241–250 of 295 posts
Earlier quoted context omitted.
They've honestly done a pretty great job on iOS security (at least since iPad 2/iPhone 3GS). OSX, not as much.
Disagree. They can't even keep the lock screen secure. Any major or point release there's been a bypass exploit.
http://www.androidcentral.com/samsung-lock-screen-bypassed-e...
Earlier quoted context omitted.
> NSA is not my most serious threat I wish more people understood this. Not to let NSA off the hook (what they are doing is awful), but the threat posed by the NSA is a higher-level down the road/slippery slope threat. There are other more immediate and real dangers out there that are actively trying to steal whatever they can find.
It also very much depends on which side of the Atlantic you are living on.
Earlier quoted context omitted.
3) Hidden in plain sight I'm baffled that this wasn't caught long, long ago. Most of us have worked with internal systems where certs, for whatever reason, don't match the site, and it's surprising many people haven't noted that such doesn't raise any errors on iOS/OSX. Though thinking back....I actually remember encountering exactly that on the iPad once, surprised that it didn't raise a flag. Like probably most I j…
Because it does not work like that. SecureTransport actually verifies the validity of the TLS certificate. If you hand it an invalid certificate in the first place, it will complain. The issue is one level deeper. When you connect to a server that supports ephemeral key exchange, the parties involved will generate new key pairs on the fly to use for that connection. In order to make sure that the server has the key p…
Earlier quoted context omitted.
Nope, it's actually pretty decent C. With a bug.
this pattern is structured to avoid the use of an additional stack (local) variable to track a condition, and to skip superfluous execution of code once that condition is detected. i've used it myself to optimize inner loops of very simple un-accelerated graphics rendering code (which sped it up considerably, since it is potentially skipping many levels of unnecessary execution on the cpu, millions of times), but i a…
Earlier quoted context omitted.
Requiring braces is the wrong solution to the problem. It's the indentation that misleads here; indentation is what people look at to see what's part of which if, so have the language look at the same thing, like Python does.
Indeed, but I wonder if indenting would have helped here. Two gotos immediately after one another at the same indentation level is obviously wrong by visual inspection. Proper indentation might have led the casual viewer to think that the code was actually ok!
Earlier quoted context omitted.
FYI -- the source code here is public. Didn't help :D
It helped us realize how easy it would be to test for this, and that Apple isn't.
Earlier quoted context omitted.
> Dijkstra always contended GOTOs were harmful! - The bug here has nothing to do with GOTO. - Dijkstra said a lot of stupid things, this is one of them. Parsimonious use of GOTO is fine and sometimes leads to clearer code (exiting deeply nested conditions for example). - Another stupid thing that Dijkstra said is that anyone who started by learning BASIC has their brain corrupted forever, which is total nonsense (I b…
There is a context missing. The Dijkstra quote is really old (Wikipedia dates it to 1975) and do not talk about "modern Basic" we know, with a good support for structured programming -- it's about a language where GOTO's were used instead of proper loops. It's certainly still an exageration to speak about "brain corruption", but I think I know why he put such emphasis on the statement.
Earlier quoted context omitted.
Requiring braces is the wrong solution to the problem. It's the indentation that misleads here; indentation is what people look at to see what's part of which if, so have the language look at the same thing, like Python does.
Indeed, but I wonder if indenting would have helped here. Two gotos immediately after one another at the same indentation level is obviously wrong by visual inspection. Proper indentation might have led the casual viewer to think that the code was actually ok!
Earlier quoted context omitted.
> How is this code not covered by a unit test? ...or an integration test. or a functional test. When you write an SSL lib, I suspect that at some point you ought to test that it checks f%^&ing certificates :/
Negligence or malice. My theory is that Apple is spread too thin. Kayak.com reproducibly crashed MobileSafari the day iOS7 shipped, and brand new iPad minis regularly kernel panic and reboot. It wasn't always like this.
Earlier quoted context omitted.
> Their destructors will be called, in reverse order, regardless of how the function is exited. Not in C.
Yes, one makes a conscious choice of implementation language. They aren't dictated by the laws of physics. Choosing your implementation language is a rather important step.