Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ibrahim Balic breaks silence on hacking Apple developer site

news.com.au

Post reply on HN
Print view View original

11–20 of 56 posts

Re: Ibrahim Balic breaks silence on hacking Apple developer site

#11

Post by protomyth »

threeseed wrote: post #7
bsaul wrote: post #4

The fact that the site is still down makes wonder what they're doing. Provided that the hacker did report all the security bugs to Apple, one could suppose that it would only require of couple of days to fix the bugs, put the site back online, and start performing a full security audit along with massive code rewrite in parallel. The only reason i see why they would still be offline, is that they instead decided to r…

The developer portal is written in WebObjects/Java. And whilst I am sure they are using Project Wonder which wraps up a lot of the old WebObjects code there is still the fact that it is a deprecated technology. And it's never just write some code and deploy in these situations. It will involve testers signing it off, performance testing, security testing, deployment etc. So all those parts add up. Plus there's no "St…

I do wish they had converted WebObjects back to Objective-C and released EOF with it. It would have been nice to write the app and the server code in the same language and environment.

Re: Ibrahim Balic breaks silence on hacking Apple developer site

#12

Post by bsaul »

threeseed wrote: post #7
bsaul wrote: post #4

The fact that the site is still down makes wonder what they're doing. Provided that the hacker did report all the security bugs to Apple, one could suppose that it would only require of couple of days to fix the bugs, put the site back online, and start performing a full security audit along with massive code rewrite in parallel. The only reason i see why they would still be offline, is that they instead decided to r…

The developer portal is written in WebObjects/Java. And whilst I am sure they are using Project Wonder which wraps up a lot of the old WebObjects code there is still the fact that it is a deprecated technology. And it's never just write some code and deploy in these situations. It will involve testers signing it off, performance testing, security testing, deployment etc. So all those parts add up. Plus there's no "St…

It really amaze me that Apple didn't and continues not to invest more on server side technologies, knowing how much apps are connected today (i can't find a single app that doesn't talk to a server one way or another).

I mean, we all know the sad state of server-side development compared to client-side (x), yet it took a personal project for Google to create Go, it took a legal issue with java for Microsoft to start working on C#, and Apple still got nothing.

(x) : not wanting to launch a flame war, but the fact that people at Google created both Go and Dart in the last 5 years does say something, not to mention the countless "Java+" languages like scala or groovy. Also, by client-side i mostly mean objective-c on xcode, which has really become a joy.

Re: Ibrahim Balic breaks silence on hacking Apple developer site

#13

Post by bsaul »

protomyth wrote: post #11
threeseed wrote: post #7

Earlier quoted context omitted.

The developer portal is written in WebObjects/Java. And whilst I am sure they are using Project Wonder which wraps up a lot of the old WebObjects code there is still the fact that it is a deprecated technology. And it's never just write some code and deploy in these situations. It will involve testers signing it off, performance testing, security testing, deployment etc. So all those parts add up. Plus there's no "St…

I do wish they had converted WebObjects back to Objective-C and released EOF with it. It would have been nice to write the app and the server code in the same language and environment.

Completely agree. Objective-C with ARC and blocks has the perfect blend of dynamic language + static typing that i'm looking for (although the syntax really feels like a hack).

Now, libraries for the server are clearly not there, and i suppose that you would need to write them in C to get descent performances, which is unrealistic i guess.

Re: Ibrahim Balic breaks silence on hacking Apple developer site

#14

Post by thornjm »

reggplant wrote: post #2

The article states that the website is back up but as of now 24/07 11:08GMT that is not the case. This is terrible timing for me since I came back from travelling on Thursday and haven't been able to get on with working in iOS 7. I really wish Apple were able to provide us with more information on time-scales.

I would not trust everything the article reports.

Slightly off topic, but for those unfamiliar with news.com.au it is a low quality sensationalist outlet who frequently post link bait material.

Some of their stories are shared from their News Corp partners but the rest is celebrity gossip and reddit reposts.

Re: Ibrahim Balic breaks silence on hacking Apple developer site

#15

Post by mattstocum »

reggplant wrote: post #2

The article states that the website is back up but as of now 24/07 11:08GMT that is not the case. This is terrible timing for me since I came back from travelling on Thursday and haven't been able to get on with working in iOS 7. I really wish Apple were able to provide us with more information on time-scales.

They may have checked developer.apple.com, which is up. It's just when you try to get into the dev centers that you get the notice.

Re: Ibrahim Balic breaks silence on hacking Apple developer site

#16

Post by kybernetyk »

> I have taken 73 users details (all apple inc workers only) and prove them as an example ...

> I have over 100,000+ users details ...

> I do not want my name to be in blacklist

One would think that 73 compromised Apple employee accounts should be enough to make a point. Why would he take another 100k user accounts hostage?

Re: Ibrahim Balic breaks silence on hacking Apple developer site

#17

Post by junto »

This kind of pen-testing, without previous authorization, is a very risky enterprise if you live in the UK. The Computer Misuse Act 1990 expressly forbids "unauthorised access". Sections 1-3 of the Act introduced three criminal offences:

- unauthorised access to computer material, punishable by 6 months' imprisonment or a fine "not exceeding level 5 on the standard scale" (currently £5000);

- unauthorised access with intent to commit or facilitate commission of further offences, punishable by 6 months/maximum fine on summary conviction or 5 years/fine on indictment;

- unauthorised modification of computer material, subject to the same sentences as section 2 offences.

If he had been contracted to pen-test the website by Apple then it would be a different matter.

Re: Ibrahim Balic breaks silence on hacking Apple developer site

#18

Post by martinml »

bsaul wrote: post #4

The fact that the site is still down makes wonder what they're doing. Provided that the hacker did report all the security bugs to Apple, one could suppose that it would only require of couple of days to fix the bugs, put the site back online, and start performing a full security audit along with massive code rewrite in parallel. The only reason i see why they would still be offline, is that they instead decided to r…

In 2011 it took Sony about a month to restore PSN services after its infamous breach: http://en.wikipedia.org/wiki/PlayStation_Network_outage#Time...

Re: Ibrahim Balic breaks silence on hacking Apple developer site

#19

Post by jasallen »

kybernetyk wrote: post #16

> I have taken 73 users details (all apple inc workers only) and prove them as an example ... > I have over 100,000+ users details ... > I do not want my name to be in blacklist One would think that 73 compromised Apple employee accounts should be enough to make a point. Why would he take another 100k user accounts hostage?

That probably wouldn't have shut down the site, which in turn would not have gotten the attention. He wasn't making a point to Apple, who already knew the bugs existed, he was making Apple do something about it. He did.

Re: Ibrahim Balic breaks silence on hacking Apple developer site

#20

Post by 67726e »

mikhailt wrote: post #10
terabytest wrote: post #5

With the iOS 7 launch already on a tight schedule this is a disgrace for both Apple and developers trying to renovate their apps.

disgrace |disˈgrās| noun loss of reputation or respect, esp. as the result of a dishonorable action [ in sing. ] a person or thing regarded as shameful and unacceptable How is it a disgrace? You're making it sound like Apple meant for this to happen, this could've happen to any companies. Apple should not be portrayed to be perfect at everything, they're lead by humans who can make mistakes, just like everybody else.…

> How is it a disgrace? You're making it sound like Apple meant for this to happen, this could've happen to any companies.

Well if Ibrahim is to be believed, Apple failed to reasonably handle his disclosure of the security flaws. Apple is not entirely at fault, but they surely failed to protect their users' data. Users trusted Apple to prevent this from happening, but they have failed. That is a disgrace.

Post reply on HN