5 ms·

With no disrespect to the developers at Apple, et al, each one of these problems that goes viral before reaching “proper” channels is a well-deserved slap in th

With no disrespect to the developers at Apple, et al, each one of these problems that goes viral before reaching “proper” channels is a well-deserved slap in the face of these behemoth organizations. Perhaps, if the entire tech community regards Apple as a joke, they will start paying attention. “Responsible disclosure” is great stuff for creating a culture of free outsourcing of tech companies’ most imporant feature (security) to the same people that paid those companies thousands of dollars for that privilege.

monochromatic 9y ago
Especially here, where it’s (probably?) not remotely exploitable.
- zamalek 9y ago
  > probably Show and focus a window when the user locks their machine.
  - brazzledazzle 9y ago
    Yeah. You can do keystroke logging without root but typing into password fields can't be intercepted. This would be a nice complement to that capability.
    - throwawaymanbot 9y ago
      Interestingly, someone mentioned on twitter the same thing happening to them on ubuntu With slack. Would this be an issue with slack interjecting itself for key strokes?
  - daveFNbuck 9y ago
    How do you do that?
    - fleitz 9y ago
      - (void) viewDidAppear{ [super viewDidAppear]; [self.passwordfield becomeFirstResponder]; }
      - fleitz 9y ago
        I guess I got down voted for Obj C code, here's the swift version: func viewDidAppear(){ super.viewDidAppear() passwordField.becomeFirstResponder() }
- blattimwind 9y ago
  Having your password in some IRC channel gets remotely exploitable quickly.
  - floatboth 9y ago
    If you reused the password, yeah, instant pwnage everywhere. If your local account password isn't used anywhere else, meh, random IRC people don't have physical access to your machine :)
    - pornel 9y ago
      Unless you have remote SSH logon enabled and IRC exposes your IP address.
      - Fnoord 9y ago
        Depends how you authenticate with your password. You could use pubkey with or without a password. Even if you reuse the password there, even if they have your password, if they don't have your private key they can't authenticate.
      - cuckcuckspruce 9y ago
        Yet another reason to only use SSH keys.
      - floatboth 9y ago
        Remote logon with passwords allowed and sshd exposed to the whole internet (not behind ISP's NAT, not behind home NAT, port allowed on home firewall, port allowed on laptop firewall).
    - davrosthedalek 9y ago
      No need to reuse your password. If the machine has sshd enabled, the attacker only has to guess the account name, but that's hopefully a lot easier than guessing the password.
  - bartvk 9y ago
mholt 9y ago
Yes, the manner of disclosure reflects the respect one has for the software vendor. https://twitter.com/mholt6/status/935687749381775362 https://twitter.com/mholt6/status/935687749381775362 Responsible disclosure is more or less earned as your resources go to infinity.
- TaylorAlexander 9y ago
  An interesting comment given that Apple as closer to infinity resources than anyone else.
  - drewmol 9y ago
    Indeed, infinitesimally closer ;-)
- jethro_tell 9y ago
  This stuff is so amateur though I don't think it is being discovered and handled by security guys. It's just some dev that is annoyed that the lock screen doesn't have total focus which is annoying and insecure and the kid of shit you'd see in the 90s
- gaius 9y ago
  Who can respect a vendor that assigns engineers to work on the animated poop icon instead of basic security?
  - vhost- 9y ago
    contrary to what you may believe, some people need to work on content and should not be touching security. it's absurd to expect apple to fire all their non-security related staff and replace them with a whole organization of engineers that only work on basic security. I do agree that apple has had a ton of problems in this area and needs to work on it, but this example is very played out and boring.
  - EpicEng 9y ago
    Yes because I'm sure those same people are also able to work on security.
daveFNbuck 9y ago
Responsible disclosure is about preventing the bug from being exploited before it can be fixed. Knowing about this bug doesn't help me compromise someone else, but it does help me avoid getting compromised.
- deleted 9y ago
  [deleted]
- bagacrap 9y ago
  presumably if you had access to someone's locked MBP and you could move focus away from the password field you might be able to trick them into revealing their pw; if the setup requires access to an unlocked device it still allows you to leverage temporary access to unlocked device to get a leaked password.
- dingaling 9y ago
  > but it does help me avoid getting compromised Only by casual hackers. The pros will probably have been exploiting the flaw for weeks or months against gainful targets. If there is a reasonable end-user workaround against the vulnerability then I'd argue it's more responsible to publish early and widely than to wait for the vendor. It becomes greyer if there is no workaround. I'm not sure what I'd support in that case.
