5 ms·

How can you be mad at Esser? He didn't put the bug there. He has nothing to do with this.

enneff 11y ago
https://en.wikipedia.org/wiki/Responsible_disclosure https://en.wikipedia.org/wiki/Responsible_disclosure
acomjean 11y ago
From the Author in the Comments "In Esser's original post revealing the vulnerability, he said, "At the moment it is unclear if Apple knows about this security problem or not."" So basically he just released it without disclosure. He claims reasons (see parent post), but its still kinda ick..
- 13 11y ago
  Just giving the benefit of the doubt here, a lot of the time it's unclear if your disclosure even made it to the right people in a company or not. No response is the norm for security disclosures, as is claims of "we didn't get this", even if you have a receipt for their ticketing system that says they did. I've sometimes spent far longer attempting to contact a company than doing research into something that seems to be a problem.
  - jsjohnst 11y ago
    Stefan is not just some random guy on the Internet. I can assure you the relevant folks at Apple know him and most likely he knows them.
    - oldmanjay 11y ago
      oh, well as long as you can assure us of that orthogonal point, I guess it's all good mr anonymous internet person
      - jsjohnst 11y ago
        It's easy to prove. Just go look at the number of iOS and OSX security fixes attributed to him. Or you can go do a simple search on any reputable site posting security info and you'll see him all over it.
code_sterling 11y ago
You forget your key when leaving for work, and don't lock your door. It was accidental, you have a lot on your plate. Your neighbour sees you didn't lock it, and tweets out, "Hey Mike at 321 Greyhat Bvld, you didn't lock your front door". He didn't send that to you as a text, he tweeted it. You come home, and you've been cleaned out. I'm sure we can all agree, you should have locked your door. Why be mad at your neighbour, he didn't leave the door unlocked, he didn't take your stuff...
- geofft 11y ago
  A better analogy would be your doorman, whose one job is to watch who gets into your building, leaving the key cabinet unlocked and going to lunch. I don't mean to blame any individual human here, but I'm baffled at the process by which debugging environment variables were added to dyld without being carefully vetted for bad interactions with setuid binaries. This is a well-known easy place to screw up, and I'm surprised that someone was working on dyld without knowing that (although yes, humans forget things sometimes), and much more surprised that this made it past code review and into a shipping product. This isn't a random screw up in regular software. dyld is security-sensitive; it's one of the small number of libraries that bears a responsibility to be paranoid about setuid.
- odonnellryan 11y ago
  That's kind-of a bad analogy. It'd be better of: 1) The person who left the house open was certain to get the message quicker because of the tweet than just a text. 2) It was possible to quickly and remotely lock the door. Apple can and should fix this bug very quickly, as that is certainly possible for them.
- kordless 11y ago
  I'm sure we can all agree we can make up shit that can happen till the cows come home. I'm not going to act as if someone robbed me until they do. Hold Esser responsible if someone hacks a large number of people because of what he did. Otherwise, stop living a thousands lives.
  - 11y ago

https://en.wikipedia.org/wiki/Responsible_disclosure https://en.wikipedia.org/wiki/Responsible_disclosure

From the Author in the Comments "In Esser's original post revealing the vulnerability, he said, "At the moment it is unclear if Apple knows about this security problem or not."" So basically he just released it without disclosure. He claims reasons (see parent post), but its still kinda ick..

13 11y ago
Just giving the benefit of the doubt here, a lot of the time it's unclear if your disclosure even made it to the right people in a company or not. No response is the norm for security disclosures, as is claims of "we didn't get this", even if you have a receipt for their ticketing system that says they did. I've sometimes spent far longer attempting to contact a company than doing research into something that seems to be a problem.
- jsjohnst 11y ago
  Stefan is not just some random guy on the Internet. I can assure you the relevant folks at Apple know him and most likely he knows them.
  - oldmanjay 11y ago
    oh, well as long as you can assure us of that orthogonal point, I guess it's all good mr anonymous internet person
    - jsjohnst 11y ago
      It's easy to prove. Just go look at the number of iOS and OSX security fixes attributed to him. Or you can go do a simple search on any reputable site posting security info and you'll see him all over it.

code_sterling 11y ago

You forget your key when leaving for work, and don't lock your door. It was accidental, you have a lot on your plate. Your neighbour sees you didn't lock it, and tweets out, "Hey Mike at 321 Greyhat Bvld, you didn't lock your front door". He didn't send that to you as a text, he tweeted it. You come home, and you've been cleaned out. I'm sure we can all agree, you should have locked your door. Why be mad at your neighbour, he didn't leave the door unlocked, he didn't take your stuff...

geofft 11y ago
A better analogy would be your doorman, whose one job is to watch who gets into your building, leaving the key cabinet unlocked and going to lunch. I don't mean to blame any individual human here, but I'm baffled at the process by which debugging environment variables were added to dyld without being carefully vetted for bad interactions with setuid binaries. This is a well-known easy place to screw up, and I'm surprised that someone was working on dyld without knowing that (although yes, humans forget things sometimes), and much more surprised that this made it past code review and into a shipping product. This isn't a random screw up in regular software. dyld is security-sensitive; it's one of the small number of libraries that bears a responsibility to be paranoid about setuid.
odonnellryan 11y ago
That's kind-of a bad analogy. It'd be better of: 1) The person who left the house open was certain to get the message quicker because of the tweet than just a text. 2) It was possible to quickly and remotely lock the door. Apple can and should fix this bug very quickly, as that is certainly possible for them.
kordless 11y ago
I'm sure we can all agree we can make up shit that can happen till the cows come home. I'm not going to act as if someone robbed me until they do. Hold Esser responsible if someone hacks a large number of people because of what he did. Otherwise, stop living a thousands lives.
- 11y ago