More Apple Security Problems

[Guest Lester Weevils]

http://www.zdnet.com/major-apple-security-flaw-patch-issued-users-open-to-mitm-attacks-7000026624/

http://www.forbes.com/sites/andygreenberg/2014/02/24/former-apple-security-engineer-to-apple-fix-your-sh-t/

Last summer the entire apple developer site had to be shut down and reworked after being hacked.

Maybe it's not so much that the companies are screwing up. Maybe there is just no such thing as complete security in life, even in software? Edited February 24, 2014 by Lester Weevils

[2.ooohhh]

Not half as big an issue on iOS as it is in the desktop OS, though in iOS it doesn't affect users of Chrome since Chrome handles SSL handshake via NSS instead of the effected DHE and ECDHE.

 

Coding is extremely complex and it takes YEARS to work all the bugs out. VxWorks is a perfect example, essentially out since 1987 and still had a major bug pointed out by security researchers in 2010.

[2.ooohhh]

If you want real scary look at the number of java versions in the wild and all of the exploits published for many of them. I was at a conference last summer where a researcher pointed out that around 75% of the browsers on the web are running a java plug in that is more than 6 months out of date!

 

 

 

Source

[Guest Lester Weevils]

Coding is extremely complex and it takes YEARS to work all the bugs out. VxWorks is a perfect example, essentially out since 1987 and still had a major bug pointed out by security researchers in 2010.

Completely debugged software seems a vanishingly rare unicorn.

[sigmtnman]

...

Coding is extremely complex and it takes YEARS to work all the bugs out. VxWorks is a perfect example, essentially out since 1987 and still had a major bug pointed out by security researchers in 2010.

As though all the bugs are ever found, much less fixed. Most security bugs, are not bugs, but instead oversights or just insecure design s.