8 ms·

Apple promises fix 'very soon' for Macs with failed encryption

73 points by Varcht 13y ago

mistercow 13y ago
Wasn't the fix for this to delete a duplicated line of code? How is that a "very soon" fix and not a "yesterday" fix?
- typicalbender 13y ago
  As metric10 mentioned, that even a one line change can cause failure somewhere else in the system and they have to be confident that the new code that is being executed that wasn't before actually works before release it out to the general public where it could cause more harm. The fix may be simple but the cascading effects from the fix need to be well understood before releasing.
lotsofmangos 13y ago
So, how do we trust this update given a) we don't know for sure that the original bug was an honest mistake, and b) the encryption checking mechanism is blown so the update to fix the bug can be hijacked.
wreegab 13y ago
> "I believe that it's just a mistake and I feel very bad for whomever might have slipped" There has been such a rush from many places to cast this as a "mistake". We just don't know whether this was deliberate or a mistake, anything else is just an opinion. I don't see one explanation being less likely than the other, it's annoying to see one explanation being pushed more than the other.
- dmur 13y ago
  Is it possible that this bug was deliberately planted? Sure. Is it equally likely that this bug was deliberately planted as it is that the bug was a mistake? I say no, Occam's razor being the main reason for making that distinction.
  - sitkack 13y ago
    Occams's razor is a pithy statement, not a fact, not proven theory. Pithy statements don't make things more true than non-pithy statements.
    - vinceguidry 13y ago
      http://en.wikipedia.org/wiki/Solomonoff%27s_theory_of_inductive_inference http://en.wikipedia.org/wiki/Solomonoff%27s_theory_of_induct...
      - sitkack 13y ago
        Not that a link to wikipedia is even a complete sentence but having the most huffman compressible answer doesn't make it the correct one. From the wikipedia entry on Occam's Razor. > In the scientific method, Occam's Razor is not considered an irrefutable principle of logic or a scientific result.
- LnxPrgr3 13y ago
  If anything, I'd assume both Apple and the NSA can find people who can sneak an intentional bug in that's a lot harder to spot than an extra "goto fail;". I've also seen enough silly bugs (1) result from merges or other tedious mechanical changes, and (2) escape detection in code review that I don't find it that hard to believe this was unintentional. It's amazing how elusive the obvious can be when your mind's on something else. Given that, I personally assume good faith until there's significant reason to doubt that assumption. Here's an embarrassingly stupid bug I created (or rather, the one-line patch that fixes it): https://github.com/LnxPrgr3/message_queue/commit/b21944ab63ff987cab6c12947f6383cf83c3ef36 https://github.com/LnxPrgr3/message_queue/commit/b21944ab63f...
cies 13y ago
C'mon Apple.. This is (as far as i understand) a one-liner fix! In opensource land this would be fixed and packag-manager-updatable in less then 24hrs. Probably less then 6. The fact that it takes sooo long, and that the fix will be bundled in a blob with all sorts of other "fixes" gives me the feeling that one attack-vector cannot be closed until another is available. I got this feeling years back when a huge back-door-enabling was not closed for months until big fat service pack was issued that "fixed" it (amongst fixing a million+1 other things; probably opening the next attack-vector). Call me paranoid.
- metric10 13y ago
  Consider that this fix doesn't just remove the goto, it enables code that previously wasn't being run or tested. They need to verify that it works and doesn't segfault, otherwise important services (like the update system itself) could end up being broken. This includes testing on all Macs that can run Mavericks, which is a larger and more complex set of hardware then iOS.
  - typicalbender 13y ago
    This. Apple caters to millions and millions of people, acting rash and pushing out a fix that's not thoroughly tested could cause a lot of damage to their brand. The sad fact is the majority of people wont/don't care about this issue so it's not in apple's best interest to push out a fix that isn't thoroughly tested.
  - revelation 13y ago
    Please, stop it with the strawmans. Microsoft can push an update like this in a day, and Windows runs on .. well every hardware ever made to run anything.
    - metric10 13y ago
      Umm...they can? Do you have any examples of this? All this time, has it just been that Windows security vulnerabilities have been found on the second Monday of every month?
chmars 13y ago
It should be a given that Apple provides a fix for OS X as soon as possible. On the other hand, it is telling that Apple gave priority to iOS. (Although priority is relative even for iOS. We have many iOS devices in the family and not a single one had asked to install the fix until yesterday evening. The fix, however, was available after a manually initiated update check.)
- achamayou 13y ago
  In their defense, there are far more iOS devices out there than Macs.
  - pjmlp 13y ago
    So Oracle, Google and Microsoft get burned when something like this happens, but Apple gets excused?! Typical.
    - rimantas 13y ago
