4 ms·

Consider that this fix doesn't just remove the goto, it enables code that previously wasn't being run or tested. They need to verify that it works and doesn't

Consider that this fix doesn't just remove the goto, it enables code that previously wasn't being run or tested. They need to verify that it works and doesn't segfault, otherwise important services (like the update system itself) could end up being broken. This includes testing on all Macs that can run Mavericks, which is a larger and more complex set of hardware then iOS.

typicalbender 13y ago
This. Apple caters to millions and millions of people, acting rash and pushing out a fix that's not thoroughly tested could cause a lot of damage to their brand. The sad fact is the majority of people wont/don't care about this issue so it's not in apple's best interest to push out a fix that isn't thoroughly tested.
revelation 13y ago
Please, stop it with the strawmans. Microsoft can push an update like this in a day, and Windows runs on .. well every hardware ever made to run anything.
- metric10 13y ago
  Umm...they can? Do you have any examples of this? All this time, has it just been that Windows security vulnerabilities have been found on the second Monday of every month?
  - yaeger 13y ago
    He can't. There were more than one "How to" on MS homepage as to how to work around an issue until a fix was ready. Even for trivial stuff. Why? Cause in a a giant corporation, even a hotfix takes ages to get through all QA.
lucian1900 13y ago
I still don't see how that's an excuse. Better to break everyone's TLS connections than leave them vulnerable. The risk isn't that high either, anyway.
- kevinavery 13y ago
  Better to break everyone's TLS connections than leave them vulnerable. wat
- demallien 13y ago
  I'm not 100% sure, but I think that the Mac update system actually uses this code - if it starts failing they can't send out any more signed updates to people. Far better to wait one or two days more to make sure that you're not about to break some of the more important functionality in the OS, I would think.
- pavel_lishin 13y ago
  > Better to break everyone's TLS connections than leave them vulnerable. It's better to leave them vulnerable than to leave them vulnerable?
cies 13y ago
> Consider that this fix doesn't just remove the goto, it enables code that previously wasn't being run or tested. Good point. Still the update will likely come as part of a large blob. Finally, I'm just disagreeing with the "tech savvy" crowd going en-masse for Apple products. OSX is a huge step fwd to Windoze in terms of internal software architecture -- yet it carries the same risk as it is proprietary and closed in parts that are critical to its security. Yes Mr IT-geek; your MBP is probably rooted from the moment you opened the box. Again: call me paranoid :)
- mdavidn 13y ago
  Macs are certainly full of proprietary and closed-source software, but not in this specific case. [1] [1]: http://opensource.apple.com/source/Security/Security-55471/libsecurity_ssl/lib/sslKeyExchange.c http://opensource.apple.com/source/Security/Security-55471/l...

typicalbender 13y ago

This. Apple caters to millions and millions of people, acting rash and pushing out a fix that's not thoroughly tested could cause a lot of damage to their brand. The sad fact is the majority of people wont/don't care about this issue so it's not in apple's best interest to push out a fix that isn't thoroughly tested.

revelation 13y ago

Please, stop it with the strawmans. Microsoft can push an update like this in a day, and Windows runs on .. well every hardware ever made to run anything.

metric10 13y ago
Umm...they can? Do you have any examples of this? All this time, has it just been that Windows security vulnerabilities have been found on the second Monday of every month?
- yaeger 13y ago
  He can't. There were more than one "How to" on MS homepage as to how to work around an issue until a fix was ready. Even for trivial stuff. Why? Cause in a a giant corporation, even a hotfix takes ages to get through all QA.

lucian1900 13y ago

I still don't see how that's an excuse. Better to break everyone's TLS connections than leave them vulnerable. The risk isn't that high either, anyway.

kevinavery 13y ago
Better to break everyone's TLS connections than leave them vulnerable. wat
demallien 13y ago
I'm not 100% sure, but I think that the Mac update system actually uses this code - if it starts failing they can't send out any more signed updates to people. Far better to wait one or two days more to make sure that you're not about to break some of the more important functionality in the OS, I would think.
pavel_lishin 13y ago
> Better to break everyone's TLS connections than leave them vulnerable. It's better to leave them vulnerable than to leave them vulnerable?

cies 13y ago

> Consider that this fix doesn't just remove the goto, it enables code that previously wasn't being run or tested. Good point. Still the update will likely come as part of a large blob. Finally, I'm just disagreeing with the "tech savvy" crowd going en-masse for Apple products. OSX is a huge step fwd to Windoze in terms of internal software architecture -- yet it carries the same risk as it is proprietary and closed in parts that are critical to its security. Yes Mr IT-geek; your MBP is probably rooted from the moment you opened the box. Again: call me paranoid :)

mdavidn 13y ago
Macs are certainly full of proprietary and closed-source software, but not in this specific case. [1] [1]: http://opensource.apple.com/source/Security/Security-55471/libsecurity_ssl/lib/sslKeyExchange.c http://opensource.apple.com/source/Security/Security-55471/l...