5 ms·

I find it interesting how Apple is defended when they make security blunders, while Microsoft was heavily slammed back in the day. It is simply inacceptable th

by mrich 14y ago

I find it interesting how Apple is defended when they make security blunders, while Microsoft was heavily slammed back in the day. It is simply inacceptable that a user basically reported the issue on their support forum and didn't even get an answer back.

joejohnson 14y ago
The parent comment isn't defending Apple; @tptacek is pointing out that this issue won't impact a large number of users, that the headline is misleading, and that maybe ZDNet is sensationalizing a minor issue.
- mrich 14y ago
  It sounded defensive to me. "name a single case where ZDNet has broken a story we cared about" sounded like ZDNet should have shut up about this very important issue. It doesn't matter that they are not the first reporting it, their readers may thank them for it.
  - tptacek 14y ago
    I think if your presumption is that my whole experience of ZDNet's security reporting is "when they happen to hit the HN front page", that's a reasonable reading. But it's not. I'm a software security person. I also know Ryan Naraine, well enough that we'd spot each other and say "hi" in a crowd. (I like Ryan, but ZDNet?). I've been interviewed by ZDNet people (we avoid press now). I'm offering a carefully considered assessment: HN would probably be better off if we just banned ZDNet and venues like ZDNet. Ryan Naraine and Dancho Danchev have other outlets to write in that might make it to HN.
    - larrys 14y ago
      "I've been interviewed by ZDNet people (we avoid press now)." Curious if one of the reasons for that is that it makes you a target?
      - tptacek 14y ago
        That's not it. It's just, very minimal potential upside, lots of annoying downsides. Re-read everything you've read on HN about "being careful talking to the press", assume that --- unlike most startups --- the press is seeking you out pretty regularly, and then consider the mental energy required to minimize the downsides.
        larrys 14y ago
        YMDV. I'm not even selling a high ticket item but back when I courted the press (simply by writing emails whenever a topic I knew about was mentioned) I've had results that have well paid for themselves in a) the effort and b) the misquotes and annoying downsides. (In one case my small company at the time was mentioned right next to AT&T in a list of 4 companies mentioned.) I really can't imagine how it wouldn't pay for you (business wise) to be mentioned given what you do in mainstream press. In order to be mentioned in mainstream press it pays to have mention elsewhere as a starter. I can see a CEO with a security problem reading a quote of yours in the WSJ and handing the tearout to someone with the instructions to contact you about some issues they are dealing with. I can see links and quotes from both online and offline mention of your name appearing on your website and giving you and edge on your competition. By the way mention on your website such as "Our work has been featured in Network World, eWeek, Forbes, Macworld, Wired, and the Washington Post, and at conferences ranging from Black Hat to Gartner" and links to or copies of said articles will not produce the same results. And if the articles are old that is why you need fresh mention. That said I can totally see (which is why I asked) how a security researcher frequently mentioned in the press, like a former boxer sentenced to prison, becomes a juicy target and that is definitely a downside.
        tptacek 14y ago
        Couple things: * In my particular line of business, the quality of one's website has vanishingly little to do with success. We have a cookie-cutter front page that says cookie-cutter things; its purpose is to confirm that we are, in fact, a real business. It succeeds at that. * I have no doubt whatsoever that people outside software security, or maybe even new entrants in software security, have much to gain from press hits. But "fresh hits" do very little for us. * Only a very small minority of our business is "event driven", such as when a CEO realizes he has an immediate security problem. We're an engineering service. In the overwhelming majority of cases, we're working for other engineers and their product managers who've known for ages that they need help with security; we get engaged when it makes sense in the budget and the dev cycle to engage us. We're one of the largest pure, dedicated software security firms; we're also one of the more mature/established of them. Most of our business tomorrow will come from executing competently today; people who can reliably flush security flaws out of arbitrary pieces of software are in short supply and high demand.
w1ntermute 14y ago
> I find it interesting how Apple is defended when they make security blunders, while Microsoft was heavily slammed back in the day. Given that we have a plurality of OS X users on HN (according to the last poll), it's not surprising that post-purchase rationalization is a common response to such articles.
- tptacek 14y ago
  "Post-purchase rationalization"? What a weird thing to say.
  - joenathan 14y ago
    Not really, it's very common, people defend things they have an interest in.
  - ryanmolden 14y ago
