Nah. It’s a bug in a critical security system that made it to release. It should have been caught by automated testing—can you grep for the password, or decryp

Nah. It’s a bug in a critical security system that made it to release. It should have been caught by automated testing—can you grep for the password, or decrypted volume encryption key, in an encrypted filesystem? When you change the password, does anything change other than the encrypted VEK? It shouldn’t! These are in the first page of tests I’d write. NIST SP 800-111 asks for forensic pre-release testing—can you really believe such happened here? This isn’t a failure of the engineer who wrote out the wrong buffer. Everyone makes mistakes like that. It’s a failure of the Engineering culture and engineering management that shipped without reasonable testing, or manual pre-release examination. It’s a failure of the culture that accepted bugs like this, rather than asking (appropriately, for an Apple FDE product): let’s assume that it will cost someone $1B or a thousand lives if this fails. What should we do to assure its correctness?