4 ms·

That's the wrong URL, too. Just use https://feedbackassistant.apple.com/ https://feedbackassistant.apple.com/

saagarjha 6y ago
It’s not the wrong URL, it’s the old URL. Until recently it was just as effective as the URL you gave.
cmeacham98 6y ago
SSL_ERROR_UNSAFE_NEGOTIATION when connecting in firefox. https://www.ssllabs.com/ssltest/analyze.html?d=appleseed.apple.com https://www.ssllabs.com/ssltest/analyze.html?d=appleseed.app... > This server is vulnerable to the Zombie POODLE vulnerability. Grade set to F. > There is no support for secure renegotiation. > This server does not support Forward Secrecy with the reference browsers. Grade capped to B. > This server supports TLS 1.0 and TLS 1.1. Grade capped to B. What the fuck?
- cookiengineer 6y ago
  > POODLE vulnerability. Maybe the domain still uses the gotofail [1] prone implementation of Apple's SSL library? [1] https://nvd.nist.gov/vuln/detail/CVE-2014-1266 https://nvd.nist.gov/vuln/detail/CVE-2014-1266 Personal note: After that CVE was disclosed in 2014, I decided to ditch all Apple hardware forever. There is absolutely no security on any Apple device. The bug meant that there was not a single working SSL encryption from Apple's first OS up until (and including) OSX 10.9.2 and iOS 7.0.6 ... which kinda speaks volumes on Q&A or security audits.
  - reanimus 6y ago
    Were all of the other OS X versions affected, too? The CVE only lists 10.9.x (so, 10.9 and 10.9.1)
    - cookiengineer 6y ago
      Yes, all previous OSX version up until 2014 were affected, too. The doubled `goto fail;` line was included since the first public revision of libsecurity_ssl, and the (c) of that file is 1999-2001,2005-2012 Apple Inc. [1] Nowadays, due to Apple never using any git or any other version control software for opensourced codes, I could trace it down to Mac OSX 10.4 which was released in 2005. [2] With 10.1, there's no libsecurity open sourced, I don't know why, but I'm pretty damn sure that at least 10.2 included the library back then. I don't have my old Powerbook G4 anymore, but I swear I could verify this bug on 10.2 (Jaguar) that was running on it at the time. Other versions of (maybe patched?) versions of libsecurity-ssl are located on the same server, with a global directory for everything so it's not actually versioned!? [3] At least the version of the file that has copyright 2000-2001 still has the same bug in it, so that is very likely the one that was used in the 10.1 public release [4] [1] https://opensource.apple.com/source/Security/Security-55471/libsecurity_ssl/lib/sslKeyExchange.c.auto.html https://opensource.apple.com/source/Security/Security-55471/... [2] https://opensource.apple.com/release/mac-os-x-104.html https://opensource.apple.com/release/mac-os-x-104.html [3] https://opensource.apple.com/source/libsecurity_ssl/ https://opensource.apple.com/source/libsecurity_ssl/ [4] https://opensource.apple.com/source/libsecurity_ssl/libsecurity_ssl-6/lib/sslKeyExchange.cpp.auto.html https://opensource.apple.com/source/libsecurity_ssl/libsecur...

It’s not the wrong URL, it’s the old URL. Until recently it was just as effective as the URL you gave.

SSL_ERROR_UNSAFE_NEGOTIATION when connecting in firefox. https://www.ssllabs.com/ssltest/analyze.html?d=appleseed.apple.com https://www.ssllabs.com/ssltest/analyze.html?d=appleseed.app... > This server is vulnerable to the Zombie POODLE vulnerability. Grade set to F. > There is no support for secure renegotiation. > This server does not support Forward Secrecy with the reference browsers. Grade capped to B. > This server supports TLS 1.0 and TLS 1.1. Grade capped to B. What the fuck?

cookiengineer 6y ago
> POODLE vulnerability. Maybe the domain still uses the gotofail [1] prone implementation of Apple's SSL library? [1] https://nvd.nist.gov/vuln/detail/CVE-2014-1266 https://nvd.nist.gov/vuln/detail/CVE-2014-1266 Personal note: After that CVE was disclosed in 2014, I decided to ditch all Apple hardware forever. There is absolutely no security on any Apple device. The bug meant that there was not a single working SSL encryption from Apple's first OS up until (and including) OSX 10.9.2 and iOS 7.0.6 ... which kinda speaks volumes on Q&A or security audits.
- reanimus 6y ago
  Were all of the other OS X versions affected, too? The CVE only lists 10.9.x (so, 10.9 and 10.9.1)
  - cookiengineer 6y ago
    Yes, all previous OSX version up until 2014 were affected, too. The doubled `goto fail;` line was included since the first public revision of libsecurity_ssl, and the (c) of that file is 1999-2001,2005-2012 Apple Inc. [1] Nowadays, due to Apple never using any git or any other version control software for opensourced codes, I could trace it down to Mac OSX 10.4 which was released in 2005. [2] With 10.1, there's no libsecurity open sourced, I don't know why, but I'm pretty damn sure that at least 10.2 included the library back then. I don't have my old Powerbook G4 anymore, but I swear I could verify this bug on 10.2 (Jaguar) that was running on it at the time. Other versions of (maybe patched?) versions of libsecurity-ssl are located on the same server, with a global directory for everything so it's not actually versioned!? [3] At least the version of the file that has copyright 2000-2001 still has the same bug in it, so that is very likely the one that was used in the 10.1 public release [4] [1] https://opensource.apple.com/source/Security/Security-55471/libsecurity_ssl/lib/sslKeyExchange.c.auto.html https://opensource.apple.com/source/Security/Security-55471/... [2] https://opensource.apple.com/release/mac-os-x-104.html https://opensource.apple.com/release/mac-os-x-104.html [3] https://opensource.apple.com/source/libsecurity_ssl/ https://opensource.apple.com/source/libsecurity_ssl/ [4] https://opensource.apple.com/source/libsecurity_ssl/libsecurity_ssl-6/lib/sslKeyExchange.cpp.auto.html https://opensource.apple.com/source/libsecurity_ssl/libsecur...