Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple releases OS X Mavericks 10.9.2 with SSL fix

9to5mac.com

Post reply on HN
Print view View original

191–200 of 246 posts

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#191

Post by sneak »

aethr wrote: post #179
eslaught wrote: post #156

Earlier quoted context omitted.

> "It's not "just a bug". Yes, everyone makes mistakes, we're all human. But it's completely unacceptable that those mistakes get unnoticed and into production code of such a critical component, and deployed to millions of users." This is not a reasonable argument. At Pwn2Own each year, how many browsers have vulnerabilities that allow remote code execution? All of them. How many of these vulnerabilities are zero-day…

While it's true that almost all software has bugs that can result in exploits, I think most of the exploits used in Pwn2Own are typically the result of complex interactions between subsystems that are hard to predict. As software gets more complex, the attack surface increases. The Apple bug isn't really in that class of exploit. It's a simple coding/merge error, and it's actually a regression from previously working…

Two entire operating systems.

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#192

Post by sneak »

sbuk wrote: post #180
ambrop7 wrote: post #177

Earlier quoted context omitted.

Hence the "or". In this case, stupidity is equally unacceptable.

No. To err is human. In the grand scheme of things, it's a PR fuck up; nothing more. I doubt it affects you directly enough as a Gentoo user to have such a strong reaction anyway, but if it make you feel superior, then all power to you. Lighten up and have a look at this and ask your self if you have honestly never done the same thing: http://xkcd.com/292/ if you think you haven't, I can gaur tee that you are deludin…

The error is not that of the programmer's. The fault is not in code, it's in processes that were chosen by management.

Indeed, to err is human. This is why you're a negligent jackass if you don't plan for errors and build multiple systems to prevent and detect them, at least until computers start programming themselves for us.

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#193

Post by joeblau »

ctolsen wrote: post #95
ambrop7 wrote: post #80

Earlier quoted context omitted.

It's getting attention because: - It's an easy to spot bug, - in the most critical part of the code, - of a fundamental security library, - and it's been there for a long time, nobody knows how many systems have already been compromised due to it. With this bug, Apple's library isn't actually a SSL implementation. It does not perform the most essential part of a SSL implementation - verifying that the peer possesses…

It's even more unacceptable that it took them FOUR DAYS to fix it, just so they could add a couple of features to FaceTime while they were at it.

Facetime Audio on Mac! Heck yes, finally.

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#194

Post by thirsteh »

eridius wrote: post #141
chimeracoder wrote: post #101

Earlier quoted context omitted.

> But it's completely unacceptable that those mistakes get unnoticed and into production code of such a critical component, and deployed to millions of users. The handling has been abysmal as well. They dropped a 0-day on themselves by releasing the iOS update, and then delayed the fix by several days, apparently so they could release it along with the Facetime integration. And even then they don't mention it on the…

> The handling has been abysmal as well. They dropped a 0-day on themselves by releasing the iOS update, and then delayed the fix by several days, apparently so they could release it along with the Facetime integration. The only alternative would have been to delay the iOS release, which they didn't do because almost certainly this bug was already being exploited in the wild. All this did was make more people aware o…

> As for OS X release, I'm sure they released it as fast as they could. It has nothing to do with releasing along with FaceTime integration, and everything to do with 10.9.2. was already going through the GM process, and it was faster/easier to add this fix into that and continue trying to validate the GM than it was to spin up an entirely new train for a 10.9.1.1 with just this fix and try to validate that.

If this is true, then their process could use some adjustment. Contrast with Google Chrome which has the regular motion of changes going through channels, but the ability to update virtually all clients within a matter of hours if a critical issue is found.

(I realize there is a lot more QA necessary for an OS update, but I'm not convinced that a fix for this specific bug would have taken a long time to QA. Certainly not anywhere near as long as we've waited for this update, or as long as a lot of people will delay installing it because it is huge.)

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#195

Post by porsupah »

brown9-2 wrote: post #35

What about non-Mavericks versions of OS X?

Tested with OS X 10.8.5 and Safari 6.0.5, gotofail.com declared the bug wasn't present. (At first, it declined to run the test, having concluded it didn't need to; following the link to explicitly run the test gave the "safe" result)

FWIW, applying the security update also installs iTunes 11, which users of Requiem may want to take note of.

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#197

Post by ecmendenhall »

sneak wrote: post #189
ecmendenhall wrote: post #115

This bug was pretty serious. I'd better be extra careful and install and verify this myself. Oh, good: there's a standalone installer available ( http://support.apple.com/kb/DL1726 ). But the download is served over HTTP. Maybe I can just try the same URL with HTTPS: $ curl --head https://support.apple.com/downloads/DL1726/en_US/OSXUpdCombo10.9.2.dmg HTTP/1.1 302 Moved Temporarily Server: Apache/2.2.24 (Unix) Locatio…

This is all pointless handwaving; the update package itself is signed and will not install if tampered with, regardless of TLS certs used to download it. TLS is not used to authenticate the update.

Ah, right. That makes sense. If only it was mentioned on the download page!

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#199

Post by Zhenya »

ambrop7 wrote: post #80
e1ven wrote: post #66

Forgive me, but I'm not really sure why this is getting so much attention. It's certainly a bad bug, and it ought to have been caught. But it feels like this would be much harder to exploit than many other bugs which have had far less hoopla. As I understand, this SSL bug makes it rather trivial to perform MITM attacks against apps which use the default system SSL libs. That's certainly a problem, but most people are…

It's getting attention because: - It's an easy to spot bug, - in the most critical part of the code, - of a fundamental security library, - and it's been there for a long time, nobody knows how many systems have already been compromised due to it. With this bug, Apple's library isn't actually a SSL implementation. It does not perform the most essential part of a SSL implementation - verifying that the peer possesses…

What does it mean to "steam your online account"?

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#200

Post by eridius »

codeka wrote: post #152
eridius wrote: post #141

Earlier quoted context omitted.

> The handling has been abysmal as well. They dropped a 0-day on themselves by releasing the iOS update, and then delayed the fix by several days, apparently so they could release it along with the Facetime integration. The only alternative would have been to delay the iOS release, which they didn't do because almost certainly this bug was already being exploited in the wild. All this did was make more people aware o…

>The only alternative would have been to delay the iOS release Right. This is basically Apple violating their own "responsible disclosure" policy and announcing a 0-day vulnerability in OS X. They should have delayed the release of the iOS patch until the OS X one was ready. This is the whole point of responsible disclosure: maybe the vulnerability is being used in the wild, but by delaying release of it until the ve…

As I said, the iOS bug was almost certainly already being exploited. Delaying the release of a fix for that seems like the absolute last thing anyone should be suggesting they do.
Post reply on HN