On the Timing of iOS’s SSL Vulnerability and Apple’s ‘Addition’ to NSA’s PRISM

Re:On the Timing of iOS’s SSL Vulnerability and Apple’s ‘Add... by Create on Sunday February 23, 2014 @12:48PM (#7286685)

I can totally see this being "innocent 2AM mis-judgement call by a single employee", judging from what my peers tell me of Apple's corporate culture.

https://support.apple.com/library/APPLE/APPLECARE_ALLGEOS/HT...

We begin therefore where they are determined not to end, with the question whether any form of democratic self-government, anywhere, is consistent with the kind of massive, pervasive, surveillance into which the Unites Sta tes government has led not only us but the world.

This should not actually be a complicated inquiry.

http://snowdenandthefuture.info/events.html

[ Parent | on HN ]

Re:On the Timing of iOS’s SSL Vulnerability and Apple’s ‘Add... by cbhl on Sunday February 23, 2014 @03:30PM (#7287440)

FIPS 140-2 certification isn't remotely an indication of correctness of code, for better or worse.

Take, for example, the implementation Dual EC DRBG in the FIPS 140-2 certified OpenSSL module -- it was fatally flawed, and has never worked in practice. (It will be removed from the next version of the module in light of developments in the past year.)

https://lwn.net/Articles/578375/

[ Parent | on HN ]