On the Timing of iOS’s SSL Vulnerability and Apple’s ‘Addition’ to NSA’s PRISM

Re:On the Timing of iOS’s SSL Vulnerability and Apple’s ‘Add... by stormbrew on Sunday February 23, 2014 @02:20AM (#7285221)

In the CR tool I assume it may have looked more like this:

        if ((err = SSLHashSHA1.update(&hashCtx, &serverRandom)) != 0)  
            goto fail;
        if ((err = SSLHashSHA1.update(&hashCtx, &signedParams)) != 0)    
            goto fail;
    -   if ((err = SSLHashSHA1.update(&hashCtx, &somethingElse)) != 0)
            goto fail;  
        if ((err = SSLHashSHA1.final(&hashCtx, &hashOut)) != 0)  
            goto fail;

Which is a little harder to see. Obviously you should always look at it in a side-by-side view (god I wish github would implement this) or at the resulting code, but people are imperfect.

[ Parent | on HN ]

Re:On the Timing of iOS’s SSL Vulnerability and Apple’s ‘Add... by nickls on Sunday February 23, 2014 @04:56AM (#7285436)

Doesn't look like any (major) modification to surrounding lines.

    if ((err = ReadyHash(&SSLHashSHA1, &hashCtx, ctx)) != 0)
        goto fail;

changes to:

    if ((err = ReadyHash(&SSLHashSHA1, &hashCtx)) != 0)
        goto fail;

See: http://www.diffnow.com/?report=ob51k

Diff35

[ Parent | on HN ]

Re:On the Timing of iOS’s SSL Vulnerability and Apple’s ‘Add... by pmjordan on Sunday February 23, 2014 @11:05AM (#7286255)

We only see the diff between released versions, not intermediate commits. For all we know, Apple developers use a single-pane diff tool, where such bugs are easy to miss.

[ Parent | on HN ]

Re:On the Timing of iOS’s SSL Vulnerability and Apple’s ‘Add... by oneeyedpigeon on Sunday February 23, 2014 @04:50AM (#7285426)

Damn fine point. I really don't think we can conclude this is malice; do all of our own bugs always turn out to be really tricky to spot? Do we never make utterly ridiculous mistakes along these lines?

[ Parent | on HN ]

Re:On the Timing of iOS’s SSL Vulnerability and Apple’s ‘Add... by wreegab on Sunday February 23, 2014 @04:59PM (#7287797)

Except that I don't think this was the original code considering it appears to be cut and paste of same code in same file. I commented on this: https://news.ycombinator.com/item?id=7286582

[ Parent | on HN ]