Hacker News Reader

Comment by lawnchair_larry | Hacker News Reader

How can you be mad at Esser? He didn't put the bug there. He has nothing to do with this.

You forget your key when leaving for work, and don't lock your door. It was accidental, you have a lot on your plate. Your neighbour sees you didn't lock it, and tweets out, "Hey Mike at 321 Greyhat Bvld, you didn't lock your front door". He didn't send that to you as a text, he tweeted it. You come home, and you've been cleaned out.

I'm sure we can all agree, you should have locked your door. Why be mad at your neighbour, he didn't leave the door unlocked, he didn't take your stuff...

A better analogy would be your doorman, whose one job is to watch who gets into your building, leaving the key cabinet unlocked and going to lunch.

I don't mean to blame any individual human here, but I'm baffled at the process by which debugging environment variables were added to dyld without being carefully vetted for bad interactions with setuid binaries. This is a well-known easy place to screw up, and I'm surprised that someone was working on dyld without knowing that (although yes, humans forget things sometimes), and much more surprised that this made it past code review and into a shipping product.

This isn't a random screw up in regular software. dyld is security-sensitive; it's one of the small number of libraries that bears a responsibility to be paranoid about setuid.

That's kind-of a bad analogy. It'd be better of:

1) The person who left the house open was certain to get the message quicker because of the tweet than just a text. 2) It was possible to quickly and remotely lock the door. Apple can and should fix this bug very quickly, as that is certainly possible for them.

I'm sure we can all agree we can make up shit that can happen till the cows come home. I'm not going to act as if someone robbed me until they do. Hold Esser responsible if someone hacks a large number of people because of what he did. Otherwise, stop living a thousands lives.

Well, I mean, there were consequences--as the article said, there's now malware out there that uses the exploit this guy publicized.

Actually that's not a consequence. A consequence is "200K credit cards were stolen and created $50M in losses". Our assumptions (nay, EXPECTATIONS) that we can achieve a perfect record for responsible disclosure is akin to dissonance, which is why this topic is so polarizing. Let's save the judgement of him until we have evidence that shows why what he did is wrong. Until then, this is all a waste of effort.

At least read about responsible disclosure before being so flippant about things like that.

Esser put people at risk. Whether or not anything happens is irrelevant. He put them at risk and we need to recognize that is the cost of full disclosure.

If you're fine with that, cool, but don't pretend he didn't do anything.

Well, Apple knew about the vulnerability long before Esser reported it though. So "responsible disclosure" whould have achieved nothing, so we should not be comparing public disclosure to it, but be comparing public disclosure to no disclosure.

> read about responsible disclosure

Stop presuming I haven't.

> Esser put people at risk.

That's non-provable until we see it instantiated.

> If you're fine with that, cool, but don't pretend he didn't do anything.

Don't speak for me. I never said he did the right thing. I said stop spinning what-ifs about it, but clearly what I should have said is STFU and do something about it. People getting in each other's grill isn't doing something about it. It's blaming others for whatever issues we, as a group, find polarizing.

>> Esser put people at risk.

>That's non-provable until we see it instantiated.

That's not how risk works. I don't even know where to start. If you play a round of Russian Roulette and happen to hit an empty chamber, do you say it's impossible to prove you were at risk? Do you see now how dumb that argument is?

If he publicized a vulnerability, the risk to all of the affected systems is increased. Period.

It's the same way that EMPs are a risk to airlines. If someone releases a method to generate them very easily, they increase the risk to all airlines. You don't have to wait until an airline is brought down before you say the risk was increased.

From the Author in the Comments "In Esser's original post revealing the vulnerability, he said, "At the moment it is unclear if Apple knows about this security problem or not.""

So basically he just released it without disclosure. He claims reasons (see parent post), but its still kinda ick..

Just giving the benefit of the doubt here, a lot of the time it's unclear if your disclosure even made it to the right people in a company or not. No response is the norm for security disclosures, as is claims of "we didn't get this", even if you have a receipt for their ticketing system that says they did. I've sometimes spent far longer attempting to contact a company than doing research into something that seems to be a problem.

Stefan is not just some random guy on the Internet. I can assure you the relevant folks at Apple know him and most likely he knows them.

oh, well as long as you can assure us of that orthogonal point, I guess it's all good mr anonymous internet person

It's easy to prove. Just go look at the number of iOS and OSX security fixes attributed to him. Or you can go do a simple search on any reputable site posting security info and you'll see him all over it.

https://en.wikipedia.org/wiki/Responsible_disclosure

Reply on news.ycombinator.com