Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FaceTime bug lets you hear audio of person you are calling before they pick up

9to5mac.com

Post reply on HN
Print view View original

351–360 of 458 posts

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#351

Post by scraft »

NelsonMinar wrote: post #13

I'm always curious how a bug like this ships. I mean QA & Testing should catch it, sure. But even before then. Some engineer wrote code for FaceTime that has it open the microphone before the call is accepted. And transmit the audio over the network before the call is accepted. Who did that? And why? I'm not suggesting malice but I do wonder at the lack of defensive programming.

Possibly a product owner trying out the latest build, receiving a call, accepting it, and then waiting for the call initiator to receive the message that the call has been accepted, and then start sending data and asking:

"Why doesn't it take X seconds before I can start talking".

To which the engineers possibly explained the reasons and the product owner saying:

"But I want it instant, let's bypass all this extra stuff and get a proof of concept instant answer working"

To which the engineer said:

"But we'd technically be sending data before the call has even been accepted"

To which the product owner said:

"That's okay, the user can't actually see that data, let us just get this in for now, we can worry about the security/privacy side later".

To which the engineer said "but, but, but" saw the product owners eyes glaze over and just made the commit:

Commit 1279: Remove very important security/privacy feature of ensuring no data is transmitted until the call has been accepted. This is again my best judgement, do not come to me when this blows up, please speak to the product owner.

Then went to the pub in despair.

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#352

Post by jeromebaek »

NelsonMinar wrote: post #13

I'm always curious how a bug like this ships. I mean QA & Testing should catch it, sure. But even before then. Some engineer wrote code for FaceTime that has it open the microphone before the call is accepted. And transmit the audio over the network before the call is accepted. Who did that? And why? I'm not suggesting malice but I do wonder at the lack of defensive programming.

An old product like FaceTime comes with tons of legacy code. Mistakes like this while fiddling with legacy code is not unreasonable.

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#353

Post by heywire »

tuxxy wrote: post #168
codetrotter wrote: post #134

Earlier quoted context omitted.

I remember some people discovered that you could kill the xscreensaver lock screen on Debian with Alt+SysRq+F some years back. Well, a decade back actually — 2009. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=562884

A fee years ago, I discovered that if someone was running dual monitors and using XScreenlock, you could unplug one of the monitors and it would bypass the lock screen. I have no idea if this is still possible, I've not used XScreenlock since then.

On Windows 10, if you have dual screens and unplug one while the screen is locked, it will reconfigure the displays and give you a flash of what was under the lock screen. Hope you didn't leave anything sensitive on your screen!

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#354

Post by whamlastxmas »

scraft wrote: post #351
NelsonMinar wrote: post #13

I'm always curious how a bug like this ships. I mean QA & Testing should catch it, sure. But even before then. Some engineer wrote code for FaceTime that has it open the microphone before the call is accepted. And transmit the audio over the network before the call is accepted. Who did that? And why? I'm not suggesting malice but I do wonder at the lack of defensive programming.

Possibly a product owner trying out the latest build, receiving a call, accepting it, and then waiting for the call initiator to receive the message that the call has been accepted, and then start sending data and asking: "Why doesn't it take X seconds before I can start talking". To which the engineers possibly explained the reasons and the product owner saying: "But I want it instant, let's bypass all this extra st…

I think it's much more likely their code is a mess and it's not super obvious when stuff starts and ends and this is just an unintentional mistake.

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#356

Post by samoa42 »

oil25 wrote: post #260
_bxg1 wrote: post #236

Earlier quoted context omitted.

As someone who bought an iPhone specifically for privacy reasons, I'm not really upset about this. What I'm concerned about is passive, mass-scale corporate surveillance, not a one-off bug that allows an individual with mal-intent to listen through my microphone for a few seconds and also let me know about it.

Are you able to root an iPhone or use one without signing in with an Apple account (that's tied to a credit card, etc)? If not, then I believe the devices are still very much part of a mass-scale corporate surveillance network.

confirm: iphone works almost fine with no apple account or cc. if only it would be able to talk/mount webdav...

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#357

Post by tehlike »

saagarjha wrote: post #85
tehlike wrote: post #57

Earlier quoted context omitted.

Desperate times call for faster-deployment. Been there. Sometimes, you might even need to patch a binary.

For this? I seriously doubt that this would require binary patching. A simple recompile with the fix should be good enough.

Not for this one, no.

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#358

Post by 7Z7 »

neya wrote: post #336
npunt wrote: post #292

Earlier quoted context omitted.

Stock manipulation perhaps? Happens a lot with Tesla apparently, short sellers will pump up any negative story and try to get it into press. This person was making several attempts to get in contact with press after all, and a story about a teenager finding a big privacy bug in a company that publicly touts its privacy chops has ‘news at 11’ written all over it. Personally I think a bug report story is not a particul…

Is it still called stock manipulation if the bug is critical and for real and the company deserves to lose shareholder value simply for the critical nature of the bug? Imagine how many people are vulnerable out there - I'm already starting to read some complaints on the internet that some people were unknowingly sharing a video of them taking a shower, etc.

Depends on when the information was made public

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#359

Post by pbhjpbhj »

whamlastxmas wrote: post #354
scraft wrote: post #351

Earlier quoted context omitted.

Possibly a product owner trying out the latest build, receiving a call, accepting it, and then waiting for the call initiator to receive the message that the call has been accepted, and then start sending data and asking: "Why doesn't it take X seconds before I can start talking". To which the engineers possibly explained the reasons and the product owner saying: "But I want it instant, let's bypass all this extra st…

I think it's much more likely their code is a mess and it's not super obvious when stuff starts and ends and this is just an unintentional mistake.

You hear this excuse all the time, don't FAANG employ the world's very best developers?

Maybe their code is a mess for orthogonal reasons - management, profit-motive?

Aside: I thought I'd heard devs have automated analysers that step through and find all possible code paths, allowing complex code to be audited for security issues and such? Presumably that's how these sorts of bugs should be found in testing.

Re: FaceTime bug lets you hear audio of person you are calling before they pick up

#360

Post by ABeeSea »

scraft wrote: post #351
NelsonMinar wrote: post #13

I'm always curious how a bug like this ships. I mean QA & Testing should catch it, sure. But even before then. Some engineer wrote code for FaceTime that has it open the microphone before the call is accepted. And transmit the audio over the network before the call is accepted. Who did that? And why? I'm not suggesting malice but I do wonder at the lack of defensive programming.

Possibly a product owner trying out the latest build, receiving a call, accepting it, and then waiting for the call initiator to receive the message that the call has been accepted, and then start sending data and asking: "Why doesn't it take X seconds before I can start talking". To which the engineers possibly explained the reasons and the product owner saying: "But I want it instant, let's bypass all this extra st…

Ah yes, it’s always the product owners fault and engineering is always fault-less. A HN classic.
Post reply on HN