Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple releases OS X Mavericks 10.9.2 with SSL fix

9to5mac.com

Post reply on HN
Print view View original

201–210 of 246 posts

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#201

Post by eridius »

rmc wrote: post #173
eridius wrote: post #141

Earlier quoted context omitted.

> The handling has been abysmal as well. They dropped a 0-day on themselves by releasing the iOS update, and then delayed the fix by several days, apparently so they could release it along with the Facetime integration. The only alternative would have been to delay the iOS release, which they didn't do because almost certainly this bug was already being exploited in the wild. All this did was make more people aware o…

The hell with GM process. There should be a way to push out simple changes like this, as soon as possible, for cases like this which is very important.

That's a great way to let a bad build slip out, which would do significantly more harm than any bug it could possibly hope to fix.

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#204

Post by spiralpolitik »

dola wrote: post #150

What I wonder, is if Apple can be held responsible (to some extent) for damages that resulted due to this bug for app developers like a bank whose customers were robbed because the bank relied on the secure connection as it should have been provided by the Apple API. Clearly, the attacker is still the person to have exploited the bug but I think a developer should be able to assume that Apples security relevant API f…

Remember that software license you clicked while installing ? Most likely it had something like:

THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.

So yeah Apple can't be held responsible. If they could then the whole free software open source community would be in deep doo doo.

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#205

Post by spiralpolitik »

rch wrote: post #112
cpach wrote: post #89

Earlier quoted context omitted.

If you don’t run Mavericks you’re not affected by the goto fail.

Yep, I know. As discussed a couple of days ago. I think I'm just bothered by my perception that this Mavericks upgrade is being presented as a fix for an OS X security issue, rather than just offering a patch to Mavericks users.

My guess is that the time to get the 10.9.2 release out the door was less then it would have taken to get a seperate patch done.

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#207

Post by gwu78 »

A compelling way to get holdouts to upgrade iOS/OSX. Get those iPhone 4 folks who are content with iOS 6.x to install iOS 7.x.

God only knows what incompetence and disregard for user privacy and sanity awaits in these "new" versions. What are they adding that we really need? Oh, the ability to use SSL PKI. Yeah, I guess you have to upgrade.

Why isn't HN discussing the effects this screw up has on email? Email is bigger than the web, belive it or not.

And most of the world appears to use webmail.

With this "bug" HTTPS for your webmail is futile.

You have no way to know you are connecting to the real googlemail, yahoomail, hotmail, etc.

The "authentication" functions of SSL need to be made an compilation option, not a default.

It's obvious almost no knows or cares how to use SSL's PKI mechanism properly.

SSL's encryption capabilities have been useful, but using SSL to do server authentication causes more problems than it solves.

History has shown it's just not easy enough to use.

SSH can do authentication without PKI. Alas, it is embedded into a program that only nerds use.

I'm using the authentication framework in CurveCP. I'm working on making it very easy to use.

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#208

Post by brudgers »

dfc wrote: post #190
brudgers wrote: post #159

Earlier quoted context omitted.

"Mom, First use linux/fbsd/obsd/win box to download update. Next verify authenticity of cert/sha1. Then just scp dmg / copy to USB drive, apply update and move on." If you're 13, add "duh" at the end.

That is a cute response. The only problem is that you are substituting "mom" for OP. Did the mother of your thirteen year old preface her question with "I already tried to use curl but then I realized that would not work. Then I thought I could verify the SHA1 but I realized I was obtaining the sha1 value over an insecure channel."?

Steady now, that's my mother you're talking about...

I agree that context matters. That's why statistically the proposed solution isn't a solution. It doesn't really work in a way that address the serious issue because the serious issue is the sheer magnitude of the number of compromised systems.

To put it another way, if you have a Linux or Windows or BSD box why keep a potentially deeply compromised OSX installation around at all. The patch isn't going to unpwn a pwnd box. The hoops might insure the patch isn't compromised but in terms of system security the horse is out of the barn and all the way to the glue factory.

The only case where jumping through those hoops makes a difference is in the second best case. And that's statistically equivalent to the best case and preparing for the best case in regard to security goes by the name of "wishful thinking."

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#209

Post by lugg »

rmc wrote: post #173
eridius wrote: post #141

Earlier quoted context omitted.

> The handling has been abysmal as well. They dropped a 0-day on themselves by releasing the iOS update, and then delayed the fix by several days, apparently so they could release it along with the Facetime integration. The only alternative would have been to delay the iOS release, which they didn't do because almost certainly this bug was already being exploited in the wild. All this did was make more people aware o…

The hell with GM process. There should be a way to push out simple changes like this, as soon as possible, for cases like this which is very important.

The GM process is there precisely to stop bugs like this malingbit into production. Who knows how many potential bugs it has stopped. You can't know.

To play the devil a bit, their process still needs some work, there isn't a good reason why they couldnt have released this patch in its own approval process simultaneously with a higher priority for staff to choose it over facetime.

Re: Apple releases OS X Mavericks 10.9.2 with SSL fix

#210

Post by eropple »

saurik wrote: post #111
ctolsen wrote: post #100

Earlier quoted context omitted.

Without this bug, they wouldn't be able to use BofA's own certificate to do it.

Why does this matter? The browser isn't even at bankofamerica.com, it is at bankofamericaa.com: it "adds insult to injury", but it doesn't affect the attack. No browser would notice, even with the fanciest watchdog services and certificate pinning, that the certificate of an unrelated website is "authentic" or not. The only way you are going to notice the name being wrong is if the user opens the certificate details…

From my experience, people really do pay attention to EV certs ("the green bar"), so I'm not sure it's quite as simple as you're putting it.
Post reply on HN