Seriously "they've gotta do something" sounds good but I'm not sure what options they actually have. If the user clicks through a clear SSL warning, that's Apple's fault?
Your response is like saying when Facebook was privacy zuckering (http://darkpatterns.org/library/privacy_zuckering/), the user clicks right through the settings that should have sounded an alarm.
What can Apple do? They could make a better browser (I like how Chrome and Firefox do things - you have to go out of your way to reach a page with bad SSL -- compare Safari's rather passive and enabling error message: http://blog.serverdensity.com/wp-content/uploads/2009/05/ssl... vs. chrome's: http://i.imgur.com/ttmmDJ8.png -- you have to REALLY see and think how to access the site despite the warning, it's that good). They could be more vigilant in alerting users of where and how this can happen.
If we were talking about any other young startup, your apology might fly -- not so with Apple, they're sitting on billions, they have the resources to think of a solution and implement it.
> Your response is like saying when Facebook was privacy zuckering, the user clicks right through the settings that should have sounded an alarm.
This is a bit odd, though. On one hand we have a company directly attempting to trick users; on the other, we have a company whose product is being attacked by a hostile government. Drawing an equivalence between the two is a bit ridiculous, no?
I think the two are quite comparable. In both cases, the software developer should be responsible for guiding the user to make the right decision.
"It’s hard to blame users for not being interested in SSL and certificates when (as far as we can determine) 100% of all certificate errors seen by users are false positives."*
"It’s hard to blame users for not being interested in SSL and certificates when (as far as we can determine) 100% of all certificate errors seen by users are false positives."