I would love to see a detailed postmortem about exactly how this bug happened in the first place and why it's taking so long to fix it on the Mac side. Unfortunately, given how secretive the company is, I'm sure we'll never have more than speculation.
My guess is that they are close to shipping 10.9.2 and decided to hold on for that, not realizing how much attention this bug would get.
Yes, I agree that's a stupid call to make, but most smartphones have far worse unpatched vulnerabilities.
Also, it's worth saying that negative attention probably has little effect on Apple. In this case it's totally justified and well deserved, but the vast majority of it is 'they rejected my flappy bird app', or 'why Apple should fire Tim cook', so this doesn't add much to the pile.
Anyway, I stand by "unconscionable" either way. It implies nothing about the industry standard. If Apple's unconscionable actions here are still better than the industry standard (and I'm skeptical about that, hence the "if", but even given that) then that just means the industry standard is unconscionable.
Why is it worth saying that negative attention probably had little effect on Apple? I really could not possibly care less about this. My statements are based on impact to the users including myself, not the price of AAPL or its balance sheet.
Yes - it's obvious that there are bad practices at work here - in particular no strict static analysis. I agree there's little excuse for not adding machine processes that could have helped.
But adding human processes costs time and agility, and as you point out, money cannot replace these.
MM is used to denote an American million = 10^6
10^9 used to be a milliard in British English but is no longer used. It is now referred to as a billion.
10^12 used to be a billion in British English but is now referred to as a trillion.
Edit: http://www.youtube.com/watch?v=C-52AI_ojyQ explains it all quite nicely.
People that talk about security spending miss the inherent imbalance in security: a defender has to find every bug; an attacker only has to find one.
Nobody is saying that Apple's wealth should mean they have no bugs. However, it does mean that they should have reasonable test coverage of critical security code.
And these android vulnerabilities are essentially unpatchable by design - which I think is something that really does deserve the word unconscionable.
But I accept that the overall behavior in the industry could be described by that term.
My comment about the negative attention is that Apple makes decisions based on the impact to itself. A few days of delay in fixing the bug might result in some small number of compromises, but as long as it doesn't drag on for months, it's unlikely to be a big deal.
On the other hand, negative attention and social media sentiment could have been a big deal for Apple, had it not been for all the wolf-crying. Now it's just a muted signal.
So from Apple's position this is actually a minor affair. We are horrified in principle but they are basing their actions on their practical reality.
I think you're right that this won't be a big deal for Apple. It won't really hurt them much.
However, basing your actions solely on the impact to yourself and ignoring the potentially huge negative impact for your customers is exactly the sort of thing that causes me to call it "unconscionable".
There is definitely a gamble they are taking, and definitely process improvements they should make (e.g. mandatory static analysis of shipping code). I just think think this is more about poor performance than poor morals.
[noting again that if this was discovered because it's in the wild, then it's all about performance]
How many Macs connected to Starbucks WiFi this weekend and had their e-mail and banking credentials lifted? If my hat were darker, I'd have been out there doing it for fun if nothing else.
The fact that it requires a MITM means you're fairly safe on a home connection, but there are lots of people out there on public WiFi who would be pretty vulnerable to this.
I really don't understand what the "gamble" is. What's the upside to waiting?
I doubt that many credentials were stolen this way.
Again, what's the upside to waiting? It looks like zero to me. Minor convenience for Apple at best. Placing their own convenience over the security of their customers is bad.
Search for what you can do for an Android phone that isn't on the very latest version of the OS, and then look up stats of how many Android phones are not, and will never be, on the latest version of the OS. That's unconscionable. To not backport fixes to devices, and to stop shipping updates to them mere months after their release in some cases.
> Yes, I agree that's a stupid call to make, but most smartphones have far worse unpatched vulnerabilities.
That's why Apple's response here is so interesting: it's much more common for smartphones to have serious and known unpatched vulnerabilities than it is for desktop and server operating systems to have them.
It's expected that a smartphone might go unpatched for a while, but the industry standard is that a desktop or server operating system should receive a patch for an extremely severe security vulnerability almost immediately.