      So Oracle, Google and Microsoft have a larger install base of their mobile OSes compared to their desktop OSes?
    - achamayou 13y ago
      A comparable situation would be Microsoft patching 7 & 8 desktops before patching Surface because there's many more PCs than Surfaces out there. I'm not saying it's a great move, but if you're going to prioritize, doesn't it make sense to start with what you know will protect the most users ?
      - rdl 13y ago
        I don't think there are many shared resources at Apple between the iOS and OSX teams, at least as would be doing OS updates to fix this.
- threeseed 13y ago
  > On the other hand, it is telling that Apple gave priority to iOS. Maybe not. It could just be that OSX has a higher testing effort. There is a bigger spread of versions across the OSX platform than iOS. And also Apple does have quite a few hardware specific builds of OSX they need to test. Still completely unacceptable though.
gommm 13y ago
It was completely irresponsible not to release the OS X fix at the same time as the ios fix. Apple also needs to setup a way to alert users when an update fixes an important security fix. None of my ios devices asked to install the fix and I had to do a manual update check. This should not happen for major security issues.
- 0x0 13y ago
  Also, the ios over-the-air update refused to download over 3g even though it was only 10mb. I couldn't even manually update until I got back home much later :-/ (Last time I tethered to a friend's android phone!)
  - Geee 13y ago
    This is the stupidest limitation of iOS. Why I can't update or download big apps on 3G? I just don't get it.
    - drawkbox 13y ago
      Blame limitations to wireless air delivery on telcos. They have it at 100MB now limit but before it was 50MB and before that it was 20MB. They telcos prevented files/apps over that size from being transmitted over their wireless networks.
      - 0x0 13y ago
        Yep, but Apple really should have increased the limit for updates to match the limit for app sizes. It's pretty ridiculous that you can download as many 99mb app installs and updates as you want, but be denied a 10mb critical security patch over 3g.
    - Varcht 13y ago
      Walled gardens are great... until you run into the wall.
    - gorm 13y ago
thelogos 13y ago
The fallout from this will last for a while. Most normal people are not aware of these security issues and many of them rarely install updates.
- k-mcgrady 13y ago
  >> "many of them rarely install updates." Not true, at least on iOS. iOS 7 is on over 80% of devices less than 6 months after launch.
  - Pacabel 13y ago
    But that remaining 20% or so still includes millions of devices and people who are affected.
    - joev_ 13y ago
      Absolutely true, but compared to android this is a rather good percentage.
- threeseed 13y ago
  Not true at all. Apple has quite a high percentage of users on both iOS and OSX with the latest versions.
deleted 13y ago
[deleted]
- sjfkfjksldkamfj 13y ago
  yes, it turns out we laugh at the mactards not just because they bought an overpriced intel laptop, but also because it is full of now publically known security holes. Shiny but insecure - the agony of choice!
higherpurpose 13y ago
I was just reading through Adam Langley's description of the bug and this jumped out at me: > The code will always jump to the end from that second goto, err will contain a successful value because the SHA1 update operation was successful and so the signature verification will never fail. Wait, Apple still uses SHA1? Are they aware it's banned from use (by NIST, no less) starting with this year? http://www.zdnet.com/nist-makes-a-hash-of-sha-1-ban-7000025980/ http://www.zdnet.com/nist-makes-a-hash-of-sha-1-ban-70000259... Maybe they'd want to take this opportunity to fix that, too...
- praseodym 13y ago
  If a certificate uses SHA1, Apple (or any other vendor) can't help but use that for verification…
  - RexRollman 13y ago
    They can't refuse to use it? It seems to me that SHA1 should be depracated.
    - tptacek 13y ago
      As in, refuse to allow their browser to talk to sites on the Internet?
    - stephen_g 13y ago
      I don't think you understand what the code is doing. This is verifying certificates for HTTPS connections - not creating them. If they removed the SHA1 verification, you can no longer visit hundreds of millions of sites that haven't updated their certificates yet. It's the people still using certificates with SHA1 hashes that need to upgrade.
      - RexRollman 13y ago
        But if browser makers decided not to support the hashes, the website owners would have to upgrade. Why allow them to continue to use weak hashes?
afhsfsfdsss88 13y ago
Apple: We really are holier than thou.
fidotron 13y ago
This one is going to cause serious damage to the credibility Apple have long been holding with many software developers. Most people seem to have tolerated the massive quality drop in OSX since Tiger (easily their peak version) but a bug as egregious as this which would easily have not happened with the slightest bit of preventative quality control? Absolutely disgraceful. Until someone else makes a laptop OS that's even half as good as OSX we're all stuck with it.
- stcredzero 13y ago
  Most people seem to have tolerated the massive quality drop in OSX since Tiger (easily their peak version) I would say that Snow Leopard was their peak, even though it did follow Leopard.

