts
Earlier quoted context omitted.
You need to integrate the famous iTunes into this thesis. (people have complained about it approximately since it was released)
iTunes has always felt robust and well-architected, but it's UI has been a dumpster fire since whenever.
I'm always curious how a bug like this ships. I mean QA & Testing should catch it, sure. But even before then. Some engineer wrote code for FaceTime that has it open the microphone before the call is accepted. And transmit the audio over the network before the call is accepted. Who did that? And why? I'm not suggesting malice but I do wonder at the lack of defensive programming.
Most likely 2 different teams worked on it. One worked on accepting calls, the other worked on transmitting audio, another probably worked on video. Then it got integrated and complete e2e testing wasn't done.
Apologies in advance for my ignorance, I haven’t written code for a long time.
Earlier quoted context omitted.
This bug only applied to grub authentication, which isn't a widely used feature. And you could achieve the same result with boot from disk/USB if that is enabled. The vuln doesn't give you access to the actual accounts on the computer.
Let's not forget https://www.cvedetails.com/cve/CVE-2013-1050/ and https://www.cvedetails.com/cve/CVE-2015-7496/ and https://www.cvedetails.com/cve/CVE-2017-8900/ (to a lesser extent). Check out https://www.cvedetails.com/vulnerability-list.php?vendor_id=... for more fun.
Earlier quoted context omitted.
They obviously didn't test it the first time out. Why do they need to test it this time?
I don't see a bug in the patch to fix this bug going over very well with the press.
https://www.theguardian.com/technology/2017/nov/30/apple-mac...
Earlier quoted context omitted.
> The result is you have tons of brilliant people who can quickly whip up a DFS algorithm, but don't understand that using 4MB of RAM for a JPEG is unnacceptable, or that whatever dynamic thing they are asking the runtime to do might not always work as intended. I’m not sure where you’re getting this anecdote from, because I have not found it to be at all true in practice.
I’m not sure about the situation at Apple, but this is 100% true in the web development world today; with the exception that many of the new programmers hired straight out of General Assembly and the like can’t implement a DFS algorithm either. It’s a nightmare for security and performance - the number of obvious, blatant security issues I’ve spotted and fixed just through luck alone is horrifying.
But coming back to your point, there have always been new engineers with weak skills, just like there have always been smart engineers as well. I don't think the choice of programming language changes this fact significantly, although certain languages may have a slightly higher proportion of inexperienced programmers than others.
What about updates for people who don't update often or don't even see that there's an update? This is way too critical a bug for people who don't follow the news to not be taken care of (their devices, I mean). Apple keeps pushing major new version iOS downloads forcefully down to devices without any way of opting out, yet what I've seen is that point updates are left as optional and may not even show up unless one…
> Apple keeps pushing major new version iOS downloads forcefully down to devices without any way of opting out iOS upgrades are not mandatory by any means. > no waiting for the phone to be on the charger overnight, etc. This is how you get phones running out of battery halfway through an update.
The upgrades are not mandatory, but the downloads certainly are. I've had to delete the iOS downloads several times over years (including the downloads for iOS 12) because iOS doesn't have an option to disable this, and it automatically downloads the upgrade in the background when on WiFi for a long enough time. It's a cumbersome process to delete the download. It's even worse when you consider that a downloaded update would be installed overnight if you leave the device on the charger and connected to WiFi and by mistake tap on install when that prompt appears at some random time. The user interface for controlling and managing iOS upgrades does not exist.
> This is how you get phones running out of battery halfway through an update.
The OS could always put a limit saying the phone should be charged at least 30-40% for an update to start installing. Even now, the upgrades and updates are allowed to go through for iPhones without them having to be on the charger.
It may be entirely unrelated, however this is the exact sort of behaviour you would expect to see associated with providing compatibility with Australia's newly introduced AABill, or to implement GCHQ's ghost participant proposal ( https://www.lawfareblog.com/principles-more-informed-excepti... ).
Earlier quoted context omitted.
This sound horrifying. If I use a hacked/modified FaceTime client, does this mean I'll be able to hear and see the other end before they pick up, even after the fix?
Facetime calls are end to end encrypted so I doubt a modified client would work.
Or maybe there is already one, and I'm blissfully ignorant!
