Re:On the Timing of iOS’s SSL Vulnerability and Apple’s ‘Add...
by Create on Sunday February 23, 2014 @12:48PM
(#7286685)
I can totally see this being "innocent 2AM mis-judgement call by a single employee", judging from what my peers tell me of Apple's corporate culture.
https://support.apple.com/library/APPLE/APPLECARE_ALLGEOS/HT...
We begin therefore where they are determined not to end, with the question whether any form of democratic self-government, anywhere, is consistent with the kind of massive, pervasive, surveillance into which the Unites Sta tes government has led not only us but the world.
This should not actually be a complicated inquiry.
Re:On the Timing of iOS’s SSL Vulnerability and Apple’s ‘Add...
by cbhl on Sunday February 23, 2014 @03:30PM
(#7287440)
FIPS 140-2 certification isn't remotely an indication of correctness of code, for better or worse.
Take, for example, the implementation Dual EC DRBG in the FIPS 140-2 certified OpenSSL module -- it was fatally flawed, and has never worked in practice. (It will be removed from the next version of the module in light of developments in the past year.)
I can totally see this being "innocent 2AM mis-judgement call by a single employee", judging from what my peers tell me of Apple's corporate culture. I do think that Adam Langley's suggestion that code review would help is plausible, but it merely just means that more than one person has to make the same mistake in a judgement call. (It reduces the probability of such an error happening; it doesn't theoretically eliminate it.)