    It's a well known behavior, once people have made a commitment they move from analyzing objectively to defending their choice. Not saying it is in play here, but it isn't really unheard of. [1] http://en.m.wikipedia.org/wiki/Choice-supportive_bias http://en.m.wikipedia.org/wiki/Choice-supportive_bias
    - dsrguru 14y ago
      Dan Gilbert's TED Talk does a great job demonstrating this (http://www.ted.com/talks/dan_gilbert_asks_why_are_we_happy.html http://www.ted.com/talks/dan_gilbert_asks_why_are_we_happy.h...).
  - w1ntermute 14y ago
    Not weird at all. It's a documented phenomenon in marketing research: http://www.jstor.org/discover/10.2307/3150288?uid=3739744&uid=2&uid=4&uid=3739256&sid=21100774741791 http://www.jstor.org/discover/10.2307/3150288?uid=3739744&#3... Since its effect is directly proportional to the cost of the purchase in question, it would make sense that relatively expensive objects, such as smartphones and computers, would trigger a correspondingly stronger negative reaction to criticism of said product.
kevinchen 14y ago
mrich, no company's engineers can be expected to spend their days reading every single thread on the company's support forum. I wonder if the researcher(s) reported the issue using Apple's Bug Reporter? It has a special category for Security.
- Drbble 14y ago
  What does "support" mean then? They absolutely should have staff skimming the forums and escalating important issues.
- mrich 14y ago
  The post was made on the Enterprise servers forum. https://discussions.apple.com/thread/3715366 https://discussions.apple.com/thread/3715366 If your company sells software to businesses, the standards are a little higher. Either you make sure such a bug cannot slip through by testing, or you have to make it up in support by at least reading all the new customer questions. How much effort is it to read the first post of every new thread started there? I bet it can be done by one guy who has basic knowledge of computers, heck just hire a Genius bar guy. :)
hej 14y ago
This comment doesn’t defend Apple. It doesn’t make any value judgments about Apple at all. It merely attacks the article.
- quanticle 14y ago
  Given that the article is pointing out a security hole in OSX, any attack of the article is an implicit defense of Apple.
  - hej 14y ago
    When something is factually wrong it’s factually wrong. That’s it. There is nothing else to it. Nobody said that there is no security hole and no problem.
    - brudgers 14y ago
      The comment did not point out anything factually incorrect in the article. The claim was that the author didn't know anyone who engaged in the practices which would lead to a security breach. That's anecdote, not evidence - even given the poster's experience in security there's reason to suspect that such experience would be primarily with Mac installations which take security more seriously than Apple's marketing department portrays it.
      - hej 14y ago
        Oh come on! Don’t be so dense.
tptacek 14y ago
Every single time the topic of Microsoft's security track record has come up on HN, I've waded in to point out what a great job Microsoft has done. Here's one of my highest rated comments from several years ago: http://news.ycombinator.com/item?id=577684 http://news.ycombinator.com/item?id=577684 Now, I don't disagree with your general point: Microsoft gets more scrutiny than Apple does on HN about security, and Apple enjoys an inflated perception of platform security here --- I attribute that to a general Unix bias, by the way, and not to Apple fandom. But please be careful to note that I'm not a part of that phenomenon. You will, if you dig, find comments of mine that are critical of Apple security; you will probably not find comments critical of Microsoft's security practices. (To be clear: securing a whole platform is an incredibly difficult job, and platform software security talent is some of the hardest to find in the whole industry; both Apple and Microsoft take this stuff seriously and, compared to 2002, both do a fantastic job. Also: the security of the iOS platform is a different story than of the OS X platform.)
- zobzu 14y ago
  I don't see how comment history makes a separate comment more truthful. If anything, it makes people less likely to have proper critical thinking because they know you. Which is exactly what he points out about your comment, but related to Apple. You know Apple thus you're less likely to criticize them properly. It doesn't mean what you wrote is entirely wrong, but I think he has a point. MS is very harshly criticized for any security issue, no matter how small, and hey, that's probably a good thing. For Apple if there's any possibility we find them.. excuses.. really? (and the "I don't know anyone who used file vault before!" sounds terrible, to be honest)
  - gruseom 14y ago
    tptacek has been the most prominent defender of Microsoft's security practices on HN for years. Everything you guys are saying about how Apple get off easy while MS get slammed, he has said repeatedly and more coherently. And out of direct experience to boot. It just didn't happen to be - and still isn't - relevant here.
rickmb 14y ago
"Back in the day", Microsoft didn't make security blunders. It made things fundamentally insecure as a matter of policy, and could get away with it because they had a virtual monopoly. This significant difference informs how people respond, regardless of the nature of the blunder.