Why Apple has chosen to ignore and invert that expectation is unclear. Was there an active, seriously damaging attack against iOS that they thought needed to be stopped right away, despite the cost to OS X users? Did they look at the install base and decide patching iOS first would have a larger impact? Is their development process for OS X not up to the task? Do they just care a lot more about their consumer electronics than their computers?
Then there's the question of why they published the details of the iOS patch before publishing a patch for OS X. Perhaps they rushed to patch iOS when they discovered the vulnerability without realizing that OS X is affected as well? The situation raises a lot of questions--while I'm not sure that what has happened is unconscionable yet (rather than merely extremely incompetent but well-intentioned), it's still an open question, and it's certainly possible.
EDIT: Great points about the checking of the signatures. Let's hope there's not a second bug that can bypass this in some cases.
1. if they can't use the update service, then they can't deploy anything that they're coding up anyways.
2. I assume they sign their updates, so it shouldn't matter that the channel is compromised.
Although we still don't know how this was discovered or if it's in the wild.
But a lot of programmers who have never done anything more difficult than mylamesocialstartup.com in PHP have no idea what it's like to build and test something as complex as an OS. No, recompiling your Linux kernel ain't the same thing.
It's now been 5 days PLUS however long they sat on this for ios.
Again, this isn't some little web site. This is a piece of software that thousands of programmers have worked on for more than a decade, millions of lines of code with a tremendously complex build, testing, release, and approval system.
And finally, Apple's primary concern isn't that a handful of customers might be exposed to risk for a couple of extra days. It's that they botch the rollout of a major security patch and have to re-release, or customers are victimized by new bugs as part of the patch. That sort of thing can cost them billions in market punishment.
You don't spend a week holding the fix hostage so you can fine tune a new os release with "improvements to autofill forms" in safari while script kiddies are running wild with mitmproxy.
Also I would think that a full ios+appletv OS release is much more complicated than an OSX release due to the way the mobile OSes are packaged (probably 10+ unique/model restore images plus delta downloads)
If their build process is so broken that it takes days to take the 10.9.1 tag, apply a one-line patch, and release it, then they're doing it severely wrong. Security problems happen, and you need to be ready to move fast.
Personally, if I was on that team and it came down to taking days to recompile and retest everything, I'd be seriously considering a binary patch as an interim fix. Take the actual built binaries, apply this one patch, and you know nothing else got somehow miscompiled or mislinked in the process.
You're right. It's not at all like Red Hat compiling and releasing a new RPM which they would push out in hours, max. It's actually much easier. Apple retains absolute control over their source code.
The manager who is holding the SSL fix hostage to 10.9.2's shitty feature-adds should be terminated out of a cannon. It's hilarious that we don't know who that person is -- who is the head of software security at Apple? From what I've heard there are at least two separate teams, and the relevant team is closely tied to Federighi, but no one outside Apple (generally) knows sub-SVP people at Apple.
There should be 10.9.1.1 with just the SSL fix. If that means delaying 10.9.2 another month, so be it.
So, it turns out that they had a point release very far down the release engineering pipeline that included several new features (FaceTime Audio, FT call waiting, Mail bugfixes, et c).
A few days ago when the TLS bug became widely known they had two options: push a point release for _just that_ near-immediately, followed by the existing planned release (after redoing QA because the TLS changes would require the feature-add release be rechecked), or just integrate the TLS fix and restart QA on the planned release. They opted for making everyone wait a few days and just doing one release.
It was a trade-off, and both would have been okay decisions IMHO. There is a non-zero downside to releasing OS updates too frequently with an installed base as large as OSX.
"Unconscionable" it would have been if it had dragged on for a week or more. This was probably a heroic effort by the release engineering team(s) to get it out in in the timeframe that they did (after opting for just one release).
Good thing they made sure all our AppleTVs are safe from MITMs, though.
Or are you saying that this doesn't impact the underlying SSL library for all of OSX?
Or are you saying that no one (should) use Mac for actual work, so it doesn't matter?
Obviously, you're not saying these things, but what if you did. :)