Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reverse Engineering the Apple Multipeer Connectivity Framework (2022)

evilsocket.net

Post reply on HN
Print view View original

21–30 of 36 posts

Re: Reverse Engineering the Apple Multipeer Connectivity Framework (2022)

#21

Post by refulgentis »

isodev wrote: post #11
fisherjeff wrote: post #4

“Moreover, while sending crafted packets and attempting all sorts of things, I’ve discovered several vulnerabilities in the Apple custom made parsers. I will not discuss them here (exception made for the session spoofing) but at the same time I’m not interested in reporting them to Apple…” Erm, hope they’re not super serious I guess?

[flagged]

I don't understand, you have a high-level technical understanding of MPC, but you're dismissive of the criticism?

An auth strategy based on a Map, where String is a plain-text beacon on the LAN, seems well-worth criticizing.

I may have gotten turned about when trying to understand a few things, my understanding is you dismiss this because you're not sure if one feature uses it? And because parsers can't have vulnerabilities on arbitrary data?

Re: Reverse Engineering the Apple Multipeer Connectivity Framework (2022)

#22

Post by joshspankit »

mannyv wrote: post #7

"custom (and as typical of Apple, undocumented) TCP protocol" Pretty much all custom protocols are undocumented. Not sure why he feels the need to shit on Apple. And any custom protocol parser will be riddled with errors, because they always expect values to be in range.

Apple has one of the most damaging two-faced approaches where on the public side they say they are all about openness and power users and security but on the private side they are intentional and severe about keeping that public image at the expense of users.

I agree that there’s no responsibility on Apple to document this specific protocol but it’s important to see it in context.

Re: Reverse Engineering the Apple Multipeer Connectivity Framework (2022)

#23

Post by brookst »

joshspankit wrote: post #22
mannyv wrote: post #7

"custom (and as typical of Apple, undocumented) TCP protocol" Pretty much all custom protocols are undocumented. Not sure why he feels the need to shit on Apple. And any custom protocol parser will be riddled with errors, because they always expect values to be in range.

Apple has one of the most damaging two-faced approaches where on the public side they say they are all about openness and power users and security but on the private side they are intentional and severe about keeping that public image at the expense of users . I agree that there’s no responsibility on Apple to document this specific protocol but it’s important to see it in context.

> they say they are all about openness and power users and security

They do mention security a lot, but “all about openness and power users”? That’s not my impression. They famously eschew the “make everything a setting” philosophy. The whole Apple thing is simplicity at the expense of configurability and control. Do you see them otherwise?

Re: Reverse Engineering the Apple Multipeer Connectivity Framework (2022)

#24

Post by Gorbzel »

madeofpalk wrote: post #20
isodev wrote: post #11

Earlier quoted context omitted.

[flagged]

It's two lines in an otherwise pretty indepth technical article. Hardly a tantrum.

What he’s basically saying here is “I’d rather let my personal opinion prevail than responsibly disclose and get some vulnerabilities fixed.”

Even if, at their worst, Apple is as petty as he’s “heard” (given the FUD surrounding quite a lot of engineer’s), the proper response is responding with less pettiness, not more. It’s reflective of the author’s character no matter how he expressed the tantrum.

Re: Reverse Engineering the Apple Multipeer Connectivity Framework (2022)

#25

Post by valianteffort »

Gorbzel wrote: post #24
madeofpalk wrote: post #20

Earlier quoted context omitted.

It's two lines in an otherwise pretty indepth technical article. Hardly a tantrum.

What he’s basically saying here is “I’d rather let my personal opinion prevail than responsibly disclose and get some vulnerabilities fixed.” Even if, at their worst, Apple is as petty as he’s “heard” (given the FUD surrounding quite a lot of engineer’s), the proper response is responding with less pettiness, not more. It’s reflective of the author’s character no matter how he expressed the tantrum.

Reporting a vulnerability should be extremely low effort. Regardless of how I feel about a company I wouldn't want users to get screwed. I tried to disclose to google once and they required an account so instead I moved on with my life. I don't care about random people enough to make a google account.

Re: Reverse Engineering the Apple Multipeer Connectivity Framework (2022)

#26

Post by RoseRose »

Gorbzel wrote: post #24
madeofpalk wrote: post #20

Earlier quoted context omitted.

It's two lines in an otherwise pretty indepth technical article. Hardly a tantrum.

What he’s basically saying here is “I’d rather let my personal opinion prevail than responsibly disclose and get some vulnerabilities fixed.” Even if, at their worst, Apple is as petty as he’s “heard” (given the FUD surrounding quite a lot of engineer’s), the proper response is responding with less pettiness, not more. It’s reflective of the author’s character no matter how he expressed the tantrum.

Well this is absolute bullshit. You're discussing private software. It's up to the owner to offer a bug program that's enticing enough to debug their own software if they care.

