Earlier quoted context omitted.
Certainly, but an unrestricted code signing certificate would be quite useful too (until they are revoked)
Which wouldn't take very long. I'd be amazed if Apple wasn't using a hardware security module to store their intermediate signing keys and logging the keys generated from it. I wonder where the CRL for the dev certificates is -- we might see an update to it soon.
Apple Developer Website Update
111–120 of 223 posts
Re: Apple Developer Website Update
#112Imagine what you could do here: - break into facebook or twitter or any other high profile dev account - reissue new code signing keys - crack the latest public app and patch in a backdoor - code sign with new keys and submit as an app update
How? They took it offline.
Re: Apple Developer Website Update
#113Earlier quoted context omitted.
It's a strange world we live in when every time we're told by a big corp that our personal info was compromised, we're grateful for being told. This is the worlds most cashed-up corporation. They could buy entire countries, yet they made a conscious choice not to update their server software or hire more competent sys-admins. There shouldn't be a way for them to gain marketing wins out of this. There should be a law…
This isn't about marketing. It's about a security breach. And security breaches take time (> 2 days) to properly investigate and report. It's entirely possible that this is a massive oversight by Apple and they've been extremely negligent in their security policies. It's equally possible that there's some bug (that either you or I could easily have made the mistake of introducing) that's resulted in this being possib…
This shouldn't happen.
When my 4yr old tells me he did something "wrong" without any prompting (eg. "Dad, I broke your phone"), I'm impressed because he didn't have to out himself, but did so because it was the right thing to do.
Large corporations rarely think in terms of right and wrong... they have a duty to their shareholders, and nobody else. As far as their shareholders are concerned, they shouldn't release damaging information unless not doing so could potentially negatively impact profits down the line. So when Apple tells you they messed up, they're only doing so because they're worried you might find out some other way, which would be worse for them. They aren't doing it out of the kindness of their hearts.
Now if there were a law requiring the disclosure of incidents such as this when personal information is compromised, then Apple wouldn't have a choice in the matter, and they wouldn't be able to fool people like you into thinking they're awesome when they just lost your data through negligence.
> It's entirely possible that this is a massive oversight by Apple and they've been extremely negligent in their security policies.
They just said they'll be updating their software. Why would they do that if they didn't think that that would make the data safer. It's pretty much an admission that they chose not to update the software earlier ie. someone made a decision to use outdated software.
Re: Apple Developer Website Update
#114Manage your Apple ID/password/security questions here: https://appleid.apple.com
If you think having your email address out there means you are at higher risk of being attacked, I've got news for you...
Re: Apple Developer Website Update
#115Good to see some transparency on Apple's part here. I understand this must be a very challenging situation for them to deal with, and I appreciate the notification. As I'm sure many developers feel, I'd like to know more details, but I'm sure these will come in due course.
Transparency? After 3 days? Transparency would be telling us right away (with an update as soon as they know more). They should also tell us what kind of info was taken and what does sensitive information mean to them since they don't seem to be sure about that. > Sensitive personal information was encrypted and cannot be accessed, however, we have not been able to rule out the possibility that some developers’ names…
my WAG: paving systems; reinstalling the server OS; updating packages; restoring db from known clean backup; replaying logs/binlogs that are known clean?
That would be my guess.
Re: Apple Developer Website Update
#116These details are befuddling. "Personal information was encrypted and cannot be accessed". It can't be accessed because it's somehow stored elsewhere, or it can't be accessed because of the encryption? That is, does the intruder currently own my encrypted data? I'm also disappointed that it took them 72 hours to tell us anything, and that the update doesn't even have a timeline for when the site may be back. "Soon" i…
But, in their defense it may take days to ascertain what exactly happened.
Once a system is compromised it's nearly impossible to trust anything about it. Auditing the logs, and reviewing the code, crypto, and the mix of platforms they're using (see https://news.ycombinator.com/item?id=6078854) in order to understand what data could be accessed and fix all vulnerabilities is not an easy task.
The PlayStation store was not down for such a long time without reason.
Re: Apple Developer Website Update
#117> "In the spirit of transparency, we want to inform you of the issue." Ha, what a joke, I can't help laughing at that. With so many third-party Apple developers drinking the kool-aid, and dreaming of becoming rich, I'm not surprised Apple treat them like fools. Just yesterday on Twitter, some developers were speculating that the site was taken down to be updated with new SDKs for exciting new features and product lin…
Apple is great a lot of things but I don't think even their most ardent fans would argue that transparency is one of them.
Re: Apple Developer Website Update
#118Earlier quoted context omitted.
Anyone who has my name can find my email address with a simple Google search. My mailing address is on all kinds of public records.
"Give me a list of all registered developers email addresses" is a little harder though.
Re: Apple Developer Website Update
#119Hmm so it only takes a few days to "completely overhaul" their developer systems? Not sure I believe this is what they're actually doing. And why haven't they updated their server software before? I know mistakes can never be completely avoided, but this seems slightly amateurish for a company with so much cash.
> this seems slightly amateurish for a company with so much cash I know there are people here who probably have been in the start-up space for all of their working life, but never underestimate how piss poor architecture can be at big companies. I would place a large amount of money that every single person here who has done a stint at a large corporation has a horror story about terrible, awful architecture, outdate…
> I know there are people here who probably have been in the start-up space for all of their working life, but never underestimate how piss poor architecture can be at big companies.
Systems that are over 5/10/etc years old and are part of a multi-million/billion dollar system even more so. > who has done a stint at a large corporation has a horror story about terrible, awful architecture, outdated practices, and shoddy insecure software.
My god that rings so true. ;_;Re: Apple Developer Website Update
#120Earlier quoted context omitted.
Passwords could be hashed, but credit-cards are the big one you have to keep in plaintext. If you want to bill the card without asking for the number to be reentered, there's no way to avoid storing the number and expiration date. PCI does mandate that you keep less than necessary to initiate a new charge, though: you are not allowed to store the 3-digit verification code from the back of the card. Future charges fro…
Most banks provide the ability to get a billing token to avoid having to store card details at all. In order to do recurring billing you only need to store the token and the CVV on the back.