Any theories on how this got committed and merged?
Looks like the kind of mistake an automated merge can make.
Or even a manual merge.
Apple's SSL/TLS bug
131–140 of 295 posts
Re: Apple's SSL/TLS bug
#132Re: Apple's SSL/TLS bug
#133Unfortunately OSX does not appear patched even in the latest developer center 10.9.2 build (13C62). Tested in both Safari and OS-distributed curl. Chrome/Firefox of course is still fine since it uses the NSS stuff, but plenty of OS services use the OS crypto. (I'm violating NDA by commenting on pre-release Apple stuff, of course.) Windows or ubuntu bootcamp until they fix this, I think.
MITM of any SSL connection in Safari and other system apps, and they couldn't even bother to have an OS X patch ready at the same time as the disclosure for iOS? I think anyone relying on the security of OS X is going to have to seriously rethink their OS choice after this.
> I think anyone relying on the security of OS X is going to have to seriously rethink their OS choice after this.
Re: Apple's SSL/TLS bug
#134So here is the shirt – proceeds will go to EFF and FSFE: http://teespring.com/goto-fail
in.
Re: Apple's SSL/TLS bug
#135Unfortunately OSX does not appear patched even in the latest developer center 10.9.2 build (13C62). Tested in both Safari and OS-distributed curl. Chrome/Firefox of course is still fine since it uses the NSS stuff, but plenty of OS services use the OS crypto. (I'm violating NDA by commenting on pre-release Apple stuff, of course.) Windows or ubuntu bootcamp until they fix this, I think.
MITM of any SSL connection in Safari and other system apps, and they couldn't even bother to have an OS X patch ready at the same time as the disclosure for iOS? I think anyone relying on the security of OS X is going to have to seriously rethink their OS choice after this.
Seriously, what were they thinking? They've announced you can attack ≈40% of OS X machines and then didn't provide a fix. Great.
Re: Apple's SSL/TLS bug
#136Earlier quoted context omitted.
"If you're on OS X Mavericks or on iOS 7 and haven't patched" how do I patch on OS X Mavericks? Software update shows nothing to update
There is no patch for Mavericks out yet. :-(
I thought Apple's policy was to not release these sort of security notices until a fix was in place?
Re: Apple's SSL/TLS bug
#137Earlier quoted context omitted.
In actual code things would not be named as they were above and it would be shorter, I was just trying to make it look reasonably like the C for HN.
True, but I've definitely noticed that particular style of writing if tests using a one-line assignment and obscured test condition seems to be pretty common in the Go community and it's a bad habit for understanding code.
>>it's a bad habit for understanding code.
Is there objective evidence for this? As a Go programmer a semicolon in an if statement screams to me. I can see it possibly being in issue for new Go programmers- but I don't remember it being one for me.
Re: Apple's SSL/TLS bug
#138Earlier quoted context omitted.
Braces don't help in coding styles that put the opening brace on a separate line from the control statement. if ((err = SSLHashSHA1.update(&hashCtx, &signedParams)) != 0) { goto fail; } { goto fail; }
If you have a programmer on your team who is likely to modify if (condition) { doSomething(); } into if (condition) { doSomething(); } { doAnotherThing(); } instead of if (condition) { doSomething(); doAnotherThing(); } then that person needs some serious mentoring right away. 'Cuz. . . just wow. As far as the original example goes, if it's an error it's most likely a copy/paste error. Curly braces help there, too. W…
As far as the original example goes, if it's an error it's most likely a copy/paste error.
Right, and this demonstrates the major problem with verbosity in languages and APIs and design patterns. When you have to repeat yourself many times, it's very easy to make a mistake in one of the near-copies, and you or a code reviewer can miss it because you'll tend to quickly skim over the boilerplate.
For cases like this, using exceptions rather than manual error value checking would make your code shorter, less redundant, and not susceptible to this particular bug. (Not possible in C, I know).
Re: Apple's SSL/TLS bug
#139Earlier quoted context omitted.
MITM of any SSL connection in Safari and other system apps, and they couldn't even bother to have an OS X patch ready at the same time as the disclosure for iOS? I think anyone relying on the security of OS X is going to have to seriously rethink their OS choice after this.
Indeed the only secure OS nowadays is Linux. Everything else should be considered compromised by default a priori.
Every OS is compromised a priori. It's just a matter of when the compromises will be discovered. Linux has certainly had its share of flaws.
Re: Apple's SSL/TLS bug
#140Unfortunately OSX does not appear patched even in the latest developer center 10.9.2 build (13C62). Tested in both Safari and OS-distributed curl. Chrome/Firefox of course is still fine since it uses the NSS stuff, but plenty of OS services use the OS crypto. (I'm violating NDA by commenting on pre-release Apple stuff, of course.) Windows or ubuntu bootcamp until they fix this, I think.
>I'm violating NDA by commenting on pre-release Apple stuff, of course.
Not that we really care. And you could have gotten the beta off of some torrent or whatever, without ever agreeing to the NDA anyway...