SSL vulnerability ios and Macos X.

Planky said:
Perhaps you should change your Avatar to a troll?
Click to expand...
TBH, something like this is ripe for a comment like that - sooo many times a single one liner comes back that Macs are totally immune without a full understanding of what's going on. Having said that, no virus protection would guard against this - it's a real bug in the SSL code which would be exploited as your data is carried, not a hack on a Mac/iOS device.
 
inkiboo said:
Sorry, this can't be the case because I've read so many posts on here about Apple having no security issues.
Click to expand...

Maybe the apple fans will have to slightly ajust to "Apple it just doesn't work" ;) of course sent from my iPad :lol:
 
srichards said:
It doesn't say whether it is only the mac mail that is vulnerable or whether any other mail app eg Thunderbird is also vulnerable.
Click to expand...

It's not just email. If anything it's web browsing where you're most likely to be vulnerable. Anything using Secure Sockets Layer is vulnerable. However, it's unlikely to be a problem for home users (unless they're stupid enough to not use any security on the wireless connection) but it could be a problem if you use public WiFi.
 
I expect better from Apple really. If the vulnerability is a known classic attack that has been a hole before in other implementations then it is a particularly stupid mistake.

I certainly wouldn't use a phone to access banking data.

This is the mistake: https://www.imperialviolet.org/2014/02/22/applebug.html

Basic programming mistake. I never even knew apple source code used gotos. I thought they went out with bbc basic and were removed from all proper programming languages!

Pleasingly it doesn't affect chrome nor FF for browsing so it's only the secure ipad stuff that isn't really secure.
 
Last edited:
srichards said:
I never even knew apple source code used gotos.
Click to expand...
GOTOs per se are not bad. It's the programmers use of them that is potentially bad (see Apple and SSL ;)). That could quite easily be as bad not using {}'s without the goto...
 
Even better macosx 10.8.5 doesn't seem to be vulnerable anyway as I tried the same test site in safari and that 'couldn't establish a connection'.

I knew not updating to mavericks was a sensible choice :D
 
Also just noticed that Siri starts up from the lock screen even if it is set to be inaccessible. Not noticed that for a while. Not checked whether it bypasses the passcode system again.

I keep it off otherwise the daft git gets started just about every time I try and fish my phone out of an awkward pocket :-/
 
srichards said:
Basic programming mistake. I never even knew apple source code used gotos. I thought they went out with bbc basic and were removed from all proper programming languages!
Click to expand...
They persist, and the use in the page linked is the most common one, to have a common "clean up and exit" section of code so you don't have to modify lots of failure conditions if you add another memory allocation at the start of a function (for example).
 
The problem doesn't seem to affect Firefox so it looks like Apple apps only, Safari, Mail iMessage . Not sure if it affects iCloud.
 
arad85 said:
GOTOs per se are not bad. It's the programmers use of them that is potentially bad (see Apple and SSL ;)). That could quite easily be as bad not using {}'s without the goto...
Click to expand...

I thought the reason for them being deprecated is that with a GOTO a program can't be mathematically proved. Basically because you can't work out what the previous line of code was if you allow GOTOs (with most other jumps there's a register somewhere that will tell you the return address). That's from a half remembered lecture in the 90s though so it may not be right.

The real error with that code is the duplicated command so the second one is outside the conditional. Like putting a random full stop in a COBOL conditional. Like most if not all errors of this kind it would have been caught by adequate testing but pretty much nobody tests stuff any more....... :)

TBH I wouldn't do anything on a public data signal that I didn't expect to be intercepted.
 
JonathanRyan said:
I thought the reason for them being deprecated is that with a GOTO a program can't be mathematically proved.
Click to expand...
Do people still use ADA? You can write really, really poor code without the use of gotos....

The main reason for using them is as Mark said - for cleaning up allocations etc.. when something goes wrong.
 
OS 10.9.2 is now available. Apple users can update, fix the bug and continue to be smug/condescending.
 
  • Like
Reactions: Nod
I used to work on the periphery of the defence/space industry in the 80's and 90's. I once saw a list of 10 or so coding rules which were (as far as I know) adhered to when coding for mission critical space systems. In the first two or three of those rules was: you shall not use floating point calculations - presumably due to the dropoff of accuracy when you need more and more precision.

Talk about making life hard for yourself....
 
inkiboo said:
OS 10.9.2 is now available. Apple users can update, fix the bug and continue to be smug/condescending.
Click to expand...

Ipad one came out yesterday and took ages to install.
 
I've still not updated my stuff, I suppose I'd better. I was kind of enjoying the fact that my iPad was still on 7.0.0.
 
I don't need extra smugness as mountain lion doesn't have that issue anyway :)
 
arad85 said:
Are you sure? It could be someone impersonating Apple and downloading Megabytes of virii... ;)
Click to expand...

Yes I'm sure. They asked for my credit card to make sure it was actually me. That's normal, right?
 
neil_g said:
Interesting, my iPhone updated last week for an ssl issue.

Haven't checked the iPad for a while though.
Click to expand...

Same here, I got an auto update notice on my phone at the weekend and manually updated my iPad the next day.

I think Apple phase in the automatic updates for iOS to different devices over a few days to spread the server load at their end.
 
JonathanRyan said:
Yes I'm sure. They asked for my credit card to make sure it was actually me. That's normal, right?
Click to expand...
I don't know. I've never had to download smugness as it comes pre-installed over here, so I'm not sure whether CC details are needed or not....
 
You must log in or register to reply here.
Back
Top