Reader M sends this note for iPhone, iPad and Mac users:
Run software update on iOS devices immediately. Settings > General > Software Update.
Technical details: https://www.imperialviolet.org/2014/02/22/applebug.html
It also affects OS X 10.9.1, which I’m hoping they patch today…
Hacker News thread: https://news.ycombinator.com/item?id=7281378
Reader J sends in what’s (in his estimation) everything you need to know about white evangelicals.
Add, subtract, multiply or divide in the comments.
The Pale Scot
So my next door neighbor is rocking his Ohio Polka station down here in FL, and thru the window i just heard a cover of “Momma’s got a Squeeze Box”. It’s kinda catchy, and that’s scary.
chopper
Lol, dead code in a security handshake. That’s awesome.
stickler
Well, I can’t comprehend anything from the story in the first link, and Apple Software Update tells me that there is no update for my MacBook Air. So this hair-on-fire warning from some guy who sent an anonymous warning from some hacker dude is kind of annoying.
SiubhanDuinne
Ambition, Distraction, Uglification, and Derision.
Ambition, Distraction, Uglification, and Derision.
Roger Moore
With a log table, even an adder can multiply.
SiubhanDuinne
@stickler:
Warning is all over my Facebook feed.
Thlayli
@stickler:
It said “iOS devices”, which a Macbook isn’t.
Reading comprehension: it’s not just for breakfast anymore.
Origuy
Yeah, I have an iOS update 7.0.6, which is about SSL, pending on my iPhone. I kind of followed the discussion. Basically, the bug allows you to connect to a website which is sending a certificate (which says that a signing authority like VeriSign has said they are who they say they are) but doesn’t have the proper key that matches it. That’s because the code has an extra branch that is taken unconditionally. Potentially very bad.
ruemara
The warning links need to translated from programmer to human. But I’ll boot up the Mac, just in case.
Up since 5a.m., headache since 8 p.m.. The hard deadlines I’m up against are already starting to trigger all my stress responses. Can’t even imagine what it’s going to be like if I fail.
Origuy
@Thlayli: mistermix says the bug is in OS X, too. Apple probably uses the same SHA routine in both systems.
Origuy
@Thlayli: mistermix says the bug is in OS X, too. Apple probably uses the same SHA routine in both systems.
Davis X. Machina
@Origuy: From first link:
raven
Jesus it’s taking forever! Why do they bother showing all these stupid steps? Just start the goddamn thing and tell me when it’s done.
lonesomerobot
So I will just go ahead and bust out this totally unsolicited story…
I basically work for your crazy right-wing Uncle Norval. He’s been very erratic lately, to the point that about a month ago we had around 25 employees, and now we have seven (all those that left did so voluntarily). This is normally the time that a person who doesn’t have the luxury of just leaving begins a job search in earnest, so that’s what I did. Long story short, I’m now in the final stages of interviewing for a job with the company that is the subject of this article from Think Progress. [Synopsis: Company has made millions using a made up pitch to sell “survival” products to fear-addled conservatives – basically my current boss is their target customer. It’s kind of shady; the person listed as their “principal” is not even a real person.]
The final interview for this job is in about ten days. I’m told by the recruiter that the Partners — a husband and wife — who run the company are actually very nice people who she personally loves to work with. They both have Ivy League degrees (whatever that means, I realize it doesn’t necessarily make them good people). I’ve actually been in contact with the author of the Think Progress article. Let’s just say that I’m very thorough when I’m preparing for an interview.
So, I’ve got a lot to think about on this one. In the meantime, I’m also in the interview process for other jobs, and at least one of the others looks as promising, if not more. I’m taking input here, and would be really interested to hear what some of you would do if you were in a similar position. Thanks!
Tommy
Automatic system updates suck. My tablet is only a year old. Android. The last system update just made it work at a snails pace. I am like “dude, are you forcing me to upgrade already?”
Cassidy
@lonesomerobot: Depends on circumstances. When you got a family to feed, principle doesn’t buy groceries.
