5 ms·

It still amazes me that Apple responded to a responsible disclosure of an exploit by taking their system down for weeks. Can you imagine someone like Facebook

by smackfu 13y ago

It still amazes me that Apple responded to a responsible disclosure of an exploit by taking their system down for weeks. Can you imagine someone like Facebook or Amazon having to do that?

numbsafari 13y ago
If you become aware that your system is compromised, and you don't yet know the extent of how compromised it is, and that system contains highly sensitive data, why would you do anything other than take it down until you have fully restored your confidence in the system? What difference does it make if the disclosure was responsible or not? If Facebook's billing platform for advertisers was compromised in some fashion, do you think they'd wait even a minute to take it off-line until they situation was under control?
- smackfu 13y ago
  >What difference does it make if the disclosure was responsible or not? If someone gives you reproduce steps for an issue, that's a lot better than just seeing intrusions or weird stuff happening without any idea of the cause.
  - numbsafari 13y ago
    So if someone gives you steps to reproduce you leave the system on-line?
    - smackfu 13y ago
      Sorry if I was unclear. It's not taking the system down that I am surprised at... it's keeping it down for weeks. How many people have software jobs that would accept a sev 1 outage for that long? I know we would get escalated to the CEO. But I guess that's the benefit for Apple... they don't have to care about their developer customers. And steps to reproduce should help you bring the system up faster.
      - interpol_p 13y ago
        > But I guess that's the benefit for Apple... they don't have to care about their developer customers. I'm not sure I understand your argument. You seem to be implying that they kept their dev center down for longer than they could have? I don't think we have any idea how hard they worked to get it back online — maybe they put in as much effort as they could to resolve the issue as quickly as possible, and "as quickly as possible" turned out to be weeks. They did restore the most useful dev tools after one week (adding devices, updating provisioning profiles). So it's not like they kept the entire system down for weeks. And surely rebuilding their system now is better for their developer customers in the long term? If they had simply attempted to patch it up, it may have led to other exploits down the road. Rebuilding it from scratch seemed like a painful but necessary long-term procedure.
melling 13y ago
I'm not exactly sure why you would equate Apple taking down their developer support subsystem with all of Facebook or Amazon coming down. Apple.com didn't go down. 99.99% of their customers never knew the difference.
- sliverstorm 13y ago
  Whereas, on the other side of the coin if Amazon.com goes down, it takes 20% of global ecommerce down with it. The scales of impact aren't even on the same register.
  - epistasis 13y ago
    This outage would be equivalent to an outage of Amazon's merchant APIs for adding new products. Even if that happened, normal Amazon.com commerce would continue.
- unreal37 13y ago
  It didn't cost Apple any revenues though. iPhones were still sold, the Apple Store was unaffected and iTunes was unaffected.
  - tvon 13y ago
    I don't have any numbers, but halting new app submissions surely cost them something with regards to their 30% App Store cut.
    - k-mcgrady 13y ago
      afaik iTunes Connect remained up and provisioning was still possible through Xcode.
      - Spoom 13y ago
        iTunes Connect remained up, but developers couldn't create new App IDs for a while, so if you were uploading new apps (as I was) you had to wait until that particular portion of the developer portal was back.
rsynnott 13y ago
Amazon and Facebook couldn't really afford to. The dev center being down was largely more inconvenience than disaster. Now, if it had been iTunes Connect, that might have been different.

by smackfu 13y ago

It still amazes me that Apple responded to a responsible disclosure of an exploit by taking their system down for weeks. Can you imagine someone like Facebook or Amazon having to do that?

numbsafari 13y ago

If you become aware that your system is compromised, and you don't yet know the extent of how compromised it is, and that system contains highly sensitive data, why would you do anything other than take it down until you have fully restored your confidence in the system? What difference does it make if the disclosure was responsible or not? If Facebook's billing platform for advertisers was compromised in some fashion, do you think they'd wait even a minute to take it off-line until they situation was under control?

smackfu 13y ago
>What difference does it make if the disclosure was responsible or not? If someone gives you reproduce steps for an issue, that's a lot better than just seeing intrusions or weird stuff happening without any idea of the cause.
- numbsafari 13y ago
  So if someone gives you steps to reproduce you leave the system on-line?
  - smackfu 13y ago
    Sorry if I was unclear. It's not taking the system down that I am surprised at... it's keeping it down for weeks. How many people have software jobs that would accept a sev 1 outage for that long? I know we would get escalated to the CEO. But I guess that's the benefit for Apple... they don't have to care about their developer customers. And steps to reproduce should help you bring the system up faster.
    - interpol_p 13y ago
      > But I guess that's the benefit for Apple... they don't have to care about their developer customers. I'm not sure I understand your argument. You seem to be implying that they kept their dev center down for longer than they could have? I don't think we have any idea how hard they worked to get it back online — maybe they put in as much effort as they could to resolve the issue as quickly as possible, and "as quickly as possible" turned out to be weeks. They did restore the most useful dev tools after one week (adding devices, updating provisioning profiles). So it's not like they kept the entire system down for weeks. And surely rebuilding their system now is better for their developer customers in the long term? If they had simply attempted to patch it up, it may have led to other exploits down the road. Rebuilding it from scratch seemed like a painful but necessary long-term procedure.

melling 13y ago

I'm not exactly sure why you would equate Apple taking down their developer support subsystem with all of Facebook or Amazon coming down. Apple.com didn't go down. 99.99% of their customers never knew the difference.

sliverstorm 13y ago
Whereas, on the other side of the coin if Amazon.com goes down, it takes 20% of global ecommerce down with it. The scales of impact aren't even on the same register.
- epistasis 13y ago
  This outage would be equivalent to an outage of Amazon's merchant APIs for adding new products. Even if that happened, normal Amazon.com commerce would continue.
unreal37 13y ago
It didn't cost Apple any revenues though. iPhones were still sold, the Apple Store was unaffected and iTunes was unaffected.
- tvon 13y ago
  I don't have any numbers, but halting new app submissions surely cost them something with regards to their 30% App Store cut.
  - k-mcgrady 13y ago
    afaik iTunes Connect remained up and provisioning was still possible through Xcode.
    - Spoom 13y ago
      iTunes Connect remained up, but developers couldn't create new App IDs for a while, so if you were uploading new apps (as I was) you had to wait until that particular portion of the developer portal was back.

rsynnott 13y ago

Amazon and Facebook couldn't really afford to. The dev center being down was largely more inconvenience than disaster. Now, if it had been iTunes Connect, that might have been different.