Earlier quoted context omitted.
How long does it take?
Several hours to a day, depending on how many components fail to build.
So every bugfix is a rebuild from current, not from "released"? This seems like not a real process.
FaceTime bug lets you hear audio of person you are calling before they pick up
221–230 of 458 posts
Re: FaceTime bug lets you hear audio of person you are calling before they pick up
#222I'm always curious how a bug like this ships. I mean QA & Testing should catch it, sure. But even before then. Some engineer wrote code for FaceTime that has it open the microphone before the call is accepted. And transmit the audio over the network before the call is accepted. Who did that? And why? I'm not suggesting malice but I do wonder at the lack of defensive programming.
It reminds me of this MacOS bug from last year, where simply hitting the login box over and over with no password would eventually bypass the security entirely: https://www.theregister.co.uk/2017/11/28/root_access_bypass_... And this other MacOS bug, also from last year, where the password hint would contain the plain text encryption password: https://www.theregister.co.uk/2017/10/05/apple_patches_passw... All within…
Edit: Deleted my comment because I felt it wasn’t constructive.
Re: FaceTime bug lets you hear audio of person you are calling before they pick up
#223Earlier quoted context omitted.
So… your theory is that if people understood pointers this wouldn’t have happened? I don’t think that follows.
>So… your theory is that if people understood pointers this wouldn’t have happened? Yes. But it has nothing to do with pointers specifically, just the mindset and training of the average developer who has had experience with them, vs. the average developer who has not. There's an entire generation of developers now graduating from CS programs, hiring into Apple, and getting dumped on these application teams with zero…
I think you over-simplify — engineers slot into different roles/disciplines within large companies.
There are going to be engineers that have to deal with driver-level code that know full well the limitations of memory constraints, thread overhead, etc.
No doubt you're describing the other half — the app engineers that use the API/SPI's. It might even be argued though that, given a well defined API, they should not have to worry about how much memory a JPEG requires ... the API decompressing the image only when rendering to the destination or what-have-you. Pointers, memory management should be managed by the low-level parts of the language or OS/kernel.
I happen to like the bit-banging, pointer walking, free-wheeling world of straight C but I don't begrudge higher level languages that are designed to tackle the more modern pressures of concurrency and "asynchronicity".
Re: FaceTime bug lets you hear audio of person you are calling before they pick up
#224Earlier quoted context omitted.
The team might be able to fix it today, but the fix needs to go through testing and then be built alongside the rest of iOS (a multi-hour process). I wouldn’t be surprised if this takes two or three days to roll out.
You didn't even bring into consideration the app store approval process which can take 2-3 weeks and likely would reject this as a feature removal without user notification.
The update notes might include it ;)
Re: FaceTime bug lets you hear audio of person you are calling before they pick up
#225Earlier quoted context omitted.
Valid points. How about restricting the scope to devices connected to a network and having some sort of push notification capability? > In Apple's defense, it is pretty difficult to miss an update alert considering it comes through as (a) a push notification, (b) a mandatory alert, and (c) a persistent red badge on the Settings app. > I agree that it might be a good idea to differentiate between a normal update and a…
So... every computer running some sort of syslogd?
Not sure if I'll define it that way, but why not? If my mobile device is capable of showing inane ads as push notifications, why can't I expect security advisories to be delivered that way?
Re: FaceTime bug lets you hear audio of person you are calling before they pick up
#226Earlier quoted context omitted.
It reminds me of this MacOS bug from last year, where simply hitting the login box over and over with no password would eventually bypass the security entirely: https://www.theregister.co.uk/2017/11/28/root_access_bypass_... And this other MacOS bug, also from last year, where the password hint would contain the plain text encryption password: https://www.theregister.co.uk/2017/10/05/apple_patches_passw... All within…
Edit: Deleted my comment because I felt it wasn’t constructive.
Apple claims, falsely, that their Operating System is "secure by design". (See https://www.apple.com/business/resources/docs/iOS_Security_O... )
This is an outright lie.
However, I'm not sure a typical iOS user cares.
Re: FaceTime bug lets you hear audio of person you are calling before they pick up
#227If I were Apple, I would be implementing a server side migration right now: - if someone adds their own email or phone number again to a group chat, immediately terminate the call As far as I know, this would mitigate the vulnerability. Alternatively, disable Group FaceTime calls altogether.
> Alternatively, disable Group FaceTime calls altogether.
Apple has just done this.
Re: FaceTime bug lets you hear audio of person you are calling before they pick up
#228Earlier quoted context omitted.
Are you suggesting that the silent switch also turns off the camera and microphone?
Yup. Or, at the least, have a separate switch that does so.
That went from "two transistors" to "an entirely separate physical component on the chassis" pretty quickly.
Re: FaceTime bug lets you hear audio of person you are calling before they pick up
#229I'm always curious how a bug like this ships. I mean QA & Testing should catch it, sure. But even before then. Some engineer wrote code for FaceTime that has it open the microphone before the call is accepted. And transmit the audio over the network before the call is accepted. Who did that? And why? I'm not suggesting malice but I do wonder at the lack of defensive programming.
Abstraction. I can tell you with 100% confidence that any of these logic bugs are created by unecessary abstraction.
Anybody working in security will tell you the same. Piles of abstractions make it impossible to find out these bugs. You need a month of work to understand these codebases, often only the main developer has the architecture in its head.
Re: FaceTime bug lets you hear audio of person you are calling before they pick up
#230Apple has disabled group FaceTime on their end. https://www.apple.com/support/systemstatus/
Oh damn, they can do it just like that? I thought FaceTime was a P2P thing... but it appears group FT requires Apple's servers?
Each person only uploading one copy of video in a multiparty situation is a huge win for quality on mediocre connections.