Apple's SSL/TLS bug

If only it was open source this never would have happened.

Once eyeballs are thinly spread over enough projects, all bugs are deep again.

Here's the link to the open-sourced file, taken from the article: http://opensource.apple.com/source/Security/Security-55471/l...

It's interesting watching all the speculation about "was it a backdoor, or just a bug?"

Lots of points in favor or against:

1) It's a huge compromise, and "open" to anyone to exploit, which would ultimately get caught and fixed faster. But it's also not targeting anything specific, so there's less of a signature of the attacker.

2) Incredibly simple, and thus a plausible mistake.

3) Hidden in plain sight

I'd generally come down on the side of "accident". The better question is if an systematic testing system for exploitable weaknesses (or a lucky chance finding) could find something like this (either a regression, or a badly implemented new feature) and exploit it -- basically assuming there are going to be errors in implementations. That's understood to be a standard technique in the IC, and a whole industry built around it... and then, the scale of compromise.

There are lots of mitigation techniques for vulnerabilities like this (essentially, devices which are too fast-changing and too difficult to fully trust, but which have to touch sensitive data), but it's not as if people can carry around a firewall in their pocket these days, sadly.

I'm certainly re-generating any keys which touched iOS or OSX devices (thankfully very few), and reinstalling OSes, in the interim.

and goto statements everywhere :S