Ahh, so they probably had to restart the QA on the whole release a few days ago (including FaceTime Audio and associated features) after adding the TLS fix at the last minute.
It makes a bit more sense why they'd make us wait a few days, now.
It makes a bit more sense why they'd make us wait a few days, now.
The problem was not coordinating the release of 10.9.2 and iOS 7.0.6. The other problem is their patching cycle in general.
This update includes many high severity fixes from mid 2013 and one issue as far back as 2011. That tells you all you need to know about Apple's security program management. They release uncoordinated and when they feel like it, with no sense of urgency. It's convenient for them to just toss critical security fixes in to their 6 month OS updates, so they do.
Some criticize Microsoft for their "slow" patching, but they at least have a dedicated monthly cycle just for security updates, and they will send them out of band if a 0day gets exposed. And rarely will you see them drop 0day on themselves (though this wasn't always the case).
It's still terrible. They should have pushed out a fix for this vulnerability first and push back 10.9.2 if necessary. Or perhaps introduce a modern package system for the base system.
I suspect what this points to is that Apple doesn't have automated testing and they need a bunch of old school "hands on keyboards testers" to run a test case list that takes 4 days.
If you find this 'totally unacceptable', my suggestion would be to either go join them and help them improve the situation or to move to another OS. Bitching on the internet merely indicates how little experience you have with the trade offs that need to be made when pushing latge volumes of software.
Uhh no, we're customers. I don't find it unacceptable but if I did, it's within my rights to say so without "help[ing] them" as I pay the Apple Tax happily and repeatedly.
So call some employees in!
The early days fiasco are long gone and the SDL (http://www.microsoft.com/security/sdl/default.aspx) has performed really well.
What this doesn't excuse is disclosing the iOS bug before all fixes are ready. THAT was the major scrweup.
It was their decision to put the fix in 10.9.2 which is the problem. I agree rushing 10.9.2 would have been bad.
For quite a serious vulnerability, which requires removing one goto statement to solve? I am not sure by what standards that is a good response time. There is surely something wrong with Apple's procedures here.
Is it more critical to have 4 days of protection, or 4 days of "WTF is Apple incompetent" press?