Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Apple goto fail vulnerability: lessons learned (2014)

dwheeler.com

Post reply on HN
Print view View original

11–20 of 42 posts

Re: The Apple goto fail vulnerability: lessons learned (2014)

#11

Post by CoolGuySteve »

Meh, I worked on C at Apple and that programming style was idiomatic there. There’s nothing malicious about it, it was almost certainly a diff tool or merge error that resulted in the duplicated line.

One thing that was weird about our merges was that we always had way too many branches in flight for the current OS X, the last OS X, the next OS X beta, iOS, the next iOS, and the Windows iTunes stuff.

Even though we had a small team inside our division dedicated to releases, it's almost guaranteed there will be merge issues when managing that many forks of the same SVN or git repo.

Re: The Apple goto fail vulnerability: lessons learned (2014)

#12

Post by tpush »

kevin_thibedeau wrote: post #10
bobbylarrybobby wrote: post #5

For as long as I live, I’ll never understand style guides that permit omitting brackets around a single line following an if statement (or for, while, etc), nor code formatters that dont automatically insert them.

They add visual noise. The grammar of C is not the same as the grammar of it's offshoots and block statements aren't part of control structures. Moreover, GCC warns about extra statements with the same indentation level with -Wall on.

IMO you get accustomed to single statement-braces very quick and they leave less room for errors.

Re: The Apple goto fail vulnerability: lessons learned (2014)

#14

Post by dwheeler »

Hi, I'm the author of the referenced article. Thanks for pointing to it!

However, can you change HN thread to the article title, which is: "The Apple goto fail vulnerability: lessons learned"?

I never used the term "backdoor" in the entire article, and I certainly never claimed that this was an intentional backdoor or that it looked just like a backdoor. I said, "The Apple goto fail vulnerability was a dangerous vulnerability that should have been found by Apple." - but I never said it was intentional. I personally doubt it was intentional (it's possible, but I have no specific evidence suggesting it).

While I'm here... ask me anything (AMA)!

Re: The Apple goto fail vulnerability: lessons learned (2014)

#16

Post by gigatexal »

dwheeler wrote: post #14

Hi, I'm the author of the referenced article. Thanks for pointing to it! However, can you change HN thread to the article title, which is: "The Apple goto fail vulnerability: lessons learned"? I never used the term "backdoor" in the entire article, and I certainly never claimed that this was an intentional backdoor or that it looked just like a backdoor. I said, "The Apple goto fail vulnerability was a dangerous vuln…

Flagged in hopes the title gets changed

Re: The Apple goto fail vulnerability: lessons learned (2014)

#17

Post by pansa2 »

dwheeler wrote: post #14

Hi, I'm the author of the referenced article. Thanks for pointing to it! However, can you change HN thread to the article title, which is: "The Apple goto fail vulnerability: lessons learned"? I never used the term "backdoor" in the entire article, and I certainly never claimed that this was an intentional backdoor or that it looked just like a backdoor. I said, "The Apple goto fail vulnerability was a dangerous vuln…

The OP has re-used the title of an unrelated article posted a few days ago, for some reason:

https://news.ycombinator.com/item?id=25726068

Re: The Apple goto fail vulnerability: lessons learned (2014)

#18

Post by dang »

dwheeler wrote: post #14

Hi, I'm the author of the referenced article. Thanks for pointing to it! However, can you change HN thread to the article title, which is: "The Apple goto fail vulnerability: lessons learned"? I never used the term "backdoor" in the entire article, and I certainly never claimed that this was an intentional backdoor or that it looked just like a backdoor. I said, "The Apple goto fail vulnerability was a dangerous vuln…

Fixed now. Thanks!

(Submitted title was "The Most Backdoor-Looking Bug I’ve Ever Seen: Apple's goto fail bug (2014)". Submitters: please don't do that—it's against the site guidelines, which ask: "Please use the original title, unless it is misleading or linkbait; don't editorialize." We eventually take submission privileges away for breaking that rule, so please follow it.)

Re: The Apple goto fail vulnerability: lessons learned (2014)

#19

Post by dwheeler »

dang wrote: post #18
dwheeler wrote: post #14

Hi, I'm the author of the referenced article. Thanks for pointing to it! However, can you change HN thread to the article title, which is: "The Apple goto fail vulnerability: lessons learned"? I never used the term "backdoor" in the entire article, and I certainly never claimed that this was an intentional backdoor or that it looked just like a backdoor. I said, "The Apple goto fail vulnerability was a dangerous vuln…

Fixed now. Thanks! (Submitted title was "The Most Backdoor-Looking Bug I’ve Ever Seen: Apple's goto fail bug (2014)". Submitters: please don't do that—it's against the site guidelines, which ask: " Please use the original title, unless it is misleading or linkbait; don't editorialize. " We eventually take submission privileges away for breaking that rule, so please follow it.)

Thanks! And while I'm here, THANK YOU for all the thankless work you do. MANY people, including me, appreciate it!
Post reply on HN