Live data from Hacker News

Ibrahim Balic breaks silence on hacking Apple developer site

news.com.au

41–50 of 56 posts

Re: Ibrahim Balic breaks silence on hacking Apple developer site

#41
post #8
post #4

The fact that the site is still down makes wonder what they're doing. Provided that the hacker did report all the security bugs to Apple, one could suppose that it would only require of couple of days to fix the bugs, put the site back online, and start performing a full security audit along with massive code rewrite in parallel. The only reason i see why they would still be offline, is that they instead decided to r…

They certainly aren't using WebObjects for everything, so I can't imagine they are particularly happy with it. Little bits of it are PHP for example, like the file search on the main page: https://developer.apple.com/search/index.php?q=HN

That URL is SO depressing...

It could almost be the masterpiece of a tumblr blog on top technology companies using crapware for themselves.

Re: Ibrahim Balic breaks silence on hacking Apple developer site

#44

I love how they just plop in some random comment from "Marco". Why is he so famous in Mac circles?

Its pretty simple:

1. Instapaper was very popular.

2. Gruber links to him a lot, and he writes well. More cynically, he has modeled his writing style after Gruber's, so if you want more of a Daring fireball fix, you read Marco.

I don't think Marco's opinions really hold anywhere near the weight of John's. Some just have an appreciation for this style of writing.

Re: Ibrahim Balic breaks silence on hacking Apple developer site

#45

I love how they just plop in some random comment from "Marco". Why is he so famous in Mac circles?

because he always has something to say. You want a quote from somebody recognizable on an apple-related news story? marco will already have one for you.

Re: Ibrahim Balic breaks silence on hacking Apple developer site

#46
post #17

This kind of pen-testing, without previous authorization, is a very risky enterprise if you live in the UK. The Computer Misuse Act 1990 expressly forbids "unauthorised access". Sections 1-3 of the Act introduced three criminal offences: - unauthorised access to computer material, punishable by 6 months' imprisonment or a fine "not exceeding level 5 on the standard scale" (currently £5000); - unauthorised access with…

Agreed. I would think cases like the Andrew Auernheimer (who was convicted and sentenced to three years in jail) would be a wake up call for pen testing sites without prior authorization.

Taking the 73 accounts is arguable in court.

Once you cross the line and scrap another 100K users in order to get their attention and shut the developer site down - you've just boxed yourself. There is no really no defense for doing something like this, regardless of your motives.

Re: Ibrahim Balic breaks silence on hacking Apple developer site

#47
I don't know what the correct action here has been, but I know as an Apple developer that apple has been acting very irresponsibly, since the first day they opened the app store about any bug reports or generally any developer communications, at least in my experience. And some part of me is happy that they hit their head against a brick wall, although my own day to day biz is disrupted too.

Re: Ibrahim Balic breaks silence on hacking Apple developer site

#48

Earlier quoted context omitted.

The developer portal is written in WebObjects/Java. And whilst I am sure they are using Project Wonder which wraps up a lot of the old WebObjects code there is still the fact that it is a deprecated technology. And it's never just write some code and deploy in these situations. It will involve testers signing it off, performance testing, security testing, deployment etc. So all those parts add up. Plus there's no "St…

I do wish they had converted WebObjects back to Objective-C and released EOF with it. It would have been nice to write the app and the server code in the same language and environment.

EOF, sure, but WebObjects in general? You don't actually want that. You just think you do.

Look: WebObjects was amazing at the time. But have you used it recently (meaning in the last several years) to write something? Because it's almost literally impossible to write something that looks modern and acts modern.

WebObject was designed to hide web development as much as possible from the developer. I.e., to make writing desktop applications and web applications as similar as possible. You'd make a view in HTML, a controller in Objective-C (or later Java), draw connections between them just as if you were making something in Interface Builder, etc. Basically, HTML just became another OpenStep view you could target.

The downside of hiding the web part of web development as much as possible is you get a technology that is very far removed from modern practice. To achieve the view/controller design pattern above, WebObjects effectively effectively uses a continuation-like pattern to hide the whole HTTP request/response loop. That's why WebObjects URLs are disgusting beasts: they tell WebObjects what state corresponds to what you're doing. ASP.NET WebForms does this same thing, by the way, although it slaps its data (called ViewState) into invisible form elements on the client-side, whereas WebObjects stores its state server-side. Former inflates the page by 30k in even simple situations, latter makes the server need tons of RAM, but they both get you to the same place, and about equally well.

The problem is that's not how you write web apps these days. If you're doing a simple-as-tea CRUD app, then sure, whatever, but you could also just publish your FileMaker or Access database to the web and be done with it in that case. And for everything else, WebObjects, unlike even ASP.NET WebForms, makes it virtually impossible to have clean, trivially usable REST endpoints, which means you can kick your responsive client-heavy web app ideas to the curb. Yes, you can work around it, and ProjectWonder provides some tolerable solutions, but you're really fighting the framework the whole way. Why bother?

I'm also highly dubious that having Objective-C on the server is really a good thing. All those pointer errors you make in your iOS app that generally just result in a crash suddenly result in your server being rooted. Memory fragmentation becomes an insanely huge deal, since Objective-C's GC is primitive, and so on and so forth.

EOF was great, and would probably still be great. WebObjects was a great idea at the time, but that time has gone.

Re: Ibrahim Balic breaks silence on hacking Apple developer site

#49

Earlier quoted context omitted.

That probably wouldn't have shut down the site, which in turn would not have gotten the attention. He wasn't making a point to Apple, who already knew the bugs existed, he was making Apple do something about it. He did.

His video shows that he filed radars on July 19th - the same day downloaded the 100,000 developer names and email addresses. This is not responsible reporting, and he's clearly broken the UK computer misuse laws, since he signed an agreement with Apple governing the use of these systems. I hope he's arrested soon. This behavior does nothing to help legitimate business or the security community.

If it truly was same day, I agree, that changes everything. I'll wait until more information comes out to decide.

Re: Ibrahim Balic breaks silence on hacking Apple developer site

#50
post #17

This kind of pen-testing, without previous authorization, is a very risky enterprise if you live in the UK. The Computer Misuse Act 1990 expressly forbids "unauthorised access". Sections 1-3 of the Act introduced three criminal offences: - unauthorised access to computer material, punishable by 6 months' imprisonment or a fine "not exceeding level 5 on the standard scale" (currently £5000); - unauthorised access with…

Those laws are retarded and it's sad to see them defended in HN.

Always try to do a parallel without computers to see if a computer law pass the retarded test.

In this case "it's illegal to enter a door left wide open for months, pick up a wallet full of money from a desk visible inside thru said open door, and return it to the home owner with all the money and a note about closing the door because it's not a safe neighborhood"

Post reply on HN