Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.sys.mac.system > #56833 > unrolled thread
| Started by | Ted Lee <tmplee@gmail.com> |
|---|---|
| First post | 2014-02-22 12:56 -0600 |
| Last post | 2014-03-01 21:53 +0000 |
| Articles | 20 on this page of 197 — 21 participants |
Back to article view | Back to comp.sys.mac.system
Latest IOS/OS X SSL security flaw Ted Lee <tmplee@gmail.com> - 2014-02-22 12:56 -0600
Re: Latest IOS/OS X SSL security flaw nospam <nospam@nospam.invalid> - 2014-02-22 14:15 -0500
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-22 14:47 -0500
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-22 21:30 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-22 19:04 -0500
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-23 00:36 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-23 09:48 -0500
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-23 16:41 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-23 12:05 -0500
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-23 17:22 +0000
Re: Latest IOS/OS X SSL security flaw billy@MIX.COM - 2014-02-24 02:15 +0000
Re: Latest IOS/OS X SSL security flaw Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-02-24 03:57 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-24 18:25 -0500
Re: Latest IOS/OS X SSL security flaw Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-02-25 08:16 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-25 19:50 -0500
Re: Latest IOS/OS X SSL security flaw Don Bruder <dakidd@sonic.net> - 2014-02-23 07:51 -0800
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-23 11:23 -0500
Re: Latest IOS/OS X SSL security flaw Don Bruder <dakidd@sonic.net> - 2014-02-23 15:05 -0800
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-23 20:01 -0500
Re: Latest IOS/OS X SSL security flaw Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-02-24 04:21 +0000
Re: Latest IOS/OS X SSL security flaw Bill Findlay <yaldnif.w@blueyonder.co.uk> - 2014-02-24 04:35 +0000
Re: Latest IOS/OS X SSL security flaw Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-02-24 06:00 +0000
Re: Latest IOS/OS X SSL security flaw JF Mezei <jfmezei.spamnot@vaxination.ca> - 2014-02-24 16:52 -0500
Re: Latest IOS/OS X SSL security flaw Bill Findlay <yaldnif.w@blueyonder.co.uk> - 2014-02-24 21:54 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-24 17:44 -0500
Re: Latest IOS/OS X SSL security flaw Bill Findlay <yaldnif.w@blueyonder.co.uk> - 2014-02-25 00:19 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-24 19:26 -0500
Re: Latest IOS/OS X SSL security flaw Bill Findlay <yaldnif.w@blueyonder.co.uk> - 2014-02-25 00:40 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-24 19:46 -0500
Re: Latest IOS/OS X SSL security flaw Bill Findlay <yaldnif.w@blueyonder.co.uk> - 2014-02-25 00:57 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-24 17:43 -0500
Re: Latest IOS/OS X SSL security flaw Bill Findlay <yaldnif.w@blueyonder.co.uk> - 2014-02-25 00:19 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-24 19:29 -0500
Re: Latest IOS/OS X SSL security flaw Bill Findlay <yaldnif.w@blueyonder.co.uk> - 2014-02-25 00:40 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-24 19:45 -0500
Re: Latest IOS/OS X SSL security flaw Bill Findlay <yaldnif.w@blueyonder.co.uk> - 2014-02-25 00:57 +0000
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-24 05:04 +0000
Re: Latest IOS/OS X SSL security flaw Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-02-24 06:00 +0000
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-24 16:10 +0000
Re: Latest IOS/OS X SSL security flaw Kurt Ullman <kurtullman@yahoo.com> - 2014-02-24 12:15 -0500
Re: Latest IOS/OS X SSL security flaw Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-02-24 22:33 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-24 17:47 -0500
Re: Latest IOS/OS X SSL security flaw Richard Kettlewell <rjk@greenend.org.uk> - 2014-02-25 13:41 +0000
Re: Latest IOS/OS X SSL security flaw Kurt Ullman <kurtullman@yahoo.com> - 2014-02-25 09:06 -0500
Re: Latest IOS/OS X SSL security flaw billy@MIX.COM - 2014-02-25 17:34 +0000
Re: Latest IOS/OS X SSL security flaw billy@MIX.COM - 2014-02-25 19:14 +0000
Re: Latest IOS/OS X SSL security flaw Paul Sture <nospam@sture.ch> - 2014-02-25 20:42 +0100
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-25 21:32 +0000
Re: Latest IOS/OS X SSL security flaw Ted Lee <tmplee@gmail.com> - 2014-02-25 17:12 -0600
Re: Latest IOS/OS X SSL security flaw Ted Lee <tmplee@gmail.com> - 2014-02-25 17:24 -0600
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-26 02:38 +0000
Re: Latest IOS/OS X SSL security flaw Ted Lee <tmplee@gmail.com> - 2014-02-25 21:03 -0600
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-26 04:19 +0000
Re: Latest IOS/OS X SSL security flaw "M. John Matlaw" <nouser@invalid.com> - 2014-02-28 11:29 -0500
Re: Latest IOS/OS X SSL security flaw Ted Lee <tmplee@gmail.com> - 2014-02-28 12:48 -0600
Re: Latest IOS/OS X SSL security flaw billy@MIX.COM - 2014-02-26 01:44 +0000
Re: Latest IOS/OS X SSL security flaw billy@MIX.COM - 2014-02-25 21:59 +0000
Re: Latest IOS/OS X SSL security flaw Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-02-24 22:33 +0000
