6 ms·

News.YC community is being much kinder towards Apple than it acted towards Dropbox for identical security bugs. Dropbox even had the issue resolved in hours.

by parfe 15y ago

News.YC community is being much kinder towards Apple than it acted towards Dropbox for identical security bugs. Dropbox even had the issue resolved in hours. I don't see anyone threatening to switch away from Apple or demanding an immediate personal response from Steve Jobs or ranting how this lapse is unforgivable. And you can't say it's because this bug only affects a small portion of Lion users as the Dropbox bug also only affected 100 accounts.

dpcan 15y ago
This is how bullying works. If the victim is small and accessible, with their reputation on the line, you can put them in their place. When DropBox broke, the community pounced. Apple can't be bullied. With DropBox I can just cancel my membership and sign-up somewhere else. I'm not going to throw out my $1000+ Mac with $1000+ in software on it out the Window, right along with my livelihood of creating software for iOS. I'm not going to cancel my iPhone contract and pay hundreds in penalties too, and throw out all my apps and games and switch to Android. Not happening. They've got us by the balls here, we just have to let them fix this and move on.
- true_religion 15y ago
  It's not bullying to tell people to fix security bugs. It's not bullying to use your own resources to entice (or force) them to do so in a timely manner. You're right that no one can threaten Apple and get action, but you're wrong in characterizing the threat as bullying.
- deleted 15y ago
  [deleted]
tedunangst 15y ago
The dropbox bug only affected 100 people? Or it affected everyone but only 100 people logged in with it? That's a big difference.
- parfe 15y ago
  "According to our records, there were fewer than a hundred affected users and neither account settings nor files were modified in any of these accounts." http://blog.dropbox.com/?p=821 http://blog.dropbox.com/?p=821 Everyone was vulnerable for 4 hours.
- deleted 15y ago
  [deleted]
thaumaturgy 15y ago
The News.YC "community" is not homogenous. I find this just as odious as Dropbox's security issues, and just as indicative of a broken software development process. Then again, it's Apple. I wouldn't normally even bother commenting here, because nobody from Apple cares. My finest rant would have epsilon impact on anyone at Apple, so why bother? Dropbox, on the other hand, is present here. Someone might be able to convince them to change their practices for the better by getting on their case here. That doesn't justify meanness, but a different response from this community over an issue from BigIvoryTowerCo versus OneOfOurOwn shouldn't be surprising.
napierzaza 15y ago
It's because it's only for enterprise setups that use LDAP in the particular way described here. It's not every Mac OS X user, it's not every enterprise Mac OS X setup. If they had been using AD it would have worked. So really it's not as wide spread as DropBox's issue that was for every single user.
- ryall 15y ago
  No. AD is fucked too, just in a different way. 5 minute logins anyone? And don't restart or you'll have to re-bind to AD.
tvon 15y ago
> And you can't say it's because this bug only affects a small portion of Lion users as the Dropbox bug also only affected 100 accounts. - The dropbox issue was not initially reported as 100 exposed accounts, it was reported as "Dropbox vulnerable", that's something that alarms about 99% of the HN readership. - Dropbox is a YC company. - Dropbox is exposed to the world and the issue was seemingly out of users control (until the facts were known). By comparison, the OSX issue was initially reported as being LDAP specific which probably means it's not an issue for 99% of HN readership. The OSX issue can also be disabled, at great inconvenience I'm sure, but the point is you can protect yourself. The OSX issue is a big screwup, but I see no mystery as to the response.
eli 15y ago
That's because lots of people here have dropbox accounts. Very few authenticate via LDAP to a Lion server. People are a lot more emotional about problems when they're personally affected.
cbs 15y ago
>News.YC community is being much kinder towards Apple than it acted towards Dropbox for identical security bugs My old HN account got shaddowbanned after I talked shit about Dropbox when that happened. The post got a big number of points (more than anything else I had ever posted) and sparked interesting discussion, but I now know better than to question the Hacker News community's Sacred Cows. >or ranting how this lapse is unforgivable. I ranted against Dropbox because of the amount of people downplaying the severity, I'm not seeing that with this OS X issue (yet?). With the dropbox password thing, I saw a frequent argument, also used in their encryption scandal, one that really pissed me off. People were defending them with what boiled down to "you're stupid for expecting them to provide any level of service, as reasonable as it may be, unless their underlying tech doesn't force them to provide it".