  - daveFNbuck 9y ago
    The compromise is that I accidentally type my password into Slack and send it out to everyone in the building. There is no hacker involved in this one, and I can fully protect myself by ensuring that my password is going into the password field.
- CodeWriter23 9y ago
  So, security through obscurity. No thanks. I'd rather know about the exploit ASAP so I can implement a workaround, rather than wait months for the vendor to get off their ass while my systems are getting hacked by the hundreds if not thousands of hackers that have 0-day knowledge. Calling what you describe as "Responsible" is intellectually dishonest.
throwawaymanbot 9y ago
totally agree, the quality has gone from apple, so has my trust.. The iphone IOS release, with the letter "I" issue was a total joke, what a disaster. Like did not one engineer testing the OS type the letter I? Cant be surprised this happens. For the first time ever, I'm contemplating an android phone. I know its nothing special but at least it seems people have done QA on it.
feelin_googley 9y ago
"With no disrespect to the developers at Apple, et. al., each one of these problems that goes viral before reaching "proper" channels..." s/that goes viral before reaching \"proper\" channels// The fact that the problems existed to begin with is more troubling than whether they became known outside the company or not. IMO. With an open source UNIX-like OS (like the ones Apple sourced from for parts of macOS), both the developers and the users can watch the commits as they happen. Developers and users anywhere can choose to watch the commits and may be able to detect a series of poor quality ones. At least they can make informed decisions on the relative merits of changes from one version to the next. (Edit: They might choose not to compile or install certain components. I do not use X11. Nor do I use systemd.) The fact that development of macOS is hidden from those outside Apple and that problems are protected from "going viral" does not make the problems any less of an issue for macOS users. The issue is not how fast and secretively they fix problems, it is how many problems their developers are introducing into the existing version to begin with. If there are problems routinely being introduced then no amount of fixing after the fact and behind the scenes is going to make the OS higher quality. Only due care taken before introducing changes will guard against further deterioration of quality level. (Edit: The mention of open source is not intended to be interpreted as an argument that open source inherently results in better software. Perhaps skill and attention to detail are at cause. This is a debate worth avoiding. The relevance of the mention of open source is intended to suggest that detecting and avoiding problematic software may be easier for some users, e.g. yours truly, if they can access the source code. As opposed to hoping that Acme Hardware and Software Corporation will quickly and secretly fix all software problems that slipped through their QC procedures. Too late for the user who has already paid for the software and updated to the new version. That argument should not be too controversial.)
- rrdharan 9y ago
  Ironically Linux has had so many long standing versions of this exact vulnerability (screensaver issues leading to various forms of terrible disclosure) that it's not even really interesting to talk about them. I'd send you to the relevant jwz rants but I'd rather spare everyone the goatse-ing...
- pfranz 9y ago
j4ship 9y ago
we do regard them as a joke, apple is for you non techies that like cool stuff and dont care about being over charged for a metal case .... how many iphone have broken screens. Apple customers dont care about the tech , they care about cool. This is what Steve Jobs and apple as branded themselves on so thats what you get, cool without good tech. And it wont matter becuase that is not the reason people buy Apple. Tech community doesnt care about Apple, but the engineers will happily take their money to work on their products. If apple falls programming and computing will go on happily and at least we wont have to build over priced products for a bunch of children to take selfie shots that dont care 2 cents that they have a technical marvel in their hands.
rdtsc 9y ago
> “Responsible disclosure” is great stuff for creating a culture of free outsourcing of tech companies’ most imporant feature (security) to the same people that paid those companies thousands of dollars for that privilege. Also "Responsible disclosure" means absolute nothing to most people who are not security researchers. They don't know about it, even if there is a bounty and they could make a decent profit, they have no idea what those things are. They notice they can get root access or the focus sends their password to Slack and they'll tweet about it.
jagermo 9y ago
If you look at the "root" issue last week, public shaming seems to be the only way to get Apple to work on problems in macOS. They didn't even include it into the big bounty, did they? It feels like they don't give a shit about non-iOS-devices.

