News for hackers. Stuff that matters.
Re:Was the iOS SSL Flaw Deliberate? by tptacek on Thursday February 27, 2014 @09:32AM (#7312339)
You are confused. The NSS bug you're referring to was in False Start. Mozilla found and fixed the False Start bug before any release of Firefox (which is not the only user of NSS) could be impacted. I am not talking about the False Start bug. The PKCS1v15 parsing bug had nothing to do with False Start. Which makes your comment a little silly.
Re:Was the iOS SSL Flaw Deliberate? by makomk on Thursday February 27, 2014 @09:36AM (#7312369)
You're not talking about it anymore, most likely because someone from Mozilla called you out on it last time. Instead you're talking about a vulnerability that's 4 years old and have quietly stopped mentioning exactly how old it was, because it'd make it obvious just how weak your argument actually is.
Re:Was the iOS SSL Flaw Deliberate? by tptacek on Thursday February 27, 2014 @09:38AM (#7312379)
So your problem with an argument you don't like is that I didn't make it? You didn't understand the point I was making on that thread and now, embarrassingly, are attempting to port your misconception into a thread that has nothing to do with either my point or your fictitious version of it. I don't think you know what you're talking about.
Re:Was the iOS SSL Flaw Deliberate? by makomk on Thursday February 27, 2014 @09:56AM (#7312472)
Okay, what exactly is your point then? You seem to be arguing that the only reason this got coverage was because it was easy for laypeople to understand, but none of the other examples you're comparing to involved the spectacular vendor incompetence in rolling out the patch that made Apple a laughing-stock online and gave the media such a sensational story to cover, and the only one [edit: well, only TLS one] that even made it into a release was so long ago most people on here have probably forgotten the details. (I wasn't on Hacker News at the time, but it definitely made it to Slashdot and as I recall resulted in a lot of people complaining about SSL/TLS being a disaster by design.)