I wonder if the hackers managed to get code signing keys out? Ultimate jailbreak?
Apple Developer Website Update
21–30 of 223 posts
Re: Apple Developer Website Update
#22Uh, how does this "encryption" work? For the website to show these details (and it does, in part, use these details in the interface) it must be able to decrypt these on the web applications side. Ergo the keys for decryption must also be on the server or derived from the users passwords, both of which make the use of encryption a fairly worthless venture. ED: As another commenter mentioned in an earlier thread, lots…
I think the 'sensitive personal information' is passwords, so the names, addresses etc which are displayed on the site were not encrypted.
[deleted]
Re: Apple Developer Website Update
#23No reason to be up in arms, folks. They've got the marketing team working on this too.
The marketing team runs the portal.
Re: Apple Developer Website Update
#24Earlier quoted context omitted.
In the spirit of transparency, we're giving you vague warning that some information might have been accessed _4 days ago_
That's not a long time to receive a letter like this. That's as fast as Apple instantly responds to anything, esp. considering the weekend. And the site was down, so it was clear something was going on. It is also extremely transparent in the sense that people were wondering this exact thing even earlier today, and now received a response detailing that this is an extremely severe breach, as opposed to something else…
Well I'm giving them a hard time due to the massive schadenfreude, obviously. Still, this is very vague about what the 'sensitive personal information' is (passwords?), what was encrypted, what was hashed, was it using a proper hashing scheme, etc.
And announcing it just because people have started to speculate is damage control, not taking responsibility.
Re: Apple Developer Website Update
#25I read the comments dismissing apples handling of this. What would you have expected them to do? There is a LOT of forensics going on probably even now trying to get a handle on this. A massive corp isn't going to make an announcement until they have some idea what they're talking about. In my books 4 days is a very quick first announcement from a company of this size.
Re: Apple Developer Website Update
#26Good to see some transparency on Apple's part here.
I understand this must be a very challenging situation for them to deal with, and I appreciate the notification. As I'm sure many developers feel, I'd like to know more details, but I'm sure these will come in due course.
Re: Apple Developer Website Update
#27> "In the spirit of transparency, we want to inform you of the issue."
Ha, what a joke, I can't help laughing at that.
With so many third-party Apple developers drinking the kool-aid, and dreaming of becoming rich, I'm not surprised Apple treat them like fools.
Just yesterday on Twitter, some developers were speculating that the site was taken down to be updated with new SDKs for exciting new features and product lines.
Re: Apple Developer Website Update
#28Good to see some transparency on Apple's part here. I understand this must be a very challenging situation for them to deal with, and I appreciate the notification. As I'm sure many developers feel, I'd like to know more details, but I'm sure these will come in due course.
Also, let's not jump to conclusions until we have more info. This is clearly a very serious and sensitive incident.
Re: Apple Developer Website Update
#29> Sensitive personal information was encrypted and cannot be accessed, however, we have not been able to rule out the possibility that some developers’ names, mailing addresses, and/or email addresses may have been accessed.
So they can't rule out the possibility that sensitive personal information, which cannot be accessed, has been accessed. Got it.
Apparently our intelligence, which cannot be insulted, has been insulted.
Re: Apple Developer Website Update
#30These details are befuddling. "Personal information was encrypted and cannot be accessed". It can't be accessed because it's somehow stored elsewhere, or it can't be accessed because of the encryption? That is, does the intruder currently own my encrypted data? I'm also disappointed that it took them 72 hours to tell us anything, and that the update doesn't even have a timeline for when the site may be back. "Soon" i…
Yeah I'm confused why companies tells us DAYS after something serious happened as opposed to right away. I can understand waiting a day but 3 whole days?! I just don't understand the delay. It's our data, we should have the right to know what happened to it.
It can take more than a day to know what happened to your data.