3 ms·
I did read your whole comment, and I didn't really take it as 'defending Apple', at least not in the sort of blind fanboyism way that implies. If I understand
by OJFord 3y ago
I did read your whole comment, and I didn't really take it as 'defending Apple', at least not in the sort of blind fanboyism way that implies.
If I understand correctly, you're assuming that the user is in control of both running the curl command, and the host it's pointed at? And thus the behaviour in this case is, you argue, arbitrary because you shouldn't let it get there anyway?
I was just thinking of it as the former, say I want to curl -X POST a comment to secretnews.ycombinator.com (not real, as far as I know!) and verify that someone hasn't MITM'd it so that I accidentally disclose my comment on news.ycombinator.com. I don't control either domain, I'm just running a curl command.
- hnlmorg 3y agoI’m saying calling this a problem because it might add a computational overhead is missing the severity of the problem. This is a problem because it creates a backdoor. I also disagree it creates a computation overhead because it’s only engaged outside of normal operation (ie when your application is already broken or if someone is intentionally exploiting that backdoor). but the computation argument is more of a distraction from the real problem. So definitely not defending Apple. I’m saying it’s more serious than just a computation problem.
- OJFord 3y agoHm, ok. I don't think they did miss the severity though, at least by my reading of: > That means that this "feature" by Apple either adds more computation for nothing, or breaks the verification model that is expected. they're saying one of two things happens: you get the wrong result (more severe than amount of computation) or you (because the cert it does have is not in Apple's store either) get the correct result, but wasted cycles doing something that you didn't want it to do and risked getting the wrong result.
- hnlmorg 3y agoYou, not they. The “they” in this context is the author of curl. And Daniel is fully aware of the problems this change makes. Whereas you’re the one barking on about computational overhead.
- OJFord 3y agoNo, that's a quote from the top-level commenter (who wasn't me, as I said when I first commented), hence 'they', because they said that, not me.