3 ms·

Unless your box has already been pwnd and the update installer has been modified to not install that update in the way it was meant to be.

• msbarnett 13y ago
  Yes, if we assume you're already fucked, then we can conclude that there is nothing you can do to verify anything and that you are fucked, because we have assumed our conclusion. SHA1s and MD5s are equally pointless in this case because you've already assumed you're fucked, so it should all be assumed to be lying to you. If, however, we don't engage in circular reasoning and we assume your box isn't currently in the possession of the Russian mafia or (insert preferred APT here), then how can one be reasonably confident that the update one receives through the updater is legitimately the one Apple is distributing? Because it is signed and the code-signing verification was not broken by this bug.
  • pikachu_is_cool 13y ago
    That gave me a good chuckle. Thanks for that.
  • stcredzero 13y ago
    If, however, we don't engage in circular reasoning I agree with the point you're making, but you can also turn this idea around, after which it serves to highlight how insanely inadequate our current tools and infrastructure are from a security standpoint. Basically, you can only reasonably hope to verify a patch if you're not already owned, so you also have to assume you're not in order to verify. It's as if there was a contagious disease that has a good chance of killing you after a number of years, but the diagnostic tests can only be counted on to work if you don't have the disease in the first place. So then why would anyone ever bother getting tested? Our current situation is that uncomfortable.
    • msbarnett 13y ago
      > Basically, you can only reasonably hope to verify a patch if you're not already owned, so you also have to assume you're not in order to verify. It's as if there was a contagious disease that has a good chance of killing you after a number of years, but the diagnostic tests can only be counted on to work if you don't have the disease in the first place. So then why would anyone ever bother getting tested? Our current situation is that uncomfortable. Being owned is less like having a virus and more like having schizophrenia. You can't ever expect to self-verify yourself, because if you're suffering from it, everything you're perceiving is being filtered through a compromised and untrustworthy system. You have to trust some third-party that you believe to not be similarly compromised to do the verification for you.
      • stcredzero 13y ago
        You have to trust some third-party that you believe to not be similarly compromised to do the verification for you. Which effectively means that most people won't bother, unless a "trusted third party" is built into their machine. But that has huge potential problems of its own.
• hughw 13y ago
  You make a valid, and well understood point. Ken Thompson's classic paper: http://cm.bell-labs.com/who/ken/trust.html http://cm.bell-labs.com/who/ken/trust.html