3 ms·
> Apple most often seems to accept that it doesn't have good people so it'll not roll its own but just use things that already exist Do they? Wasn't "goto fail
by ziml77 6y ago
> Apple most often seems to accept that it doesn't have good people so it'll not roll its own but just use things that already exist
Do they? Wasn't "goto fail" a bug in their SSL code? That one wasn't even a bug that a reviewer would need to reason about the logic of the code to see.
- tialaramex 6y agoThere are exceptions, but also that's an implementation bug. This Microsoft vulnerability isn't a bug in the code, it's a design mistake, if you implement exactly what Microsoft's design document says for NetLogon, one time in 256 all zeroes lets you in. By design. Stupid stupid design. If Microsoft had specified that the IV has to be set to 0102030405060708090A0B0C0D0E0F00 this vulnerability doesn't exist. Is there a different vulnerability? Maybe, it's hard to see how to attack it. But with all zeroes, just send all zeroes, what could be easier?