monochromatic 9y ago

Especially here, where it’s (probably?) not remotely exploitable.

zamalek 9y ago
> probably Show and focus a window when the user locks their machine.
- brazzledazzle 9y ago
  Yeah. You can do keystroke logging without root but typing into password fields can't be intercepted. This would be a nice complement to that capability.
  - throwawaymanbot 9y ago
    Interestingly, someone mentioned on twitter the same thing happening to them on ubuntu With slack. Would this be an issue with slack interjecting itself for key strokes?
- daveFNbuck 9y ago
  How do you do that?
  - fleitz 9y ago
    - (void) viewDidAppear{ [super viewDidAppear]; [self.passwordfield becomeFirstResponder]; }
    - fleitz 9y ago
      I guess I got down voted for Obj C code, here's the swift version: func viewDidAppear(){ super.viewDidAppear() passwordField.becomeFirstResponder() }
blattimwind 9y ago
Having your password in some IRC channel gets remotely exploitable quickly.
- floatboth 9y ago
  If you reused the password, yeah, instant pwnage everywhere. If your local account password isn't used anywhere else, meh, random IRC people don't have physical access to your machine :)
  - pornel 9y ago
    Unless you have remote SSH logon enabled and IRC exposes your IP address.
    - Fnoord 9y ago
      Depends how you authenticate with your password. You could use pubkey with or without a password. Even if you reuse the password there, even if they have your password, if they don't have your private key they can't authenticate.
    - cuckcuckspruce 9y ago
      Yet another reason to only use SSH keys.
    - floatboth 9y ago
      Remote logon with passwords allowed and sshd exposed to the whole internet (not behind ISP's NAT, not behind home NAT, port allowed on home firewall, port allowed on laptop firewall).
  - davrosthedalek 9y ago
    No need to reuse your password. If the machine has sshd enabled, the attacker only has to guess the account name, but that's hopefully a lot easier than guessing the password.
- bartvk 9y ago

mholt 9y ago

Yes, the manner of disclosure reflects the respect one has for the software vendor. https://twitter.com/mholt6/status/935687749381775362 https://twitter.com/mholt6/status/935687749381775362 Responsible disclosure is more or less earned as your resources go to infinity.

TaylorAlexander 9y ago
An interesting comment given that Apple as closer to infinity resources than anyone else.
- drewmol 9y ago
  Indeed, infinitesimally closer ;-)
jethro_tell 9y ago
This stuff is so amateur though I don't think it is being discovered and handled by security guys. It's just some dev that is annoyed that the lock screen doesn't have total focus which is annoying and insecure and the kid of shit you'd see in the 90s
gaius 9y ago
Who can respect a vendor that assigns engineers to work on the animated poop icon instead of basic security?
- vhost- 9y ago
  contrary to what you may believe, some people need to work on content and should not be touching security. it's absurd to expect apple to fire all their non-security related staff and replace them with a whole organization of engineers that only work on basic security. I do agree that apple has had a ton of problems in this area and needs to work on it, but this example is very played out and boring.
- EpicEng 9y ago
  Yes because I'm sure those same people are also able to work on security.

daveFNbuck 9y ago

Responsible disclosure is about preventing the bug from being exploited before it can be fixed. Knowing about this bug doesn't help me compromise someone else, but it does help me avoid getting compromised.

