101–110 of 155 posts
Earlier quoted context omitted.
It appears to be, per https://gist.github.com/rmoriz/fb2b0a6a0ce10550ab73 (and my own testing on OS X 10.9.1).
I'm able to reproduce your results with cURL. However, Safari on OS X correctly shows a warning. Can anybody explain that?
Earlier quoted context omitted.
Because it's not a blatant regression, it's a complicate bug that requires a custom-patched TLS stack on the server to be explocited. As Adam Langley put it: > A test case could have caught this, but it's difficult because it's so deep into the handshake. One needs to write a completely separate TLS stack, with lots of options for sending invalid handshakes. In Chromium we have a patched version of TLSLite to do this…
Except: ensuring that the server is signing with the right, certificate-certified private key is the major thing that TLS is supposed to provide. So no matter how strange or malicious the server-side stack would need to be... not having a test for such a deviation is a major oversight.
Earlier quoted context omitted.
They'd also need access to Apple's private keys.
Not at all: that's the bug. It's not properly verifying that the other-end of a TLS session is the entity able to sign with the certificate-declared private-key.
Of course the jailbreaking community knows well that there have been many ways around that...
Earlier quoted context omitted.
> Don't C compilers warn about code that is never executed? Not by default. On both GCC and Clang this kind of error isn't caught using -Wall or even -Wextra - you have to explicitly opt-in using -Wunreachable-code. It'd really be nice if that changed and Clang basically had close to -Weverything on by default and required you to opt out, preferably with something like `#pragma ALLOW_SHODDY_ ` per file to put some pr…
In the latest GCC releases, -Wunreachable-code has been removed (the option still exists but is silently ignored for compat with existing Makefiles), as its output varied so much between releases (depending on what got optimized away).
Just sell me the beautiful hardware.
I'll manage installing an OS that's 1. audited by a community of volunteers I generally trust and 2. can be audited (read: modified) by me: I can compile it from scratch.
Apple's OS offerings provide neither 1 nor 2.
But, go figure, Apple's OS offerings are based off of OS code that is both 1 and 2.
Like a "Linux distro", Apple gives me a lot of stuff I do not want or need, and makes it very difficult if nt impossible to remove.
I want a very minimal BSD or Plan9 OS running on my Apple hardware.
And nothing more.
Hardware we purchase should come with full documentation for writing drivers.
If enough users demand this, maybe someday it will.
Maybe Apple should stick to hardware. Just sell me the beautiful hardware. I'll manage installing an OS that's 1. audited by a community of volunteers I generally trust and 2. can be audited (read: modified) by me: I can compile it from scratch. Apple's OS offerings provide neither 1 nor 2. But, go figure, Apple's OS offerings are based off of OS code that is both 1 and 2. Like a "Linux distro", Apple gives me a lot…
Everything has bugs, community volunteers are not infallible. It's good to be able to audit the things you use, but most people can't or won't do it.
As it happens, Secure Transport (edit: on OS X) is open source. I just spent the last hour rummaging through source code ... It was later renamed to "libsecurity_ssl" when it landed on iOS. It's been around since OS X launched. They also have a folder with about four dozen regression tests and a test app, not that I've had the chance to inspect either that closely. The tarballs are spread across two folders in the ta…
Take a look at http://opensource.apple.com/source/Security/Security-55471/l... specifically check the function SSLVerifySignedServerKeyExchange I leave the joy of spotting it to you. It is obvious and if you know c you'll see it(You don't need any knowledge of crypto).
Just to be clear: /usr/bin/curl on Mavericks suffers from this problem: ~ /usr/bin/curl https://imperialviolet.org:1266 If you can see this message then[...] Keep that in mind when you download an installer using curl and pipe it to bash.
Edit: apparently curl does use Secure Transport on OS X as of 7.27:
http://curl.haxx.se/mail/lib-2012-06/0334.html
http://daniel.haxx.se/blog/2012/06/28/darwin-native-ssl-for-...
Earlier quoted context omitted.
Take a look at http://opensource.apple.com/source/Security/Security-55471/l... specifically check the function SSLVerifySignedServerKeyExchange I leave the joy of spotting it to you. It is obvious and if you know c you'll see it(You don't need any knowledge of crypto).
Does anyone else look at this file and suddenly have a greater appreciation that their company uses a cumbersome, time-consuming code review process which enforces an annoying, rigid code style?
I thought I would hate this model but I absolutely love it. It's the next best thing to pair programming and somewhat less exhausting.
Earlier quoted context omitted.
Here's a little bit of a conspiracy theory for you. There's an old saying: "there are no coincidences on Wall Street". Not with the amounts of money that are involved. I think something similar should apply to critical security code. This reminds me of when someone tried to add the following to the Linux kernel: if ((options == (__WCLONE|__WALL)) && (current->uid = 0)) retval = -EINVAL; Oops, is that "uid == 0", or i…
How could this not happen in Python?