Origuy
This is weird. I told iTunes to download the update, which is only 13.6MB. It says it will take 5 hours. However, my iPhone downloaded it in seconds and is in the process of restarting. I thought it would be faster to go through iTunes.
lonesomerobot
@Cassidy: I do have a family to feed, which lends also to the need for stability. One of my worries about the company, principles aside, is that their shadiness could lead to them either being investigated or simply harassed (either legally or otherwise) by an angry right-wing nutjob with nothing better to do.
I forgot to mention that the other job prospect would involve having to relocate from where I live now (a city in the Mid-South) to a place with a considerably higher cost-of-living (a city in the Northeast). The money’s good, though.
Cassidy
@lonesomerobot: Wingnut money is still green. They’re just more willing to part with theirs over crazy shit. lol
lonesomerobot
OK just kidding, what I really am is an internet researcher testing the best ways to kill a thread. Looks like I’ve found a winner! Either that, or everyone’s devices have crashed because of a bad update.
Jane2
Great…none of my devices have new software for me to load.
Ruckus
@lonesomerobot:
See if I try to help.
lonesomerobot
@Cassidy: True, that. I’m actually interested in meeting the people. Just don’t know what I’ll do if I’m offered the gig.
Ruckus
@lonesomerobot:
I’m the thread killer here.
You want to know how?
Send me your account info and deposit $20,000 for me, I’ll let you in on the secret.
Robert Sneddon
“Go To Statement Considered Harmful” — we knew that in 1968, for crying out loud. My first programming class the tutor warned us that each GOTO statement in submitted projects would cost us a downding (A to B, B to C etc.). I never used it at all in projects, got As all year.
Is anyone doing code review in Apple? Anyone? Testing against a suite of good and bad certificates? Anyone?
RaflW
It’s taking a very long time on my iPhone to download. Apple may have thought they could quietly issue the update, but it’s out there and it feels like they didn’t budget the servers for this.
doug r
@lonesomerobot: So you know all this about them, and you’re still asking our advice? I for one, am NOT writing to you when you go to prison. Seriously, this can only turn out bad-if not for you, then some of their “customers”.
Laertes
Anyone know how far back this goes? I’m still running 6.1.3 because…gosh, I’m not sure. I remember hearing something about 7.x that I hated and I didn’t upgrade, but I don’t remember what it was. Anyway, anyone know if this bug is in iOS 6.1.3? Just how old is this thing?
? Martin
@RaflW:
doug r
@Ruckus: I am doug r, destroyer of threads-just ask Anyone at Big Orange or Big Blue.
? Martin
@RaflW:
It’s likely not Apple’s servers bogging down but your ISP. 25% of US adults have an iPhone. Throw in iPads and you’re up around ⅓. Every time Apple releases a new OS, my ISP reports that their bandwidth consumption doubles, so software updates can, at least in the near term, exceed Netflix+Amazon+YouTube+all other streaming video services combined.
Laertes
@lonesomerobot: Thing about working for shady people is they will, sooner or later, screw you over. If the pay is good in the meantime, that can still be a net win. I’d be reluctant to relocate for a gig that’s likely to last no more than a couple of years and end ugly.
Laertes
To elaborate on that a bit: Any organization I’ve ever worked for (seven or eight now, in twenty-odd years as a developer) was, at every level, a clone of the leader’s personality. The way the top person treats her subordinates is the way they treat their subordinates, and on down the line.
One guy I worked for was an alpha-male jock type. Decent guy, but aggressive and hyper-competitive. And that’s what the whole organization was like as a direct result. You had to be a thick-skinned self-promoting alpha type to succeed there. Another was run by a thoroughly nice guy with trust & control issues. That organization, at every level, was paralyzed by an inability to make decisions and a reluctance to share information of any kind. Another was run by a woman who was low-key, no-drama, hyper-competent, and treated everyone at every level with respect. Again, that’s how everyone in the operation acted.
