5 ms·

How many other hundreds-of-billions-of-dollars companies could produce a production code fix faster?

by jachee 8y ago

briandear 8y ago
It should only take a few minutes if you’re the average HN commentator.
- olliej 8y ago
  A HN commentator would never have made such a big in the first place. Duh. :D
  - olliej 8y ago
    Follow up, would it be “an HN” or “a HN”? eg hatche-en or atche-n or hacker? As before I’m sure the worlds greatest linguist will also be here :)
    - howenterprisey 8y ago
      Probably "an HN", as saying the letter "H" sounds like "ayy-ch" (in American pronunciation, at least), which has an initial vowel sound.
      - olliej 8y ago
        Right, but when I tried saying it in my head it seemed weird because my brains turn it into “an hacker news” :)
- SmellyGeekBoy 8y ago
  They could have built their own Group FaceTime in their mom's basement in a weekend. With blackjack and hookers!
p1necone 8y ago
(according to the article) They didn't spend over a week developing a fix to the bug, it took them over a week to just disable the feature (given the severity of the bug this should have been done as soon as they knew about it). It also sounds like the person reporting the bug was ignored until she made a developer account and reported the bug through that - that shouldn't have been necessary.
- cjbprime 8y ago
  I don't agree that the article makes or implies this claim. A more plausible timeline is that Apple (incredibly) intended to roll out a client-side update fix on a relaxed schedule, until the repro went viral and forced their hand on a server-side shutdown. It is not credible to imagine that an emergency disabling of Group FaceTime takes a week.
  - netsharc 8y ago
    > roll out a client-side update fix on a relaxed schedule "There's a bug that allows our devices to be used as eavesdropping tools. But let's relax about it!"
    - sangnoir 8y ago
      > "We at Apple believe that privacy is a fundamental human right but also recognize that not everyone sees it that way," Cook said[1] I guess that "not everyone" includes some product people working on FaceTime. 1. http://time.com/5433499/tim-cook-apple-data-privacy/ http://time.com/5433499/tim-cook-apple-data-privacy/
  - darkpuma 8y ago
    > A more plausible timeline is that Apple (incredibly) intended to roll out a client-side update fix on a relaxed schedule The most plausible scenario is that somebody at Apple threw the original report in the figurative trash bin after failing to read it or failing to realize the significance of it (although given the clarity of the report, failing to read it and failing to understand it are virtually the same thing.)
olliej 8y ago
The fix itself depends on what the problem is - clearly they went for a “disable server side” route, but I’m sure they also tried to work out if they could filter on the server side. My guess is they can’t because the “call accepted” response is probably in the encrypted data stream. Rolling a system update is also not immediate (eg you need to be sure that you don’t result in user flows resulting in no audio), hence the focus on server side fixes (that lead to today’s “kill server side”) fix. But also “a week to fix” depends - it’s a week from the report, at which point it needs to be screened. So let’s say a day to get to an actual engineer - it may take longer to get appropriate security keywords attached - then the engineer would need to actually read it, which depends on what their current workload is, where they are in their release schedule, etc. It’s not trivial - all big companies get thousands of big reports a day, and they just take time to get to the right place. I agree with what other have said (telling a consumer to get an ADC account is clearly suboptimal). But in general the path from consumer to security big is challenging for everyone.

How many other hundreds-of-billions-of-dollars companies could produce a production code fix faster?

by jachee 8y ago

How many other hundreds-of-billions-of-dollars companies could produce a production code fix faster?

briandear 8y ago

It should only take a few minutes if you’re the average HN commentator.

olliej 8y ago
A HN commentator would never have made such a big in the first place. Duh. :D
- olliej 8y ago
  Follow up, would it be “an HN” or “a HN”? eg hatche-en or atche-n or hacker? As before I’m sure the worlds greatest linguist will also be here :)
  - howenterprisey 8y ago
    Probably "an HN", as saying the letter "H" sounds like "ayy-ch" (in American pronunciation, at least), which has an initial vowel sound.
    - olliej 8y ago
      Right, but when I tried saying it in my head it seemed weird because my brains turn it into “an hacker news” :)
SmellyGeekBoy 8y ago
They could have built their own Group FaceTime in their mom's basement in a weekend. With blackjack and hookers!

p1necone 8y ago

(according to the article) They didn't spend over a week developing a fix to the bug, it took them over a week to just disable the feature (given the severity of the bug this should have been done as soon as they knew about it). It also sounds like the person reporting the bug was ignored until she made a developer account and reported the bug through that - that shouldn't have been necessary.

cjbprime 8y ago
I don't agree that the article makes or implies this claim. A more plausible timeline is that Apple (incredibly) intended to roll out a client-side update fix on a relaxed schedule, until the repro went viral and forced their hand on a server-side shutdown. It is not credible to imagine that an emergency disabling of Group FaceTime takes a week.
- netsharc 8y ago
  > roll out a client-side update fix on a relaxed schedule "There's a bug that allows our devices to be used as eavesdropping tools. But let's relax about it!"
  - sangnoir 8y ago
    > "We at Apple believe that privacy is a fundamental human right but also recognize that not everyone sees it that way," Cook said[1] I guess that "not everyone" includes some product people working on FaceTime. 1. http://time.com/5433499/tim-cook-apple-data-privacy/ http://time.com/5433499/tim-cook-apple-data-privacy/
- darkpuma 8y ago
  > A more plausible timeline is that Apple (incredibly) intended to roll out a client-side update fix on a relaxed schedule The most plausible scenario is that somebody at Apple threw the original report in the figurative trash bin after failing to read it or failing to realize the significance of it (although given the clarity of the report, failing to read it and failing to understand it are virtually the same thing.)

olliej 8y ago

The fix itself depends on what the problem is - clearly they went for a “disable server side” route, but I’m sure they also tried to work out if they could filter on the server side. My guess is they can’t because the “call accepted” response is probably in the encrypted data stream. Rolling a system update is also not immediate (eg you need to be sure that you don’t result in user flows resulting in no audio), hence the focus on server side fixes (that lead to today’s “kill server side”) fix. But also “a week to fix” depends - it’s a week from the report, at which point it needs to be screened. So let’s say a day to get to an actual engineer - it may take longer to get appropriate security keywords attached - then the engineer would need to actually read it, which depends on what their current workload is, where they are in their release schedule, etc. It’s not trivial - all big companies get thousands of big reports a day, and they just take time to get to the right place. I agree with what other have said (telling a consumer to get an ADC account is clearly suboptimal). But in general the path from consumer to security big is challenging for everyone.