Hacker News Reader

Hacker News

Comment by pje | Hacker News Reader

Full thread

pje

> The release notes, however, do not make mention of the SSL security bug that was squashed on iOS late last week.

View on HN

http://support.apple.com/kb/HT6114

says at the bottom "For detailed information about the security content of this update, see Apple security updates.[1]"

[1] http://support.apple.com/kb/HT1222

It's not there yet: Apple usually posts that information a few hours _after_ the update has been released.

Looks like it's at http://support.apple.com/kb/HT6150

If anyone from Apple is reading and can influence this - could you convince whomever needs to be convinced that you ought to have less vague/shitty release notes, particularly wrt issues like this?

They cover security issues in a separate announcement (listed on http://support.apple.com/kb/HT1222), but only a few hours after the update has been released. I do think high-impact security issues like this SSL bug deserve a mention in the release notes as well.

Looks like they're just trying to not make it obvious that Macs can have security problems. I don't think many regular users (who probably think Macs are invincible) are going to actively look for security announcements about their invincible Mac. And when they look at the release notes, many of them won't be convinced to stop what they're doing and install some unnecessary updates.

(Not trashing Mac, I am a Mac user.)

I wonder if their hope is everything transitions to something like iOS before this is falsified in a widespread way on OSX in public.

In corporate settings with desktop management, Macs are actually a huge pain to deal with; Windows maybe starts from crappier defaults but there's a much more mature industry around locking it down.

Hence why you want to be the odd one out with a Mac at Corporates: IT leaves you alone and you can manage it yourself.

If you really want IT to leave you alone you need a GNU/Linux machine.

most definitely the right person is reading this, Apple is a bottom-up corporation and someone reading HN could just talk to their manager and have the complaint heard by the right person.

It's definitely included in that update. Just tested Safari post-update.

http://imgur.com/qXLQUSh

Who would benefit from that?

Maybe someone who has already installed this could check if the SSL bug is fixed? https://www.imperialviolet.org:1266

It's fixed.

Just tried it with Safari on 10.9.2

>Safari can't open the page "https://www.imperialviolet.org:1266" because Safari can't establish a secure connection to the server "www.imperialviolet.org".

That means the patch worked.

Tested with this and gotofail.com on 10.9.2. It's fixed.

Reply on news.ycombinator.com