by parfe 15y ago

dpcan 15y ago

This is how bullying works. If the victim is small and accessible, with their reputation on the line, you can put them in their place. When DropBox broke, the community pounced. Apple can't be bullied. With DropBox I can just cancel my membership and sign-up somewhere else. I'm not going to throw out my $1000+ Mac with $1000+ in software on it out the Window, right along with my livelihood of creating software for iOS. I'm not going to cancel my iPhone contract and pay hundreds in penalties too, and throw out all my apps and games and switch to Android. Not happening. They've got us by the balls here, we just have to let them fix this and move on.

true_religion 15y ago
It's not bullying to tell people to fix security bugs. It's not bullying to use your own resources to entice (or force) them to do so in a timely manner. You're right that no one can threaten Apple and get action, but you're wrong in characterizing the threat as bullying.
deleted 15y ago
[deleted]

tedunangst 15y ago

The dropbox bug only affected 100 people? Or it affected everyone but only 100 people logged in with it? That's a big difference.

parfe 15y ago
"According to our records, there were fewer than a hundred affected users and neither account settings nor files were modified in any of these accounts." http://blog.dropbox.com/?p=821 http://blog.dropbox.com/?p=821 Everyone was vulnerable for 4 hours.
deleted 15y ago
[deleted]

thaumaturgy 15y ago

The News.YC "community" is not homogenous. I find this just as odious as Dropbox's security issues, and just as indicative of a broken software development process. Then again, it's Apple. I wouldn't normally even bother commenting here, because nobody from Apple cares. My finest rant would have epsilon impact on anyone at Apple, so why bother? Dropbox, on the other hand, is present here. Someone might be able to convince them to change their practices for the better by getting on their case here. That doesn't justify meanness, but a different response from this community over an issue from BigIvoryTowerCo versus OneOfOurOwn shouldn't be surprising.

napierzaza 15y ago

It's because it's only for enterprise setups that use LDAP in the particular way described here. It's not every Mac OS X user, it's not every enterprise Mac OS X setup. If they had been using AD it would have worked. So really it's not as wide spread as DropBox's issue that was for every single user.

ryall 15y ago
No. AD is fucked too, just in a different way. 5 minute logins anyone? And don't restart or you'll have to re-bind to AD.

tvon 15y ago

> And you can't say it's because this bug only affects a small portion of Lion users as the Dropbox bug also only affected 100 accounts. - The dropbox issue was not initially reported as 100 exposed accounts, it was reported as "Dropbox vulnerable", that's something that alarms about 99% of the HN readership. - Dropbox is a YC company. - Dropbox is exposed to the world and the issue was seemingly out of users control (until the facts were known). By comparison, the OSX issue was initially reported as being LDAP specific which probably means it's not an issue for 99% of HN readership. The OSX issue can also be disabled, at great inconvenience I'm sure, but the point is you can protect yourself. The OSX issue is a big screwup, but I see no mystery as to the response.

eli 15y ago

That's because lots of people here have dropbox accounts. Very few authenticate via LDAP to a Lion server. People are a lot more emotional about problems when they're personally affected.

cbs 15y ago

>News.YC community is being much kinder towards Apple than it acted towards Dropbox for identical security bugs My old HN account got shaddowbanned after I talked shit about Dropbox when that happened. The post got a big number of points (more than anything else I had ever posted) and sparked interesting discussion, but I now know better than to question the Hacker News community's Sacred Cows. >or ranting how this lapse is unforgivable. I ranted against Dropbox because of the amount of people downplaying the severity, I'm not seeing that with this OS X issue (yet?). With the dropbox password thing, I saw a frequent argument, also used in their encryption scandal, one that really pissed me off. People were defending them with what boiled down to "you're stupid for expecting them to provide any level of service, as reasonable as it may be, unless their underlying tech doesn't force them to provide it".