Apple's SSL/TLS bug • Hacker News Board

Re: Apple's SSL/TLS bug

#221

Post by emmelaich » Sat, Feb 22, 2014, 10:20 PM UTC

joe_bleau wrote: post #125

apaprocki wrote: post #23

Worth noting that static analysis finds bugs like this immediately. TLS code seems like the perfect candidate to run through static analysis on every checkin. There are products such as Coverity and PVS-Studio that would have immediately flagged this and probably some open-source ones built around LLVM as well (unsure about this one, though). I personally use Coverity and have it hooked up in the same way everyone co…

Yep, PC-lint from Gimpel catches it: Error -> Warning 527 Unreachable code at token 'ret' (col 12)

Nice. Does PC-lint give a lot of false negatives and positives as well?

Re: Apple's SSL/TLS bug

#222

Post by lstamour » Sat, Feb 22, 2014, 10:41 PM UTC

hueving wrote: post #187

jey wrote: post #181

Earlier quoted context omitted.

Not true. IIRC, the way the Debian bug was found was by some parties noticing a bunch of collisions of SSH public keys. (For example, Github lets you push/pull via SSH as git@github.com, and they determine your identity by the SSH key used.)

How is what I said not true? If the same thing as the Deb prng bug happened in a closed source system, it could sit for a couple of years exposing thousands/millions of systems and then be patched quietly to avoid embarrassment, leaving everyone vulnerable.

FYI -- the source code here is public. Didn't help :D

Re: Apple's SSL/TLS bug

#223

Post by lstamour » Sat, Feb 22, 2014, 10:43 PM UTC

rdl wrote: post #168

atmosx wrote: post #96

Earlier quoted context omitted.

Indeed the only secure OS nowadays is Linux. Everything else should be considered compromised by default a priori.

ChromeOS is by far the safest thing out of the box, IMO.

Um, sure, after it updates. Assuming a similar bug isn't found there and exploited when it connects to the Internet. Since, you know, it can't do anything without a network connection. Just playing devils advocate here, I like ChromeOS too.

Re: Apple's SSL/TLS bug

#224

Post by nfoz » Sat, Feb 22, 2014, 10:44 PM UTC

rdl wrote: post #146

kps wrote: post #133

Earlier quoted context omitted.

> I think anyone relying on the security of OS X is going to have to seriously rethink their OS choice after this. 10.7.3 logging FileFault (that was a typo, but I think I'll keep it) passwords in plain text might have been a subtle hint in that direction.

They've honestly done a pretty great job on iOS security (at least since iPad 2/iPhone 3GS). OSX, not as much.

How can you know?

Re: Apple's SSL/TLS bug

#225

Post by lstamour » Sat, Feb 22, 2014, 10:44 PM UTC

lunixbochs wrote: post #208

lisper wrote: post #154

Earlier quoted context omitted.

Ah, right. Good point.

If the code to Security.framework is complete and builds, we might not need to patch the binary directly.

It appears to be in a cursory glance. Loaded for me in Xcode. That said, signing the security framework would be another issue ;-) I can't imagine apple would let malware replace security binaries that easily.

Re: Apple's SSL/TLS bug

#226

Post by jaimeyap » Sat, Feb 22, 2014, 10:46 PM UTC

I continue to be baffled as to why Apple hasn't rolled out a security update for this issue on OS X.

Re: Apple's SSL/TLS bug

#227

Post by lstamour » Sat, Feb 22, 2014, 10:48 PM UTC

Can't wait for Apple to patch this bug? Downgrade to 10.8.5 ...

The answer here, folks, is don't update until all the bugs have been found and fixed. Apple's golden days of OS updates was back in 10.6, when they spent most of the time just fixing bugs rather than adding new features. Every OS update since has had as many bugs as it fixed, though overall things were getting better.

It's the old Wait-until-SP1 advice. For security, it's often true. The exception being if the patch cycle is fast enough...I'm not going to say for sure whether one is better than another.

Re: Apple's SSL/TLS bug

#228

Post by jokoon » Sat, Feb 22, 2014, 10:56 PM UTC

I wonder if this would have as much attention without the Snowden leaks. I guess yes.

Not to be a conspiracy theorist, but history tells that computer technology was released to the public, so to me it still looks like there is no absolute objective, safe way to use a computer for a layman. It still looks more like a tool of surveillance than a tool of communication.

You'd want my opinion, but I'd be apple (or Linux for the days that happened for a certain commit with a =!0 thing), I'd try to sue the guy who was responsible for this commit.

You could argue in court that it's impossible to prove if it's voluntary, but I guess we must set an example and start to hold anyone responsible for this. It's time to set the courts aware of computer security standards...

Re: Apple's SSL/TLS bug

#229

Post by [deleted] » Sat, Feb 22, 2014, 10:57 PM UTC

MBCook wrote: post #219

javajosh wrote: post #207

Something that concerned me was things like software update daemons connecting with SSL. Can they be compromised? Or is this something that requires connecting to a black-hat server?

If all methods of updating need SSL, and SSL is broken, then there's no real way to securely ship a patch.

[deleted]

Re: Apple's SSL/TLS bug

#230

Post by [deleted] » Sat, Feb 22, 2014, 11:01 PM UTC

jokoon wrote: post #228

I wonder if this would have as much attention without the Snowden leaks. I guess yes. Not to be a conspiracy theorist, but history tells that computer technology was released to the public, so to me it still looks like there is no absolute objective, safe way to use a computer for a layman. It still looks more like a tool of surveillance than a tool of communication. You'd want my opinion, but I'd be apple (or Linux…

[deleted]