3 ms·

This does not sound like the Apple I know about. I mean, these guys forced every app to be able to handle IPV6-only network operations last year. And this was

by xgbi 10y ago

This does not sound like the Apple I know about. I mean, these guys forced every app to be able to handle IPV6-only network operations last year. And this was after making all apps switch to 64 bits a bit earlier. Why did they back up off SSL? I feel like this is kind of a turning point, where Apple, instead of driving the market with innovative APIs and having a vision, now tries to compromise and removes innovative features to keep its immense app market happy, and oblige for it. What a let down, especially after a very nice 2016 year, where they stood against the FBI and published their open letter about privacy of their customers.

rgsh22 10y ago
> Why did they back up off SSL? Go try and buy something on https://apple.com https://apple.com - you will once you go to view your cart you will be redirected to plain vanilla HTTP. There is no way around this. If they can't get their own SSL support in order...
- rawrmaan 10y ago
  Why is there no way around this? This is surprising to me and I'm super curious.
  - sdegutis 10y ago
    If I had to give them the benefit of the doubt, I'd guess that they feel that SSL has failed at fulfilling its intended purpose, and that they're working on a "superior" alternative which they plan to use for themselves and force all developers for their platforms to also use, in an attempt to encourage it to spread and supersede SSL.
  - brazzledazzle 10y ago
    The exchange of payment or authentication information is undoubtedly done over TLS so it's probably just not a priority. That said there seems to be some obvious security issues with it since a bad actor could, as far as I know, inject malicious javascript in the vanilla http page to do all kinds of fun stuff.
    - tuxracer 10y ago
      Yeah but the checkout button on the insecure cart page could be changed so that it instead points to http://www.apple-payment.com/.. http://www.apple-payment.com/... or any random malicious "checkout" page which then steals your CC. They've compromised the security of credit card details users will at some point enter by doing this. It's insane if that isn't a priority.
      - RKearney 10y ago
        It also exposes all of your cookies for apple.com since not a single cookie is marked secure/HTTPS only.
tw04 10y ago
>I mean, these guys forced every app to be able to handle IPV6-only network operations last year. That's easy to answer. The US government has an IPv6 mandate. They have no such SSL mandate.
- mrpippy 10y ago
  The US gov does mandate that products support IPv6, but they don't mandate that everything can work on v6-only networks. The mandate comes from mobile carriers, some of whom desperately want to run networks where phones only get v6 addresses, and v4 traffic is tunneled through DNS64/NAT64.
  - tw04 10y ago
    And you don't think the government runs their own mobile networks in war zones? They definitely aren't relying on Zain.
thorwaycation8 10y ago
People complain when they do. People complain when they don't. SSL and this particular application would be innovative? They just doubled down on wireless accessories with their latest gadget and everyone bitched. They're experimenting with adaptive UI's on laptops (Touchbar) and everyone bitched. AFAIK, they haven't backed off the standing up to the FBI and customer privacy? People have had their heads in the dirt when it comes to Apple's dark side. Xcode was laughed at for years. Their online security was a joke until celebrity pictures got leaked. Outside the OS, much of the software has been considered some combination of half-baked, bloated, or like a toy (iTunes+Music apps in particular). What was innovative about stuff like Photo Booth? Having dealt with them from a corporate customer perspective, they are worse than Google for not following up, being opaque, having snail mail processes for simple things like refunding $100 in software. Stand around waiting at an Apple store for an hour even with an appointment. Really getting tired of these Johnny Come Lately gripe trains. Complain about them in the last 6-7 years, you're a hater. Now that hating Apple is trendy, everyone hop on board!
ReverseCold 10y ago
While I agree with everything you said, here's an example of forced SSL being very hard to deal with. Decentralized platform, needs to be connected to nodes. Each node can't get an SSL cert because we can't force everyone on a blockchain to get a domain name. It doesn't matter that there's SSL anyway because everything's signed by the server anyway. The data the client sends is also public, so the worst that can happen is an attacker blocks a transaction. This can also happen with SSL. We could just distribute a cert with the node and hardcode it into our app, but then there's no point of SSL, we just published our private key. Yes, this is kinda edge case.

by xgbi 10y ago

rgsh22 10y ago

> Why did they back up off SSL? Go try and buy something on https://apple.com https://apple.com - you will once you go to view your cart you will be redirected to plain vanilla HTTP. There is no way around this. If they can't get their own SSL support in order...

rawrmaan 10y ago
Why is there no way around this? This is surprising to me and I'm super curious.
- sdegutis 10y ago
  If I had to give them the benefit of the doubt, I'd guess that they feel that SSL has failed at fulfilling its intended purpose, and that they're working on a "superior" alternative which they plan to use for themselves and force all developers for their platforms to also use, in an attempt to encourage it to spread and supersede SSL.
- brazzledazzle 10y ago
  The exchange of payment or authentication information is undoubtedly done over TLS so it's probably just not a priority. That said there seems to be some obvious security issues with it since a bad actor could, as far as I know, inject malicious javascript in the vanilla http page to do all kinds of fun stuff.
  - tuxracer 10y ago
    Yeah but the checkout button on the insecure cart page could be changed so that it instead points to http://www.apple-payment.com/.. http://www.apple-payment.com/... or any random malicious "checkout" page which then steals your CC. They've compromised the security of credit card details users will at some point enter by doing this. It's insane if that isn't a priority.
    - RKearney 10y ago
      It also exposes all of your cookies for apple.com since not a single cookie is marked secure/HTTPS only.

tw04 10y ago

>I mean, these guys forced every app to be able to handle IPV6-only network operations last year. That's easy to answer. The US government has an IPv6 mandate. They have no such SSL mandate.

mrpippy 10y ago
The US gov does mandate that products support IPv6, but they don't mandate that everything can work on v6-only networks. The mandate comes from mobile carriers, some of whom desperately want to run networks where phones only get v6 addresses, and v4 traffic is tunneled through DNS64/NAT64.
- tw04 10y ago
  And you don't think the government runs their own mobile networks in war zones? They definitely aren't relying on Zain.

thorwaycation8 10y ago

People complain when they do. People complain when they don't. SSL and this particular application would be innovative? They just doubled down on wireless accessories with their latest gadget and everyone bitched. They're experimenting with adaptive UI's on laptops (Touchbar) and everyone bitched. AFAIK, they haven't backed off the standing up to the FBI and customer privacy? People have had their heads in the dirt when it comes to Apple's dark side. Xcode was laughed at for years. Their online security was a joke until celebrity pictures got leaked. Outside the OS, much of the software has been considered some combination of half-baked, bloated, or like a toy (iTunes+Music apps in particular). What was innovative about stuff like Photo Booth? Having dealt with them from a corporate customer perspective, they are worse than Google for not following up, being opaque, having snail mail processes for simple things like refunding $100 in software. Stand around waiting at an Apple store for an hour even with an appointment. Really getting tired of these Johnny Come Lately gripe trains. Complain about them in the last 6-7 years, you're a hater. Now that hating Apple is trendy, everyone hop on board!

ReverseCold 10y ago

While I agree with everything you said, here's an example of forced SSL being very hard to deal with. Decentralized platform, needs to be connected to nodes. Each node can't get an SSL cert because we can't force everyone on a blockchain to get a domain name. It doesn't matter that there's SSL anyway because everything's signed by the server anyway. The data the client sends is also public, so the worst that can happen is an attacker blocks a transaction. This can also happen with SSL. We could just distribute a cert with the node and hardcode it into our app, but then there's no point of SSL, we just published our private key. Yes, this is kinda edge case.