73 points by Varcht 13y ago

mistercow 13y ago

Wasn't the fix for this to delete a duplicated line of code? How is that a "very soon" fix and not a "yesterday" fix?

typicalbender 13y ago
As metric10 mentioned, that even a one line change can cause failure somewhere else in the system and they have to be confident that the new code that is being executed that wasn't before actually works before release it out to the general public where it could cause more harm. The fix may be simple but the cascading effects from the fix need to be well understood before releasing.

lotsofmangos 13y ago

So, how do we trust this update given a) we don't know for sure that the original bug was an honest mistake, and b) the encryption checking mechanism is blown so the update to fix the bug can be hijacked.

wreegab 13y ago

> "I believe that it's just a mistake and I feel very bad for whomever might have slipped" There has been such a rush from many places to cast this as a "mistake". We just don't know whether this was deliberate or a mistake, anything else is just an opinion. I don't see one explanation being less likely than the other, it's annoying to see one explanation being pushed more than the other.

dmur 13y ago
Is it possible that this bug was deliberately planted? Sure. Is it equally likely that this bug was deliberately planted as it is that the bug was a mistake? I say no, Occam's razor being the main reason for making that distinction.
- sitkack 13y ago
  Occams's razor is a pithy statement, not a fact, not proven theory. Pithy statements don't make things more true than non-pithy statements.
  - vinceguidry 13y ago
    http://en.wikipedia.org/wiki/Solomonoff%27s_theory_of_inductive_inference http://en.wikipedia.org/wiki/Solomonoff%27s_theory_of_induct...
    - sitkack 13y ago
      Not that a link to wikipedia is even a complete sentence but having the most huffman compressible answer doesn't make it the correct one. From the wikipedia entry on Occam's Razor. > In the scientific method, Occam's Razor is not considered an irrefutable principle of logic or a scientific result.
LnxPrgr3 13y ago
If anything, I'd assume both Apple and the NSA can find people who can sneak an intentional bug in that's a lot harder to spot than an extra "goto fail;". I've also seen enough silly bugs (1) result from merges or other tedious mechanical changes, and (2) escape detection in code review that I don't find it that hard to believe this was unintentional. It's amazing how elusive the obvious can be when your mind's on something else. Given that, I personally assume good faith until there's significant reason to doubt that assumption. Here's an embarrassingly stupid bug I created (or rather, the one-line patch that fixes it): https://github.com/LnxPrgr3/message_queue/commit/b21944ab63ff987cab6c12947f6383cf83c3ef36 https://github.com/LnxPrgr3/message_queue/commit/b21944ab63f...

cies 13y ago

C'mon Apple.. This is (as far as i understand) a one-liner fix! In opensource land this would be fixed and packag-manager-updatable in less then 24hrs. Probably less then 6. The fact that it takes sooo long, and that the fix will be bundled in a blob with all sorts of other "fixes" gives me the feeling that one attack-vector cannot be closed until another is available. I got this feeling years back when a huge back-door-enabling was not closed for months until big fat service pack was issued that "fixed" it (amongst fixing a million+1 other things; probably opening the next attack-vector). Call me paranoid.

metric10 13y ago
Consider that this fix doesn't just remove the goto, it enables code that previously wasn't being run or tested. They need to verify that it works and doesn't segfault, otherwise important services (like the update system itself) could end up being broken. This includes testing on all Macs that can run Mavericks, which is a larger and more complex set of hardware then iOS.
- typicalbender 13y ago
  This. Apple caters to millions and millions of people, acting rash and pushing out a fix that's not thoroughly tested could cause a lot of damage to their brand. The sad fact is the majority of people wont/don't care about this issue so it's not in apple's best interest to push out a fix that isn't thoroughly tested.
- revelation 13y ago
  Please, stop it with the strawmans. Microsoft can push an update like this in a day, and Windows runs on .. well every hardware ever made to run anything.
  - metric10 13y ago
    Umm...they can? Do you have any examples of this? All this time, has it just been that Windows security vulnerabilities have been found on the second Monday of every month?

chmars 13y ago

It should be a given that Apple provides a fix for OS X as soon as possible. On the other hand, it is telling that Apple gave priority to iOS. (Although priority is relative even for iOS. We have many iOS devices in the family and not a single one had asked to install the fix until yesterday evening. The fix, however, was available after a manually initiated update check.)

