3 ms·
I'm under the impression that Apple prides itself on having a smaller number of very dedicated employees that are perfectionists. I can totally see this being
by cbhl 13y ago
I'm under the impression that Apple prides itself on having a smaller number of very dedicated employees that are perfectionists.
I can totally see this being "innocent 2AM mis-judgement call by a single employee", judging from what my peers tell me of Apple's corporate culture. I do think that Adam Langley's suggestion that code review would help is plausible, but it merely just means that more than one person has to make the same mistake in a judgement call. (It reduces the probability of such an error happening; it doesn't theoretically eliminate it.)
- Create 13y agoI can totally see this being "innocent 2AM mis-judgement call by a single employee", judging from what my peers tell me of Apple's corporate culture. https://support.apple.com/library/APPLE/APPLECARE_ALLGEOS/HT5780/Crypto_Officer_Role_Guide_for_FIPS%20140-2_Compliance_iOS_6.pdf https://support.apple.com/library/APPLE/APPLECARE_ALLGEOS/HT... We begin therefore where they are determined not to end, with the question whether any form of democratic self-government, anywhere, is consistent with the kind of massive, pervasive, surveillance into which the Unites Sta tes government has led not only us but the world. This should not actually be a complicated inquiry. http://snowdenandthefuture.info/events.html http://snowdenandthefuture.info/events.html
- cbhl 13y agoFIPS 140-2 certification isn't remotely an indication of correctness of code, for better or worse. Take, for example, the implementation Dual EC DRBG in the FIPS 140-2 certified OpenSSL module -- it was fatally flawed, and has never worked in practice. (It will be removed from the next version of the module in light of developments in the past year.) https://lwn.net/Articles/578375/ https://lwn.net/Articles/578375/