Re: Reverse Engineering the Apple Multipeer Connectivity Framework (2022)

#27

Post by Avamander »

ithkuil wrote: post #10
fisherjeff wrote: post #4

“Moreover, while sending crafted packets and attempting all sorts of things, I’ve discovered several vulnerabilities in the Apple custom made parsers. I will not discuss them here (exception made for the session spoofing) but at the same time I’m not interested in reporting them to Apple…” Erm, hope they’re not super serious I guess?

Taken out of context it looks a bit weird, but it does explain the motivation: "I’ve heard way too many negative stories about their disclosure program and in general how they mistreat researchers."

Yeah. Plenty of such stories, I had to reproduce a security issue across four macOS versions before it was finally fixed. Such a waste of time.

Re: Reverse Engineering the Apple Multipeer Connectivity Framework (2022)

#28

Post by joshspankit »

brookst wrote: post #23
joshspankit wrote: post #22

Earlier quoted context omitted.

Apple has one of the most damaging two-faced approaches where on the public side they say they are all about openness and power users and security but on the private side they are intentional and severe about keeping that public image at the expense of users . I agree that there’s no responsibility on Apple to document this specific protocol but it’s important to see it in context.

> they say they are all about openness and power users and security They do mention security a lot, but “all about openness and power users”? That’s not my impression. They famously eschew the “make everything a setting” philosophy. The whole Apple thing is simplicity at the expense of configurability and control. Do you see them otherwise?

> but “all about openness and power users”? That’s not my impression.

...!

I feel like a frog that’s just been shown the bubbles forming on the bottom of the pot.

Granted I’ve been pretty “meh” on Apple the last few years but I’ve still watched the keynotes and kept up with their growth. I didn’t even notice that Apple cleaned developers and pro users from their brand! (pro users as defined by those that are always stretching the limits of the tech, learning, and finding new optimal ways to do things).

I just finished re-watched the uncut WWDC keynote and when developers are mentioned they are now almost entirely talked about in 3rd person while Apple is talking directly to upper management. The most hands-on-tech thing they did was talk for a couple seconds about the WebKit features.

My impression of Apple is shockingly outdated in their favour.

The product pages for both Mac Studio and the Mac Pro (both “Pro” products) either talk specs without highlighting what can be done with them or they talk about media creation. The target demographic here is creative professionals and not technical ones, power users, or developers.

They have served creative professionals for a long time for sure, but they also served power users and technology professionals because they recognized that it was them working with the creative professionals (and sometimes working on their own) to build products with huge markets. I thought that this was still an underlying corporate value at Apple but I see now that they’ve just conveniently dropped it without even a whisper. I guess their new core demographic is content creators and movie studios?

Apologies if this rambles. I had to get it out. I’m still processing this.

Re: Reverse Engineering the Apple Multipeer Connectivity Framework (2022)

#29

Post by microtherion »

joshspankit wrote: post #28
brookst wrote: post #23

Earlier quoted context omitted.

> they say they are all about openness and power users and security They do mention security a lot, but “all about openness and power users”? That’s not my impression. They famously eschew the “make everything a setting” philosophy. The whole Apple thing is simplicity at the expense of configurability and control. Do you see them otherwise?

> but “all about openness and power users”? That’s not my impression. ...! I feel like a frog that’s just been shown the bubbles forming on the bottom of the pot. Granted I’ve been pretty “meh” on Apple the last few years but I’ve still watched the keynotes and kept up with their growth. I didn’t even notice that Apple cleaned developers and pro users from their brand! (pro users as defined by those that are always s…

This year, there were lots of product announcements, so the keynote was end user centric. It's really platforms state of the union address the same afternoon that has the developer focus: https://developer.apple.com/videos/play/wwdc2023/102/

Re: Reverse Engineering the Apple Multipeer Connectivity Framework (2022)

#30

Post by CharlesW »

joshspankit wrote: post #28
brookst wrote: post #23

Earlier quoted context omitted.

> they say they are all about openness and power users and security They do mention security a lot, but “all about openness and power users”? That’s not my impression. They famously eschew the “make everything a setting” philosophy. The whole Apple thing is simplicity at the expense of configurability and control. Do you see them otherwise?

> but “all about openness and power users”? That’s not my impression. ...! I feel like a frog that’s just been shown the bubbles forming on the bottom of the pot. Granted I’ve been pretty “meh” on Apple the last few years but I’ve still watched the keynotes and kept up with their growth. I didn’t even notice that Apple cleaned developers and pro users from their brand! (pro users as defined by those that are always s…

> I just finished re-watched the uncut WWDC keynote…

The WWDC keynote/state of the union is a public-facing event for enthusiasts, press and analysts. This is why Apple invites say, "Join the developer community for an in-depth look at the future of Apple platforms".

If you want to evaluate Apple's prioritization of the developer community, you can watch any other content that Apple creates for WWDC, along with the non-keynote events listed at developer.apple.com/wwdc23. Additionally, Apple developers have their own dedicated site at developer.apple.com.

Post reply on HN