4 ms·

> I'm not sure who makes me more cranky: Apple for apparently sitting on the fix, or Stefan Esser for flinging the vulnerability into the breeze for anyone to c

by _pmf_ 11y ago

> I'm not sure who makes me more cranky: Apple for apparently sitting on the fix, or Stefan Esser for flinging the vulnerability into the breeze for anyone to catch. One party makes billions off their users, and will most likely continue their practice of not supporting 3 year old systems even if they are still in wide use for the next time. This should pretty much clear up who is worse. > Esser has his reasons - "Short reminder: Europeans are not allowed to disclose vulns privately to a foreign company like Apple without registering dual-use export"[1] - but it's hard to believe he couldn't have told them anonymously. You're suggesting that he should feel ethically obliged to break the law for helping out a company that takes part in the usual tax and labor law evasion tactics (not to mention customer protection evasion in the US)?

hueving 11y ago
I believe parent is implying he should feel ethically obliged not to put everyone at risk that has a laptop. It has nothing to do with what's good for the company. That's not what responsible disclosure is about.
dspillett 11y ago
> helping out a company that takes part in the usual tax and labor law evasion tactics Irrelevant. The moral question being raised here is about potentially hurting Apple users via irresponsible behaviour, not about helping Apple itself. Just because Apple does it (by sitting on the problem) does not make it right for other people to put the public at risk as well. Both parties can be in the wrong at the same time, the behaviour of neither of them is not valid defence for the other. You do have to be very careful in these cases because of the way the law is set out and how easily companies turn to litigious defence instead of actually fixing problems. In this case I would recommend anonymously informing the controlling party. Of course if he had already done that then things are different and public disclosure is probably the only other thing he could have done.
- zamalek 11y ago
  > The moral question being raised here is about potentially hurting Apple users via irresponsible behaviour The logical next step is that Apple have been intermittently flippant about security (of late they have improved but their approach is still wholesale unacceptable). Why do users knowingly use an OS with this track record? > anonymously informing the controlling party With government surveillance could he have had any guarantee that his disclosure wouldn't have been snooped? Either way this discussion can be argued ad infinitum. The real villain here is the European Commission for such a brain-dead policy.
  - dspillett 11y ago
    > Why do users knowingly use an OS with this track record? Knowingly might be a stretch there. Many don't know any better either through lack of education on such matters or deliberate ignorance. > The real villain here is the European Commission for such a brain-dead policy. I'd argue that this means there are three villains, rather than the bad law being the one and only problem!
    - zamalek 11y ago
      > I'd argue that this means there are three villains Good point. Specifically regarding Apple and EU: something really needs to change.
  - coldtea 11y ago
    >The logical next step is that Apple have been intermittently flippant about security (of late they have improved but their approach is still wholesale unacceptable). Why do users knowingly use an OS with this track record? Perhaps because ever since 2001 there are 5-6 new stories like this with huge scaremongering headlines and "sky is falling" implications, and then NOTHING absolutely happens, at worse a tiny miniscule of OS X boxes are ever affected, and there are absolutely no implications for 99.9% of users. In the meantime, Apple, even if slow to respond to stuff like this, does improve OS X security infrastructure steadily. Meanwhile, in the same real world, people have to constantly fight viruses off of Windows boxes (slightly better after 8, but still a real concern). Btw, no it's not just about "small market share" either. Mac OS had even smaller market share in the late 90s (even 1/10 as small as OSX), but it still had lots of malware and viruses people caught.
rogeryu 11y ago
>> I'm not sure who makes me more cranky: Apple for apparently sitting on the fix, or Stefan Esser for flinging the vulnerability into the breeze for anyone to catch. > One party makes billions off their users, and will most likely continue their practice of not supporting 3 year old systems even if they are still in wide use for the next time. This should pretty much clear up who is worse. I don't agree. I have a six year old Macbook. In those six years I've updated to a new OS about three or four times. One time it has cost me 20 euros, the others were free. Not only that, but updating is a breeze, it's painless and never was a problem. I never had to do a complete reinstall. My mother could have done this. It's clicking a few buttons and that's it. On top of that, there is no serious degradation in speed. They claim it's even faster, but that probably isn't true for the older hardware. So even if they don't support their three year old OS, you can update your six year old system to the most current one without problem. They could have served these updates as minor ones, but that wouldn't be fun, nothing to show, no new names, no big shows. Now tell me - what is it that they don't support?
spike021 11y ago
I have a 2011 Macbook Pro. Sure it doesn't get AppNap or a few other small features, even if I've installed an SSD, but OS-wise I've been able to install all updates since I bought it. It's still supported, especially hardware-wise when I had a couple issues with it.
- Angostura 11y ago
  2007 iMac running the most recent OS here.

