Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple releases OS X Mavericks 10.9.2 with SSL fix

9to5mac.com

Post reply on HN
Print view View original

171–180 of 246 posts

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#171

Post by rimantas »

dola wrote: post #150

What I wonder, is if Apple can be held responsible (to some extent) for damages that resulted due to this bug for app developers like a bank whose customers were robbed because the bank relied on the secure connection as it should have been provided by the Apple API. Clearly, the attacker is still the person to have exploited the bug but I think a developer should be able to assume that Apples security relevant API f…

Does it have a precedent with gaziilions of other bugs on all platforms? It is really fun to watch how "hey I understand this one" turns into "the most dangerous and evil bug on any platform evah".

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#172

Post by sbuk »

ambrop7 wrote: post #158
eslaught wrote: post #156

Earlier quoted context omitted.

> "It's not "just a bug". Yes, everyone makes mistakes, we're all human. But it's completely unacceptable that those mistakes get unnoticed and into production code of such a critical component, and deployed to millions of users." This is not a reasonable argument. At Pwn2Own each year, how many browsers have vulnerabilities that allow remote code execution? All of them. How many of these vulnerabilities are zero-day…

As I said: It's not just another security bug. It's an easy to spot bug, in the most critical part of the code, of a fundamental security library. THIS is what makes it unacceptable. It pretty much means the change has never gone through code review, or has been planted.

> “It pretty much means that the change has never gone through code review, or has been planted.” Or Hanlon's Razor; “Never attribute to malice that which is adequately explained by stupidity.” Going straight to dumb-ass conspiracy theories it what is unacceptable.

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#173

Post by rmc »

eridius wrote: post #141
chimeracoder wrote: post #101

Earlier quoted context omitted.

> But it's completely unacceptable that those mistakes get unnoticed and into production code of such a critical component, and deployed to millions of users. The handling has been abysmal as well. They dropped a 0-day on themselves by releasing the iOS update, and then delayed the fix by several days, apparently so they could release it along with the Facetime integration. And even then they don't mention it on the…

> The handling has been abysmal as well. They dropped a 0-day on themselves by releasing the iOS update, and then delayed the fix by several days, apparently so they could release it along with the Facetime integration. The only alternative would have been to delay the iOS release, which they didn't do because almost certainly this bug was already being exploited in the wild. All this did was make more people aware o…

The hell with GM process. There should be a way to push out simple changes like this, as soon as possible, for cases like this which is very important.

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#174

Post by rmc »

codeka wrote: post #152
eridius wrote: post #141

Earlier quoted context omitted.

> The handling has been abysmal as well. They dropped a 0-day on themselves by releasing the iOS update, and then delayed the fix by several days, apparently so they could release it along with the Facetime integration. The only alternative would have been to delay the iOS release, which they didn't do because almost certainly this bug was already being exploited in the wild. All this did was make more people aware o…

>The only alternative would have been to delay the iOS release Right. This is basically Apple violating their own "responsible disclosure" policy and announcing a 0-day vulnerability in OS X. They should have delayed the release of the iOS patch until the OS X one was ready. This is the whole point of responsible disclosure: maybe the vulnerability is being used in the wild, but by delaying release of it until the ve…

The point of responsible disclosure (as opposed to telling the company and then not telling anyone) is to force the company into action, and force them to fix it with the threat of public disclosure later

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#175

Post by hughw »

ambrop7 wrote: post #123
msbarnett wrote: post #118

Earlier quoted context omitted.

Updates are signed and the OS will refuse to run them if signature verification fails, so unless your MITM has Apple's signing key that wouldn't work. (And no, this bug didn't break client-side signed package verification.)

Unless your box has already been pwnd and the update installer has been modified to not install that update in the way it was meant to be.

You make a valid, and well understood point. Ken Thompson's classic paper: http://cm.bell-labs.com/who/ken/trust.html

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#176

Post by rmc »

Jare wrote: post #45
lucian1900 wrote: post #31

Earlier quoted context omitted.

It's still inexcusable. The security update should have been immediate and separate.

You still need a minimal amount of testing and release packing. 4 days for an OS update is pretty good response time IMHO, and I thank the Apple engineers that probably worked their asses off to get this mess sorted out. What this doesn't excuse is disclosing the iOS bug before all fixes are ready. THAT was the major scrweup.

Apple had more than 4 days. Apple knew about and fixed the iOS bug. We don't know when they became aware of the SSL bug (in iOS & OSX), but it certainly wasn't on the day that Apple released the OSX bug

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#177

Post by ambrop7 »

sbuk wrote: post #172
ambrop7 wrote: post #158

Earlier quoted context omitted.

As I said: It's not just another security bug. It's an easy to spot bug, in the most critical part of the code, of a fundamental security library. THIS is what makes it unacceptable. It pretty much means the change has never gone through code review, or has been planted.

> “It pretty much means that the change has never gone through code review, or has been planted.” Or Hanlon's Razor; “Never attribute to malice that which is adequately explained by stupidity.” Going straight to dumb-ass conspiracy theories it what is unacceptable.

Hence the "or". In this case, stupidity is equally unacceptable.

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#179

Post by aethr »

eslaught wrote: post #156
ambrop7 wrote: post #80

Earlier quoted context omitted.

It's getting attention because: - It's an easy to spot bug, - in the most critical part of the code, - of a fundamental security library, - and it's been there for a long time, nobody knows how many systems have already been compromised due to it. With this bug, Apple's library isn't actually a SSL implementation. It does not perform the most essential part of a SSL implementation - verifying that the peer possesses…

> "It's not "just a bug". Yes, everyone makes mistakes, we're all human. But it's completely unacceptable that those mistakes get unnoticed and into production code of such a critical component, and deployed to millions of users." This is not a reasonable argument. At Pwn2Own each year, how many browsers have vulnerabilities that allow remote code execution? All of them. How many of these vulnerabilities are zero-day…

While it's true that almost all software has bugs that can result in exploits, I think most of the exploits used in Pwn2Own are typically the result of complex interactions between subsystems that are hard to predict. As software gets more complex, the attack surface increases.

The Apple bug isn't really in that class of exploit. It's a simple coding/merge error, and it's actually a regression from previously working code. One of the things that worries me is that this bug would have been caught so easily with basic unit tests.

    Test 1: Make connection to server with a valid SSL certificate [PASSED]
    Test 2: Make connection to a server with an invalid SSL certificate [FAILED]
Are we meant to think that Apple's build process doesn't use unit testing? Seems unlikely. Or perhaps this component didn't warrant an extensive test suite? I hope not! Not really sure what the explanation is.

I mean, I certainly can't claim that all my code is run through extensive tests before every deploy, but then I'm not working on the security tools that underpin an entire operating system.

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#180

Post by sbuk »

ambrop7 wrote: post #177
sbuk wrote: post #172

Earlier quoted context omitted.

> “It pretty much means that the change has never gone through code review, or has been planted.” Or Hanlon's Razor; “Never attribute to malice that which is adequately explained by stupidity.” Going straight to dumb-ass conspiracy theories it what is unacceptable.

Hence the "or". In this case, stupidity is equally unacceptable.

No. To err is human. In the grand scheme of things, it's a PR fuck up; nothing more. I doubt it affects you directly enough as a Gentoo user to have such a strong reaction anyway, but if it make you feel superior, then all power to you. Lighten up and have a look at this and ask your self if you have honestly never done the same thing: http://xkcd.com/292/ if you think you haven't, I can gaur tee that you are deluding yourself...
Post reply on HN