Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!eu.feeder.erje.net!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail
From: Jolly Roger <jollyroger@pobox.com>
Newsgroups: comp.sys.mac.system
Subject: Re: Latest IOS/OS X SSL security flaw
Date: 23 Feb 2014 00:36:49 GMT
Organization: People for the Ethical Treatment of Pirates
Lines: 64
Message-ID: <bmsu50Fnr6sU2@mid.individual.net>
References: <lears8$l8d$1@dont-email.me> <220220141415089899%nospam@nospam.invalid> <2NWdnQXy6oxRY5XOnZ2dnUVZ_qSdnZ2d@giganews.com> <bmsj7oFmdpqU4@mid.individual.net> <L-SdnavB-Z27ppTOnZ2dnUVZ_uKdnZ2d@giganews.com>
X-Trace: individual.net 1WApwflrmEV3JYZxCR5c3A4gXOo1Z/vw8bIx5cHmX6wxAjjpdo
Cancel-Lock: sha1:aRPE/am5WVYZDfLUjmpcw5u6R2s=
X-Face: _.g>n!a$f3/H3jA]>9pN55*5<`}Tud57>1<n@LQ!aZ7vLO_nWbK~@T'XIS0,oAJcU.qLM dk/j8Udo?O"o9B9Jyx+ez2:B<nx(k3EdHnTvB]'eoVaR495,Rv~/vPa[e^JI+^h5Zk*i`Q;ezqDW< ZFs6kmAJWZjOH\8[$$7jm,Ogw3C_%QM'|H6nygNGhhl+@}n30Nz(^vWo@h>Y%b|b-Y~()~\t,LZ3e up1/bO{=-)
User-Agent: slrn/1.0.1 (Darwin)
Xref: csiph.com comp.sys.mac.system:56874

On 2014-02-23, Alan Browne <alan.browne@FreelunchVideotron.ca> wrote:
> On 2014.02.22, 16:30 , Jolly Roger wrote:
>> On 2014-02-22, Alan Browne <alan.browne@FreelunchVideotron.ca> wrote:
>>> On 2014.02.22, 14:15 , nospam wrote:
>>>> In article <lears8$l8d$1@dont-email.me>, Ted Lee <tmplee@gmail.com>
>>>> wrote:
>>>>
>>>>> The press and gossip rag reports say the recently discovered security
>>>>> flaw with SSL is present in both IOS and OS X.  The patch for IOS showed
>>>>> up last night.  The reports say the OS X one will be out soon.  Has
>>>>> anyone run across a technically competent (as opposed to sensationalized
>>>>> fear-mongering amateur drivel) discussion of the flaw *and* a conclusive
>>>>> statement that it is indeed present in OS X?
>>>>
>>>> it is in os x, and it's nothing more than an extra goto.
>>>>
>>>> <https://www.imperialviolet.org/2014/02/22/applebug.html>
>>>
>>> ROFL.
>>>
>>> goto has always been a source of low software quality - and it rears its
>>> head again here - although it looks more like sloppy editing than
>>> anything else - like another line of condition code had been deleted or
>>> moved.
>>
>> Indeed. And as John Gruber (Daring Fireball) asserted, the practice of
>> using curly braces for if blocks would have made the slip-up much more
>> obvious. I tend to prefer using braces in if blocks myself.
>
> I tend to think curly braces suck as code block begin/ends.  ;-)
>
> {This was esp. so with dot matrix printers.  We didn't have no fancy 
> colour editors either}
>
> What the hell is the matter with nice fat, 0 code producing BEGIN END 
> statements, anyway?
>
> Ada.  Ah, Ada, why have you forsaken us and let C rule?

Right there with you. : ) I can appreciate shortened forms; but not so
much when they increase the likelihood of mistakes like this. Pascal had
BEGIN/END too.

> Confession: testing the new disk docks I made an elegance improvement in 
> my program (writes random data to the disk on the dock) and it caused a 
> bug - program wrote about 25,000 files of 64KB each before I caught it 
> (file names have a random string on the end).  The error (not involving 
> goto) was however of similar lameness to the one in the code above. 
> OTOH, it's just quickly written code to torture test the docks and just 
> as quickly fixed.

Mistakes are made by even the very best programmers. You have lots of
good company. : )

> Note: if the disk is encrypted I hit about 110 MB/s; non-encrypted 165 
> MB/s.  I didn't think there would be that much of a hit on encrypted drives.

Interesting. FileVault2, or something else?

-- 
E-mail sent to this address may be devoured by my ravenous SPAM filter.
I often ignore posts from Google. Use a real news client instead.

JR