achamayou 13y ago
In their defense, there are far more iOS devices out there than Macs.
- pjmlp 13y ago
  So Oracle, Google and Microsoft get burned when something like this happens, but Apple gets excused?! Typical.
  - rimantas 13y ago
    So Oracle, Google and Microsoft have a larger install base of their mobile OSes compared to their desktop OSes?
  - achamayou 13y ago
    A comparable situation would be Microsoft patching 7 & 8 desktops before patching Surface because there's many more PCs than Surfaces out there. I'm not saying it's a great move, but if you're going to prioritize, doesn't it make sense to start with what you know will protect the most users ?
    - rdl 13y ago
      I don't think there are many shared resources at Apple between the iOS and OSX teams, at least as would be doing OS updates to fix this.
threeseed 13y ago
> On the other hand, it is telling that Apple gave priority to iOS. Maybe not. It could just be that OSX has a higher testing effort. There is a bigger spread of versions across the OSX platform than iOS. And also Apple does have quite a few hardware specific builds of OSX they need to test. Still completely unacceptable though.

gommm 13y ago

It was completely irresponsible not to release the OS X fix at the same time as the ios fix. Apple also needs to setup a way to alert users when an update fixes an important security fix. None of my ios devices asked to install the fix and I had to do a manual update check. This should not happen for major security issues.

0x0 13y ago
Also, the ios over-the-air update refused to download over 3g even though it was only 10mb. I couldn't even manually update until I got back home much later :-/ (Last time I tethered to a friend's android phone!)
- Geee 13y ago
  This is the stupidest limitation of iOS. Why I can't update or download big apps on 3G? I just don't get it.
  - drawkbox 13y ago
    Blame limitations to wireless air delivery on telcos. They have it at 100MB now limit but before it was 50MB and before that it was 20MB. They telcos prevented files/apps over that size from being transmitted over their wireless networks.
    - 0x0 13y ago
      Yep, but Apple really should have increased the limit for updates to match the limit for app sizes. It's pretty ridiculous that you can download as many 99mb app installs and updates as you want, but be denied a 10mb critical security patch over 3g.
  - Varcht 13y ago
    Walled gardens are great... until you run into the wall.
  - gorm 13y ago

thelogos 13y ago

The fallout from this will last for a while. Most normal people are not aware of these security issues and many of them rarely install updates.

k-mcgrady 13y ago
>> "many of them rarely install updates." Not true, at least on iOS. iOS 7 is on over 80% of devices less than 6 months after launch.
- Pacabel 13y ago
  But that remaining 20% or so still includes millions of devices and people who are affected.
  - joev_ 13y ago
    Absolutely true, but compared to android this is a rather good percentage.
threeseed 13y ago
Not true at all. Apple has quite a high percentage of users on both iOS and OSX with the latest versions.

deleted 13y ago

[deleted]

sjfkfjksldkamfj 13y ago
yes, it turns out we laugh at the mactards not just because they bought an overpriced intel laptop, but also because it is full of now publically known security holes. Shiny but insecure - the agony of choice!

higherpurpose 13y ago

I was just reading through Adam Langley's description of the bug and this jumped out at me: > The code will always jump to the end from that second goto, err will contain a successful value because the SHA1 update operation was successful and so the signature verification will never fail. Wait, Apple still uses SHA1? Are they aware it's banned from use (by NIST, no less) starting with this year? http://www.zdnet.com/nist-makes-a-hash-of-sha-1-ban-7000025980/ http://www.zdnet.com/nist-makes-a-hash-of-sha-1-ban-70000259... Maybe they'd want to take this opportunity to fix that, too...

praseodym 13y ago
If a certificate uses SHA1, Apple (or any other vendor) can't help but use that for verification…
- RexRollman 13y ago
  They can't refuse to use it? It seems to me that SHA1 should be depracated.
  - tptacek 13y ago
    As in, refuse to allow their browser to talk to sites on the Internet?
  - stephen_g 13y ago
    I don't think you understand what the code is doing. This is verifying certificates for HTTPS connections - not creating them. If they removed the SHA1 verification, you can no longer visit hundreds of millions of sites that haven't updated their certificates yet. It's the people still using certificates with SHA1 hashes that need to upgrade.
    - RexRollman 13y ago
      But if browser makers decided not to support the hashes, the website owners would have to upgrade. Why allow them to continue to use weak hashes?

afhsfsfdsss88 13y ago

Apple: We really are holier than thou.

fidotron 13y ago

This one is going to cause serious damage to the credibility Apple have long been holding with many software developers. Most people seem to have tolerated the massive quality drop in OSX since Tiger (easily their peak version) but a bug as egregious as this which would easily have not happened with the slightest bit of preventative quality control? Absolutely disgraceful. Until someone else makes a laptop OS that's even half as good as OSX we're all stuck with it.

stcredzero 13y ago
Most people seem to have tolerated the massive quality drop in OSX since Tiger (easily their peak version) I would say that Snow Leopard was their peak, even though it did follow Leopard.