by mrich 14y ago

joejohnson 14y ago

The parent comment isn't defending Apple; @tptacek is pointing out that this issue won't impact a large number of users, that the headline is misleading, and that maybe ZDNet is sensationalizing a minor issue.

mrich 14y ago
It sounded defensive to me. "name a single case where ZDNet has broken a story we cared about" sounded like ZDNet should have shut up about this very important issue. It doesn't matter that they are not the first reporting it, their readers may thank them for it.
- tptacek 14y ago
  I think if your presumption is that my whole experience of ZDNet's security reporting is "when they happen to hit the HN front page", that's a reasonable reading. But it's not. I'm a software security person. I also know Ryan Naraine, well enough that we'd spot each other and say "hi" in a crowd. (I like Ryan, but ZDNet?). I've been interviewed by ZDNet people (we avoid press now). I'm offering a carefully considered assessment: HN would probably be better off if we just banned ZDNet and venues like ZDNet. Ryan Naraine and Dancho Danchev have other outlets to write in that might make it to HN.
  - larrys 14y ago
    "I've been interviewed by ZDNet people (we avoid press now)." Curious if one of the reasons for that is that it makes you a target?
    - tptacek 14y ago
      That's not it. It's just, very minimal potential upside, lots of annoying downsides. Re-read everything you've read on HN about "being careful talking to the press", assume that --- unlike most startups --- the press is seeking you out pretty regularly, and then consider the mental energy required to minimize the downsides.
      - larrys 14y ago
        YMDV. I'm not even selling a high ticket item but back when I courted the press (simply by writing emails whenever a topic I knew about was mentioned) I've had results that have well paid for themselves in a) the effort and b) the misquotes and annoying downsides. (In one case my small company at the time was mentioned right next to AT&T in a list of 4 companies mentioned.) I really can't imagine how it wouldn't pay for you (business wise) to be mentioned given what you do in mainstream press. In order to be mentioned in mainstream press it pays to have mention elsewhere as a starter. I can see a CEO with a security problem reading a quote of yours in the WSJ and handing the tearout to someone with the instructions to contact you about some issues they are dealing with. I can see links and quotes from both online and offline mention of your name appearing on your website and giving you and edge on your competition. By the way mention on your website such as "Our work has been featured in Network World, eWeek, Forbes, Macworld, Wired, and the Washington Post, and at conferences ranging from Black Hat to Gartner" and links to or copies of said articles will not produce the same results. And if the articles are old that is why you need fresh mention. That said I can totally see (which is why I asked) how a security researcher frequently mentioned in the press, like a former boxer sentenced to prison, becomes a juicy target and that is definitely a downside.
        tptacek 14y ago
        Couple things: * In my particular line of business, the quality of one's website has vanishingly little to do with success. We have a cookie-cutter front page that says cookie-cutter things; its purpose is to confirm that we are, in fact, a real business. It succeeds at that. * I have no doubt whatsoever that people outside software security, or maybe even new entrants in software security, have much to gain from press hits. But "fresh hits" do very little for us. * Only a very small minority of our business is "event driven", such as when a CEO realizes he has an immediate security problem. We're an engineering service. In the overwhelming majority of cases, we're working for other engineers and their product managers who've known for ages that they need help with security; we get engaged when it makes sense in the budget and the dev cycle to engage us. We're one of the largest pure, dedicated software security firms; we're also one of the more mature/established of them. Most of our business tomorrow will come from executing competently today; people who can reliably flush security flaws out of arbitrary pieces of software are in short supply and high demand.

w1ntermute 14y ago

> I find it interesting how Apple is defended when they make security blunders, while Microsoft was heavily slammed back in the day. Given that we have a plurality of OS X users on HN (according to the last poll), it's not surprising that post-purchase rationalization is a common response to such articles.