An operation that’s run by shady people and doesn’t respect its customers is a fundamentally deceptive operation, and that’s going to manifest as deceptive interactions among the people who work there. I’d bet money that it’s a hive of gossip, backstabbing, and political games.
cleek
i’d love to update, but the thing says it’s “no longer connected to the internet”, which it is.
i assume this means Apple is no longer connected to the internet because too many people are trying to update at once.
NotMax
Get a PC.
(Actually, use whatever floats yer boat. Just balancing out the usual, and most unhelpful, Mac snob response to these kinds of threads.)
WaterGirl
@lonesomerobot:
I think that was excellent advice.
MikeJ
@stickler:
Then obviously this doesn’t apply to you. Security holes only affect people who can comprehend the threat. I think the smart thing for you to do is to just ignore it all.
Stella B.
The new Italian PM, Matteo Renzi, announced his cabinet yesterday. There will be 8 male ministers and 8 female ministers with an average age of 47. That is quite impressive, especially in Italy.
Ruckus
@Laertes:
Dad always said that the old saying, “A bad apple spoils the barrel” applied to employees and employers. Equally.
Ruckus
@doug r:
That’s fine.
I’m not looking to be the thread killer here, it just seems to work out that way. You want to take over, I’ll move out of the way. Well I’ll try to anyway.
HOpe
My husband’s IPAD 4.3.3, doesn’t have a software update tab in settings. Now what?
muddy
@Laertes:
This is a perfect description of the workplace when I worked for a defense contractor.
Ruckus
@stickler:
It’s not even close to a hair on fire situation. It is real, it is a stupid and ridiculous mistake that is real obvious and this from someone who hasn’t programed in a couple of decades and even then a different type of programing.
ruemara
@lonesomerobot: 1. I hate to say this, but, what Cassidy said. No one gets cash for being principled. 2. What Laertes said. Unfortunately for me, I always wind up working for fireballs, because they know how to exploit people. And I always get screwed. Take it if you get it, but keep running.
Ruckus
@Laertes:
Ever work for an alcoholic? That was fun, every day not knowing if jeckel or hyde would show up and if they did what would make them adopt one or the other.
Origuy
@HOpe: It may have to be updated through iTunes. iOS 4 was a long time ago in software years.
jheartney
I have an ancient iPod that can’t be updated past iOS 5.1.1. Guess I can’t use it for banking (not that I ever did).
jheartney
From what I was reading this affects people using public WiFi and attempting to establish secure connections. If (like me) you are on your WPA2-secured home network, it doesn’t apply to you. Is that correct?
ruemara
OT to the OT thread: Mexican Chocolate Bacon candy. Yes? or No?
ACT
Tried to update my IPAD but it keeps saying Im not connected to the internet even though I have wifi on and sitting next to the router and I have 3G. Go figure.
LT
What the fuck?
I have been in nightmare land for some days now with my Mac – running 10.9.1.
Is this about this? Help… fuck… help…
LT
Are we supposed to understand those links? God almighty I fucking hate shit like that. It’s like talking to every fucking *typical* IT asshole who ever fucking lived. ZERO ability to talk below what they deem their
I gotta stop. Bad couple of days. Fuck.
WaterGirl
@ACT: Mine has been doing the same thing lately. So I connected to my computer and got the update that way.
PeterJ
@LT:
Why learn to talk to people who can’t understand, won’t understand, and will never understand? Waste of time.
Bill Arnold
@WaterGirl:
My iphone 4 updated fine (connected to house wi-fi). I had to go into settings/general/software update to check for updates.
As far as the bug (or who knows, maybe deliberate) goes, it is the sort of thing that automated checks are supposed to catch. Surprising to see in security code.
LT
@PeterJ: “Why learn to talk to people who can’t understand, won’t understand, and will never understand? Waste of time.”
