6 ms·
It's still inexcusable. The security update should have been immediate and separate.
by lucian1900 13y ago
It's still inexcusable. The security update should have been immediate and separate.
- deleted 13y ago[deleted]
- Jare 13y agoYou still need a minimal amount of testing and release packing. 4 days for an OS update is pretty good response time IMHO, and I thank the Apple engineers that probably worked their asses off to get this mess sorted out. What this doesn't excuse is disclosing the iOS bug before all fixes are ready. THAT was the major scrweup.
- meowface 13y agoNope, I disagree. Microsoft releases emergency hotfixes within about 24 hours usually, if a security vuln is critical enough. And this one is definitely extremely critical.
- dasil003 13y agoLet's be honest, Microsoft is better at security than Apple, mostly as auto-immune response, but regardless of the cause, they've been battle-tested and they know how to handle it.
- ballard 13y agoMicrosoft has had to deal with more security issues for obvious reasons. Apple has not had a serious security protocol on the basis of assuming the platform is flaw free. Even if that were the case, it's how seriously and professionally each is handled is what builds or breaks PR/credibility. IOW, you're only as good as your last performance.
- rdl 13y agoAlso (until very recently) better at developer support, particularly for enterprise developers. MSDN was amazing.
- sneak 13y agoDid you read the release notes? There were several arbitrary code exec overflows and a sandbox bypass that were patched as well. Nobody is freaking out that these took days or weeks to ship...
- rdl 13y agoI don't think a simple 10.9.1.1 (10.9.1 which was already tested, plus JUST the one-line SecureTransport fix) would have required >24h testing. It was their decision to put the fix in 10.9.2 which is the problem. I agree rushing 10.9.2 would have been bad.
- Alphasite_ 13y agoYou don't know that at all. For all you know there are programs which depend on the undefined behaviour (very unlikely, but then what do we know?).
- oneeyedpigeon 13y agoIt wasn't 'undefined' behaviour, it was 'misdefined'. And I'm sure there are/were programs that depended on it; that's the worrying thing ...
- 0x0 13y agoThey could have done the OSX testing at the same time as the iOS and the AppleTV testing. Remember, it's not 4 days response time, it's (4 days + however long the ios response time was). They unleashed a 0day on themselves.
- danieldk 13y ago4 days for an OS update is pretty good response time IMHO For quite a serious vulnerability, which requires removing one goto statement to solve? I am not sure by what standards that is a good response time. There is surely something wrong with Apple's procedures here.
- josephlord 13y agoYes, if you don't test and it stops all the devices with X installed you will have a lot of unhappy customers. And no fix, however simple is risk free.
- lawnchair_larry 13y agoWhy do you think they only knew about this bug for 4 days?
- oneeyedpigeon 13y agoBecause that's all we actually know and anything else would be gross speculation.
- rmc 13y agoApple had more than 4 days. Apple knew about and fixed the iOS bug. We don't know when they became aware of the SSL bug (in iOS & OSX), but it certainly wasn't on the day that Apple released the OSX bug