*Sigh*
Came across this tidbit while catching up on some stuff. Not good at all, really. The only positive thing about all of this is that at least security guys are giving Apple's stuff an actual look... but isn't this the 2nd exploit regarding inadequate checking over input fields in like 2 months, both different?
Yeah, I know the first was a system-wide problem with cocoa text fields, and this is application specific. But come on- this is input checking on the keychain, the jewels to most of what the user might hold dear.
Basically, two things are coming to mind:
- Apple seems to not being real thorough on some of these things, which could bode ill. For every MS exploit out there, the other platforms (*nix, including osx) gain some positive brainwidth. When that starts getting overwhelming, you've got something. For every one Apple has to patch, they erase a lot more brainwidth than they gain through MS having a bad day. After the first cocoa text field exploit, I'd have hoped they'd been going nuts reviewing all others... as I'm sure that's what turned this guy onto looking into it.
- Apple doesn't seem to have any set policy regarding security issues- the left had doesn't seem to know what the right hand is doing. In both of the last few cases, if I recall correctly, the researchers waited a bit over a month after notifying Apple to go public, usually because they simply couldn't get any word from Apple. They're in a whole different world with a lot of these guys, and are really going to need to adopt a strategy that doesn't end with security guy after security guy going public because they couldn't get a straight answer out of Apple.
Posted by drunkenbatmanJanuary 01, 2004, at 10:16 PM
Good points. I see security guys saying they are "forced" to go public after their own self imposed timelimit is exceeded all the time in the security lists I read. (Truthfully happens mostly with M$). I think the thing Im missing and want to have explained is how he contacted apple to report this. As a former Apple employee, Ive seen the quality of the people and level of care they put into their work, I also know as any other organization of its size it has bureaucracy clogging the wheels. Calling or contacting the right person is key, dont you think? While M$ must have this sort of thing happen on an hourly basis, with Apple its almost brand new.