tptacek 14y ago
"Post-purchase rationalization"? What a weird thing to say.
- joenathan 14y ago
  Not really, it's very common, people defend things they have an interest in.
- ryanmolden 14y ago
  It's a well known behavior, once people have made a commitment they move from analyzing objectively to defending their choice. Not saying it is in play here, but it isn't really unheard of. [1] http://en.m.wikipedia.org/wiki/Choice-supportive_bias http://en.m.wikipedia.org/wiki/Choice-supportive_bias
  - dsrguru 14y ago
    Dan Gilbert's TED Talk does a great job demonstrating this (http://www.ted.com/talks/dan_gilbert_asks_why_are_we_happy.html http://www.ted.com/talks/dan_gilbert_asks_why_are_we_happy.h...).
- w1ntermute 14y ago
  Not weird at all. It's a documented phenomenon in marketing research: http://www.jstor.org/discover/10.2307/3150288?uid=3739744&uid=2&uid=4&uid=3739256&sid=21100774741791 http://www.jstor.org/discover/10.2307/3150288?uid=3739744&#3... Since its effect is directly proportional to the cost of the purchase in question, it would make sense that relatively expensive objects, such as smartphones and computers, would trigger a correspondingly stronger negative reaction to criticism of said product.

kevinchen 14y ago

mrich, no company's engineers can be expected to spend their days reading every single thread on the company's support forum. I wonder if the researcher(s) reported the issue using Apple's Bug Reporter? It has a special category for Security.

Drbble 14y ago
What does "support" mean then? They absolutely should have staff skimming the forums and escalating important issues.
mrich 14y ago
The post was made on the Enterprise servers forum. https://discussions.apple.com/thread/3715366 https://discussions.apple.com/thread/3715366 If your company sells software to businesses, the standards are a little higher. Either you make sure such a bug cannot slip through by testing, or you have to make it up in support by at least reading all the new customer questions. How much effort is it to read the first post of every new thread started there? I bet it can be done by one guy who has basic knowledge of computers, heck just hire a Genius bar guy. :)

hej 14y ago

This comment doesn’t defend Apple. It doesn’t make any value judgments about Apple at all. It merely attacks the article.

quanticle 14y ago
Given that the article is pointing out a security hole in OSX, any attack of the article is an implicit defense of Apple.
- hej 14y ago
  When something is factually wrong it’s factually wrong. That’s it. There is nothing else to it. Nobody said that there is no security hole and no problem.
  - brudgers 14y ago
    The comment did not point out anything factually incorrect in the article. The claim was that the author didn't know anyone who engaged in the practices which would lead to a security breach. That's anecdote, not evidence - even given the poster's experience in security there's reason to suspect that such experience would be primarily with Mac installations which take security more seriously than Apple's marketing department portrays it.
    - hej 14y ago
      Oh come on! Don’t be so dense.

tptacek 14y ago

Every single time the topic of Microsoft's security track record has come up on HN, I've waded in to point out what a great job Microsoft has done. Here's one of my highest rated comments from several years ago: http://news.ycombinator.com/item?id=577684 http://news.ycombinator.com/item?id=577684 Now, I don't disagree with your general point: Microsoft gets more scrutiny than Apple does on HN about security, and Apple enjoys an inflated perception of platform security here --- I attribute that to a general Unix bias, by the way, and not to Apple fandom. But please be careful to note that I'm not a part of that phenomenon. You will, if you dig, find comments of mine that are critical of Apple security; you will probably not find comments critical of Microsoft's security practices. (To be clear: securing a whole platform is an incredibly difficult job, and platform software security talent is some of the hardest to find in the whole industry; both Apple and Microsoft take this stuff seriously and, compared to 2002, both do a fantastic job. Also: the security of the iOS platform is a different story than of the OS X platform.)

zobzu 14y ago
I don't see how comment history makes a separate comment more truthful. If anything, it makes people less likely to have proper critical thinking because they know you. Which is exactly what he points out about your comment, but related to Apple. You know Apple thus you're less likely to criticize them properly. It doesn't mean what you wrote is entirely wrong, but I think he has a point. MS is very harshly criticized for any security issue, no matter how small, and hey, that's probably a good thing. For Apple if there's any possibility we find them.. excuses.. really? (and the "I don't know anyone who used file vault before!" sounds terrible, to be honest)
- gruseom 14y ago
  tptacek has been the most prominent defender of Microsoft's security practices on HN for years. Everything you guys are saying about how Apple get off easy while MS get slammed, he has said repeatedly and more coherently. And out of direct experience to boot. It just didn't happen to be - and still isn't - relevant here.

rickmb 14y ago

"Back in the day", Microsoft didn't make security blunders. It made things fundamentally insecure as a matter of policy, and could get away with it because they had a virtual monopoly. This significant difference informs how people respond, regardless of the nature of the blunder.