deleted 9y ago
[deleted]
bagacrap 9y ago
presumably if you had access to someone's locked MBP and you could move focus away from the password field you might be able to trick them into revealing their pw; if the setup requires access to an unlocked device it still allows you to leverage temporary access to unlocked device to get a leaked password.
dingaling 9y ago
> but it does help me avoid getting compromised Only by casual hackers. The pros will probably have been exploiting the flaw for weeks or months against gainful targets. If there is a reasonable end-user workaround against the vulnerability then I'd argue it's more responsible to publish early and widely than to wait for the vendor. It becomes greyer if there is no workaround. I'm not sure what I'd support in that case.
- daveFNbuck 9y ago
  The compromise is that I accidentally type my password into Slack and send it out to everyone in the building. There is no hacker involved in this one, and I can fully protect myself by ensuring that my password is going into the password field.
CodeWriter23 9y ago
So, security through obscurity. No thanks. I'd rather know about the exploit ASAP so I can implement a workaround, rather than wait months for the vendor to get off their ass while my systems are getting hacked by the hundreds if not thousands of hackers that have 0-day knowledge. Calling what you describe as "Responsible" is intellectually dishonest.

throwawaymanbot 9y ago

totally agree, the quality has gone from apple, so has my trust.. The iphone IOS release, with the letter "I" issue was a total joke, what a disaster. Like did not one engineer testing the OS type the letter I? Cant be surprised this happens. For the first time ever, I'm contemplating an android phone. I know its nothing special but at least it seems people have done QA on it.

feelin_googley 9y ago

"With no disrespect to the developers at Apple, et. al., each one of these problems that goes viral before reaching "proper" channels..." s/that goes viral before reaching \"proper\" channels// The fact that the problems existed to begin with is more troubling than whether they became known outside the company or not. IMO. With an open source UNIX-like OS (like the ones Apple sourced from for parts of macOS), both the developers and the users can watch the commits as they happen. Developers and users anywhere can choose to watch the commits and may be able to detect a series of poor quality ones. At least they can make informed decisions on the relative merits of changes from one version to the next. (Edit: They might choose not to compile or install certain components. I do not use X11. Nor do I use systemd.) The fact that development of macOS is hidden from those outside Apple and that problems are protected from "going viral" does not make the problems any less of an issue for macOS users. The issue is not how fast and secretively they fix problems, it is how many problems their developers are introducing into the existing version to begin with. If there are problems routinely being introduced then no amount of fixing after the fact and behind the scenes is going to make the OS higher quality. Only due care taken before introducing changes will guard against further deterioration of quality level. (Edit: The mention of open source is not intended to be interpreted as an argument that open source inherently results in better software. Perhaps skill and attention to detail are at cause. This is a debate worth avoiding. The relevance of the mention of open source is intended to suggest that detecting and avoiding problematic software may be easier for some users, e.g. yours truly, if they can access the source code. As opposed to hoping that Acme Hardware and Software Corporation will quickly and secretly fix all software problems that slipped through their QC procedures. Too late for the user who has already paid for the software and updated to the new version. That argument should not be too controversial.)

rrdharan 9y ago
Ironically Linux has had so many long standing versions of this exact vulnerability (screensaver issues leading to various forms of terrible disclosure) that it's not even really interesting to talk about them. I'd send you to the relevant jwz rants but I'd rather spare everyone the goatse-ing...
pfranz 9y ago

j4ship 9y ago

we do regard them as a joke, apple is for you non techies that like cool stuff and dont care about being over charged for a metal case .... how many iphone have broken screens. Apple customers dont care about the tech , they care about cool. This is what Steve Jobs and apple as branded themselves on so thats what you get, cool without good tech. And it wont matter becuase that is not the reason people buy Apple. Tech community doesnt care about Apple, but the engineers will happily take their money to work on their products. If apple falls programming and computing will go on happily and at least we wont have to build over priced products for a bunch of children to take selfie shots that dont care 2 cents that they have a technical marvel in their hands.

rdtsc 9y ago

> “Responsible disclosure” is great stuff for creating a culture of free outsourcing of tech companies’ most imporant feature (security) to the same people that paid those companies thousands of dollars for that privilege. Also "Responsible disclosure" means absolute nothing to most people who are not security researchers. They don't know about it, even if there is a bounty and they could make a decent profit, they have no idea what those things are. They notice they can get root access or the focus sends their password to Slack and they'll tweet about it.

jagermo 9y ago

If you look at the "root" issue last week, public shaming seems to be the only way to get Apple to work on problems in macOS. They didn't even include it into the big bounty, did they? It feels like they don't give a shit about non-iOS-devices.