by _pmf_ 11y ago

hueving 11y ago

I believe parent is implying he should feel ethically obliged not to put everyone at risk that has a laptop. It has nothing to do with what's good for the company. That's not what responsible disclosure is about.

dspillett 11y ago

> helping out a company that takes part in the usual tax and labor law evasion tactics Irrelevant. The moral question being raised here is about potentially hurting Apple users via irresponsible behaviour, not about helping Apple itself. Just because Apple does it (by sitting on the problem) does not make it right for other people to put the public at risk as well. Both parties can be in the wrong at the same time, the behaviour of neither of them is not valid defence for the other. You do have to be very careful in these cases because of the way the law is set out and how easily companies turn to litigious defence instead of actually fixing problems. In this case I would recommend anonymously informing the controlling party. Of course if he had already done that then things are different and public disclosure is probably the only other thing he could have done.

zamalek 11y ago
> The moral question being raised here is about potentially hurting Apple users via irresponsible behaviour The logical next step is that Apple have been intermittently flippant about security (of late they have improved but their approach is still wholesale unacceptable). Why do users knowingly use an OS with this track record? > anonymously informing the controlling party With government surveillance could he have had any guarantee that his disclosure wouldn't have been snooped? Either way this discussion can be argued ad infinitum. The real villain here is the European Commission for such a brain-dead policy.
- dspillett 11y ago
  > Why do users knowingly use an OS with this track record? Knowingly might be a stretch there. Many don't know any better either through lack of education on such matters or deliberate ignorance. > The real villain here is the European Commission for such a brain-dead policy. I'd argue that this means there are three villains, rather than the bad law being the one and only problem!
  - zamalek 11y ago
    > I'd argue that this means there are three villains Good point. Specifically regarding Apple and EU: something really needs to change.
- coldtea 11y ago
  >The logical next step is that Apple have been intermittently flippant about security (of late they have improved but their approach is still wholesale unacceptable). Why do users knowingly use an OS with this track record? Perhaps because ever since 2001 there are 5-6 new stories like this with huge scaremongering headlines and "sky is falling" implications, and then NOTHING absolutely happens, at worse a tiny miniscule of OS X boxes are ever affected, and there are absolutely no implications for 99.9% of users. In the meantime, Apple, even if slow to respond to stuff like this, does improve OS X security infrastructure steadily. Meanwhile, in the same real world, people have to constantly fight viruses off of Windows boxes (slightly better after 8, but still a real concern). Btw, no it's not just about "small market share" either. Mac OS had even smaller market share in the late 90s (even 1/10 as small as OSX), but it still had lots of malware and viruses people caught.

rogeryu 11y ago

>> I'm not sure who makes me more cranky: Apple for apparently sitting on the fix, or Stefan Esser for flinging the vulnerability into the breeze for anyone to catch. > One party makes billions off their users, and will most likely continue their practice of not supporting 3 year old systems even if they are still in wide use for the next time. This should pretty much clear up who is worse. I don't agree. I have a six year old Macbook. In those six years I've updated to a new OS about three or four times. One time it has cost me 20 euros, the others were free. Not only that, but updating is a breeze, it's painless and never was a problem. I never had to do a complete reinstall. My mother could have done this. It's clicking a few buttons and that's it. On top of that, there is no serious degradation in speed. They claim it's even faster, but that probably isn't true for the older hardware. So even if they don't support their three year old OS, you can update your six year old system to the most current one without problem. They could have served these updates as minor ones, but that wouldn't be fun, nothing to show, no new names, no big shows. Now tell me - what is it that they don't support?

spike021 11y ago

I have a 2011 Macbook Pro. Sure it doesn't get AppNap or a few other small features, even if I've installed an SSD, but OS-wise I've been able to install all updates since I bought it. It's still supported, especially hardware-wise when I had a couple issues with it.

Angostura 11y ago
2007 iMac running the most recent OS here.