4 ms·

One of the quicker cycles of "extraordinary claim" to "retracted" I've seen recently.

rnjesus 4y ago
incite rage with anti-apple sentiment -> get twitter followers and engagement admit you were wrong and made it all up -> get people to ‘respect’ you and even more twitter followers
- imwillofficial 4y ago
  I wouldn’t say that’s a fair characterization. Besides the ham fisted approach, the original vuln idea seemed reasonable. They were wrong, it happens to the best of us. I’d say the potential security risk was worth raising the flag over. Better be wrong and safe, having many of us learn something along the way, then overly cautious and leave a potential problem unaddressed.
  - zimpenfish 4y ago
    > then overly cautious and leave a potential problem unaddressed. I don't think "do even the most cursory verification to check if the extraordinary thing I've just seen is actually happening" could be counted as "overly cautious".
    - imwillofficial 4y ago
      As somebody in the security field tackling this stuff every day, I am happy with the tradeoffs made, and the resolution.
maliker 4y ago
Great job by the author for looking more closely and clarifying this was not an issue.
- zimpenfish 4y ago
  > Great job by the author for looking more closely I mean, I wouldn't say "great" when you've incited a security panic because you didn't even do the bare minimum of ... > looking more closely
  - maliker 4y ago
    Better to miss issues that aren’t reported or scramble to handle near misses? Optimize for false negatives at your own peril.
    - macintux 4y ago
      Probably there’d be less hostility had the author not been so egregiously snarky towards people who couldn’t reproduce it.
      - radicaldreamer 4y ago
        Assuming everyone else is lazy or not trying hard enough to reproduce a misreported issue wasn't a great move
chroma 4y ago
Because a ton of people replied saying they couldn't reproduce the issue. It didn't help that the guy was snarky to a bunch of security researchers who asked him for more info.[1] He also neglected to mention that he'd recently visited the canary URL on that computer (which is why it was in Firefox’s recent shortcuts). Had he been more forthcoming with information, people would have figured it out sooner and his misinformation wouldn't have spread as far. 1. See the bottom of the archived tweet thread: https://archive.ph/qKyA3 https://archive.ph/qKyA3
- zimpenfish 4y ago
  > Had he been more forthcoming with information It would have been better to have done some verification first, before tweeting, to check whether it was actually doing what it appeared to be. Especially when you know your tweets have considerable reach.
- secitroe 4y ago
  > Matt Hodges @hodgesmr > lololol @ the "security researchers" sliding into my DMs asking me to run shell commands and send them the output > Go run your Little Snitch and WireShark and tcpdump and mdimport and mitmproxy and system_profiler on yourself; I'm not your SOC Wow this guy comes across like a right twat. No wonder his apology sounds like it's coming out from furiously gritted teeth. Still, I hope he learned something useful from this experience. Many of us have gone through a similar period of arrogance in our younger years, only to be shocked into looking back in shame later on.

incite rage with anti-apple sentiment -> get twitter followers and engagement admit you were wrong and made it all up -> get people to ‘respect’ you and even more twitter followers

imwillofficial 4y ago
I wouldn’t say that’s a fair characterization. Besides the ham fisted approach, the original vuln idea seemed reasonable. They were wrong, it happens to the best of us. I’d say the potential security risk was worth raising the flag over. Better be wrong and safe, having many of us learn something along the way, then overly cautious and leave a potential problem unaddressed.
- zimpenfish 4y ago
  > then overly cautious and leave a potential problem unaddressed. I don't think "do even the most cursory verification to check if the extraordinary thing I've just seen is actually happening" could be counted as "overly cautious".
  - imwillofficial 4y ago
    As somebody in the security field tackling this stuff every day, I am happy with the tradeoffs made, and the resolution.

maliker 4y ago

Great job by the author for looking more closely and clarifying this was not an issue.

zimpenfish 4y ago
> Great job by the author for looking more closely I mean, I wouldn't say "great" when you've incited a security panic because you didn't even do the bare minimum of ... > looking more closely
- maliker 4y ago
  Better to miss issues that aren’t reported or scramble to handle near misses? Optimize for false negatives at your own peril.
  - macintux 4y ago
    Probably there’d be less hostility had the author not been so egregiously snarky towards people who couldn’t reproduce it.
    - radicaldreamer 4y ago
      Assuming everyone else is lazy or not trying hard enough to reproduce a misreported issue wasn't a great move

chroma 4y ago

Because a ton of people replied saying they couldn't reproduce the issue. It didn't help that the guy was snarky to a bunch of security researchers who asked him for more info.[1] He also neglected to mention that he'd recently visited the canary URL on that computer (which is why it was in Firefox’s recent shortcuts). Had he been more forthcoming with information, people would have figured it out sooner and his misinformation wouldn't have spread as far. 1. See the bottom of the archived tweet thread: https://archive.ph/qKyA3 https://archive.ph/qKyA3

zimpenfish 4y ago
> Had he been more forthcoming with information It would have been better to have done some verification first, before tweeting, to check whether it was actually doing what it appeared to be. Especially when you know your tweets have considerable reach.
secitroe 4y ago
> Matt Hodges @hodgesmr > lololol @ the "security researchers" sliding into my DMs asking me to run shell commands and send them the output > Go run your Little Snitch and WireShark and tcpdump and mdimport and mitmproxy and system_profiler on yourself; I'm not your SOC Wow this guy comes across like a right twat. No wonder his apology sounds like it's coming out from furiously gritted teeth. Still, I hope he learned something useful from this experience. Many of us have gone through a similar period of arrogance in our younger years, only to be shocked into looking back in shame later on.