Was the iOS SSL Flaw Deliberate?

Re:Was the iOS SSL Flaw Deliberate? by nly on Thursday February 27, 2014 @09:12AM (#7312215)

> it's in an open sourced package, so the assumption is someone is eventually going to see it, so it's not going to remain a secret and thus is useless as a stealth backdoor.

The fact that people can see the nature of the bug in the source code for themselves just makes the case that it was a deliberate backdoor even more deniable which, as Schneier is pointing out, is a very desirable property.

You're also assuming that a backdoor you can use indefinitely is desirable.

As an added side-benefit, any other proprietary or FOSS products that adopted this code are now vulnerable.

[ Parent | on HN ]

Re:Was the iOS SSL Flaw Deliberate? by nicholassmith on Thursday February 27, 2014 @09:18AM (#7312249)

Sure, it makes it even more deniable, but on the balance between 'well thought out conspiracy with I know-you know-I know you know I know' logic, and a fuck up, I'd err towards it being a fuck up.

[ Parent | on HN ]

Re:Was the iOS SSL Flaw Deliberate? by nly on Thursday February 27, 2014 @09:28AM (#7312309)

You're just casually brushing this off with Hanlon's Razor. You shouldn't discount the fact that as technical folk and programmers here on HN we're probably biased[0]. Our ability to recognise just how easily this flaw could have been both introduced and detected can both be used both against, and in defence, of the conspiracy theory.

[0] https://en.wikipedia.org/wiki/Attribution_%28psychology%29#D...

[ Parent | on HN ]

Re:Was the iOS SSL Flaw Deliberate? by nicholassmith on Thursday February 27, 2014 @10:04AM (#7312519)

I've been a proponent of Hanlon's Razor a number of times, so guilty as charged.

As technically minded people we intrinsically understand that it could be the work of someone malicious, but we should also understand from personal experiences that fuck ups happen significantly more often than brown envelopes full of cash.

[ Parent | on HN ]