Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple releases OS X Mavericks 10.9.2 with SSL fix

9to5mac.com

Post reply on HN
Print view View original

181–190 of 246 posts

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#181

Post by beedogs »

serge2k wrote: post #18
pivo wrote: post #16

Hope it also fixes the "issue" where my 2013 Macbook Pro reboots when it wakes up from sleep if there's a USB drive attached.

Mine grey screens when I have my usb hub plugged in at startup (doesn't get to partition selection). Android file transfer utility stops the keyboard and touchpad from working.

Having similar weird USB issues on my 13" late 2013 MBP. It's been really, really crappy since I bought it. Same issues with keyboard and touchpad breaking under random applications. Apple seems to be completely ignoring the issue aside from a botched "fix" in November.

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#182

Post by renaudg »

res0nat0r wrote: post #169
ambrop7 wrote: post #158

Earlier quoted context omitted.

As I said: It's not just another security bug. It's an easy to spot bug, in the most critical part of the code, of a fundamental security library. THIS is what makes it unacceptable. It pretty much means the change has never gone through code review, or has been planted.

While working at AWS and seeing outages being posted here, and the wildly inaccurate summaries (guesses) of what the problems were, and the wildly simplistic fixes that are assumed to easily be put in place I can say: systems like this are more complicated than you think they are.

A huge +1 to this, from someone who worked at Facebook.

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#183

Post by renaudg »

ctolsen wrote: post #95
ambrop7 wrote: post #80

Earlier quoted context omitted.

It's getting attention because: - It's an easy to spot bug, - in the most critical part of the code, - of a fundamental security library, - and it's been there for a long time, nobody knows how many systems have already been compromised due to it. With this bug, Apple's library isn't actually a SSL implementation. It does not perform the most essential part of a SSL implementation - verifying that the peer possesses…

It's even more unacceptable that it took them FOUR DAYS to fix it, just so they could add a couple of features to FaceTime while they were at it.

10.9.2 has been in beta for weeks and was evidently just about to be released. It made a lot of sense from a QA perspective to do it just the way they did.

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#185

Post by bandushrew »

ambrop7 wrote: post #161
eslaught wrote: post #156

Earlier quoted context omitted.

> "It's not "just a bug". Yes, everyone makes mistakes, we're all human. But it's completely unacceptable that those mistakes get unnoticed and into production code of such a critical component, and deployed to millions of users." This is not a reasonable argument. At Pwn2Own each year, how many browsers have vulnerabilities that allow remote code execution? All of them. How many of these vulnerabilities are zero-day…

I am interested to hear your opinion: at what point should a vulnerability be considered unacceptable?

I dont even know what that would mean, to make an existing vulnerability 'unacceptable'.

Vulnerabilities of all kinds exist. We need to find them, learn from them and we need to fix them.

Getting hung up on whether or not they are 'acceptable' is just kind of weird.

Bad stuff happens, incompetence happens, mistakes happen. None of that is 'acceptable', but it happens just the same.

Creating an environment where some kinds of mistakes are 'unacceptable' doesn't eliminate those kinds of mistakes, it just causes people to stop reporting them.

Complaining about their release cycle makes some sense. complaining about the existence of an existing bug is basically just howling at the moon.

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#186

Post by Shish2k »

ecmendenhall wrote: post #115

This bug was pretty serious. I'd better be extra careful and install and verify this myself. Oh, good: there's a standalone installer available ( http://support.apple.com/kb/DL1726 ). But the download is served over HTTP. Maybe I can just try the same URL with HTTPS: $ curl --head https://support.apple.com/downloads/DL1726/en_US/OSXUpdCombo10.9.2.dmg HTTP/1.1 302 Moved Temporarily Server: Apache/2.2.24 (Unix) Locatio…

Seems ironic that of all the patches that don't get served over SSL, the "SSL is meaningless" bug is the one where you'd point out that SSL should be available :P

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#187

Post by sneak »

meowface wrote: post #51
Jare wrote: post #45

Earlier quoted context omitted.

You still need a minimal amount of testing and release packing. 4 days for an OS update is pretty good response time IMHO, and I thank the Apple engineers that probably worked their asses off to get this mess sorted out. What this doesn't excuse is disclosing the iOS bug before all fixes are ready. THAT was the major scrweup.

Nope, I disagree. Microsoft releases emergency hotfixes within about 24 hours usually, if a security vuln is critical enough. And this one is definitely extremely critical.

Did you read the release notes? There were several arbitrary code exec overflows and a sandbox bypass that were patched as well. Nobody is freaking out that these took days or weeks to ship...

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#188

Post by Shish2k »

e1ven wrote: post #66

Forgive me, but I'm not really sure why this is getting so much attention. It's certainly a bad bug, and it ought to have been caught. But it feels like this would be much harder to exploit than many other bugs which have had far less hoopla. As I understand, this SSL bug makes it rather trivial to perform MITM attacks against apps which use the default system SSL libs. That's certainly a problem, but most people are…

> most people are using trustworthy ISPs

Have you not seen the news, at all, for the past several months? There have been a few revalations that perhaps some ISPs are not entirely trustworthy, to say the least...

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#189

Post by sneak »

ecmendenhall wrote: post #115

This bug was pretty serious. I'd better be extra careful and install and verify this myself. Oh, good: there's a standalone installer available ( http://support.apple.com/kb/DL1726 ). But the download is served over HTTP. Maybe I can just try the same URL with HTTPS: $ curl --head https://support.apple.com/downloads/DL1726/en_US/OSXUpdCombo10.9.2.dmg HTTP/1.1 302 Moved Temporarily Server: Apache/2.2.24 (Unix) Locatio…

This is all pointless handwaving; the update package itself is signed and will not install if tampered with, regardless of TLS certs used to download it.

TLS is not used to authenticate the update.

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#190

Post by dfc »

brudgers wrote: post #159
dfc wrote: post #133

Earlier quoted context omitted.

In addition to pillf's suggestion: 1. Use linux/fbsd/obsd/win box to download update. 2. Verify authenticity of cert/sha1 3. scp dmg / copy to USB drive 4. Apply update and move on.

"Mom, First use linux/fbsd/obsd/win box to download update. Next verify authenticity of cert/sha1. Then just scp dmg / copy to USB drive, apply update and move on." If you're 13, add "duh" at the end.

That is a cute response. The only problem is that you are substituting "mom" for OP.

Did the mother of your thirteen year old preface her question with "I already tried to use curl but then I realized that would not work. Then I thought I could verify the SHA1 but I realized I was obtaining the sha1 value over an insecure channel."?

Post reply on HN