What does that mean? Everryone is supposed to understand all levels of tech talk or they’re a waste of time? Hope you never have to talk to a doc about gliobalstoma or somesuch
ruemara
@PeterJ: You know why? That’s your customer base. They aren’t all IT peeps. This is why good customer materials and support can make or break a brand. I understand what you’re saying about people who just want things to work, but they pay the money that keeps tech the playground of such self-made, smarter than the rest of us, people.
PeterJ
@LT:
all you need to understand is this:
WaterGirl
@ruemara: spicy hot + chocolate = yes
bacon + sweet = no for me, but the “toffee lady” in our town sells a ton of bacon toffee, which is toffee and chocolate and nuts and bacon.
WaterGirl
@Bill Arnold: I am betting someone is in deep doo-doo over this at Apple. More than one someone, I think. This should have been caught in testing.
WaterGirl
@PeterJ: LT, if you look at the links upthread, they are preceded by “technical details” and “hacker news thread”.
Neither of those things are sources for regular people, but a ton of regular commenters here at BJ are IT folks, so that level of detail can be fun for that crowd.
If you go to the Apple site, they don’t have anything like that. They just say to run the damn update. :-)
PeterJ
@LT:
If a doctor ever wanted to talk to me about glioblastoma then I would be searching/reading about it asap. Why? Because I prefer to be informed, and trusting that just one source will give you all the information that you need… that’s a bad idea.
Robert Sneddon
@WaterGirl: To start with the development environment (IDE) should have flagged it with a warning as in “did you really want to pull a dumbass stunt like that? Sure?”. The code review follows where one or more of your team goes over your code with a practiced eye looking for this sort of glitch among others — screw up badly and you buy pizza for the team (it’s an incentive for them to look hard and a good reason for you to check your own damn code). Following that, before the code goes live to customers it gets run against a range of good and bad inputs to check the error detection among other factors. That testing should include bad or black-hat certificates which this chunk of code will let through since it treats good and bad keys the same.
This bad code affecting customers means several checkpoints were missed, bypassed or just failed to catch the error.
PeterJ
@WaterGirl:
Not sure if the site even has that…
Origuy
@jheartney:
No, it doesn’t matter how you connect to the internet. If you connect to a site with a valid certificate and a bogus key or no key, the authorization is broken.
@ACT:
Try plugging your iPad into AC power. Some devices won’t do an update unless there’s continuous power, so that the battery won’t fail in the middle and leave the system in an unbootable state.
Calming Influence
@ruemara: Si!
Calming Influence
@LT: When we’re most frustrated, we often say the things that really need to be said, though perhaps not in the most temperate tone.
My mantra: “Fuck temperate tone.”
Bill Arnold
@Robert Sneddon:
Yeah, completely agreed. Static automated checks should have been used to gate against this bug in at least two ways (and running through a formatter would have made it obvious). And that’s before code reviews, etc. (I haven’t coded in C for a decade FWIW) Since this was in security code, Apple has lost/will lose a lot of trust for this.
lonesomerobot
@doug r:
@Laertes:
@ruemara:
Thanks for taking the time to answer. Just wanted you to know I did actually read your comments and do appreciate what you said. (A beautiful Saturday happened and I ended up going to a park with my wife)
LT
@Calming Influence: This is unquestionably true. Not sure if mine was new or anything, but…
LT
@PeterJ: “Run software update on iOS devices immediately. Settings > General > Software Update.”
This is regarding iOS. I don’t do iOS. It’s regarding my work computer which has gone tits up in last couple of days. Still no fix for 10.9.1.
“If a doctor ever wanted to talk to me about glioblastoma then I would be searching/reading about it asap. Why? Because I prefer to be informed, and trusting that just one source will give you all the information that you need… that’s a bad idea.”
Look – I was just frustrated by tech speak I didn’t understand, which I combined with actual life experience with people who have ZERO ability to give instructions to ppl who don’t have their level of expertise. Again – it’s been a frustrating couple of days.
LT
@WaterGirl: True – but it’s in a BJ post addressed to Mac users, not experts. I quibble, but still…