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-24 23:13 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-24 17:45 -0500
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-24 23:17 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-24 18:28 -0500
Re: Latest IOS/OS X SSL security flaw JF Mezei <jfmezei.spamnot@vaxination.ca> - 2014-02-24 23:16 -0500
Re: Latest IOS/OS X SSL security flaw Don Bruder <dakidd@sonic.net> - 2014-02-24 21:17 -0800
Re: Latest IOS/OS X SSL security flaw Paul Sture <nospam@sture.ch> - 2014-02-25 21:03 +0100
Re: Latest IOS/OS X SSL security flaw Paul Sture <nospam@sture.ch> - 2014-02-25 21:00 +0100
Re: Latest IOS/OS X SSL security flaw billy@MIX.COM - 2014-02-25 22:02 +0000
Re: Latest IOS/OS X SSL security flaw Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-02-25 08:11 +0000
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-25 16:47 +0000
Re: Latest IOS/OS X SSL security flaw JF Mezei <jfmezei.spamnot@vaxination.ca> - 2014-02-25 17:03 -0500
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-25 19:45 -0500
Re: Latest IOS/OS X SSL security flaw JF Mezei <jfmezei.spamnot@vaxination.ca> - 2014-02-26 00:05 -0500
Re: Latest IOS/OS X SSL security flaw Paul Sture <nospam@sture.ch> - 2014-02-25 20:57 +0100
Re: Latest IOS/OS X SSL security flaw "M. John Matlaw" <nouser@invalid.com> - 2014-02-26 09:52 -0500
Re: Latest IOS/OS X SSL security flaw Paul Sture <nospam@sture.ch> - 2014-04-06 02:36 +0200
Re: Latest IOS/OS X SSL security flaw Paul Sture <nospam@sture.ch> - 2014-02-24 21:24 +0100
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-24 20:43 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-24 17:40 -0500
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-23 16:47 +0000
Re: Latest IOS/OS X SSL security flaw Don Bruder <dakidd@sonic.net> - 2014-02-23 15:37 -0800
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-23 20:08 -0500
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-24 01:15 +0000
Re: Latest IOS/OS X SSL security flaw Don Bruder <dakidd@sonic.net> - 2014-02-23 18:45 -0800
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-24 02:52 +0000
Re: Latest IOS/OS X SSL security flaw Don Bruder <dakidd@sonic.net> - 2014-02-23 19:01 -0800
Re: Latest IOS/OS X SSL security flaw Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-02-24 04:23 +0000
Re: Latest IOS/OS X SSL security flaw Paul Sture <nospam@sture.ch> - 2014-02-24 22:10 +0100
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-24 22:21 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-24 17:27 -0500
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-24 17:27 -0500
Re: Latest IOS/OS X SSL security flaw Don Bruder <dakidd@sonic.net> - 2014-02-24 21:05 -0800
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-25 19:34 -0500
Re: Latest IOS/OS X SSL security flaw Paul Sture <nospam@sture.ch> - 2014-02-24 21:58 +0100
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-24 18:04 -0500
Re: Latest IOS/OS X SSL security flaw billy@MIX.COM - 2014-02-25 02:44 +0000
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-24 01:14 +0000
Re: Latest IOS/OS X SSL security flaw Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-02-24 04:11 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-24 18:36 -0500
Re: Latest IOS/OS X SSL security flaw Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-02-25 08:20 +0000
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-25 17:00 +0000
Re: Latest IOS/OS X SSL security flaw Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-02-25 20:05 +0000
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-25 21:31 +0000
Re: Latest IOS/OS X SSL security flaw Don Bruder <dakidd@sonic.net> - 2014-02-25 19:13 -0800
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-26 04:35 +0000
Re: Latest IOS/OS X SSL security flaw billy@MIX.COM - 2014-02-26 06:42 +0000
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-03-01 21:57 +0000
Re: Latest IOS/OS X SSL security flaw Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-02-26 23:29 +0000
Re: Latest IOS/OS X SSL security flaw Walter Bushell <proto@panix.com> - 2014-04-13 15:06 -0400
Re: Latest IOS/OS X SSL security flaw Tom Stiller <clusterfux.upmon@gmail.com> - 2014-04-13 21:11 +0000
Re: Latest IOS/OS X SSL security flaw Walter Bushell <proto@panix.com> - 2014-04-15 17:03 -0400
Re: Latest IOS/OS X SSL security flaw Your Name <YourName@YourISP.com> - 2014-04-16 09:29 +1200
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-25 19:29 -0500
Re: Latest IOS/OS X SSL security flaw Bill Findlay <yaldnif.w@blueyonder.co.uk> - 2014-02-26 00:49 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-25 19:59 -0500
Re: Latest IOS/OS X SSL security flaw Bill Findlay <yaldnif.w@blueyonder.co.uk> - 2014-02-26 02:03 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-25 22:13 -0500
Re: Latest IOS/OS X SSL security flaw Bill Findlay <yaldnif.w@blueyonder.co.uk> - 2014-02-26 14:03 +0000
Re: Latest IOS/OS X SSL security flaw Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-02-26 23:42 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-27 17:03 -0500
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-26 02:47 +0000
Re: Latest IOS/OS X SSL security flaw JF Mezei <jfmezei.spamnot@vaxination.ca> - 2014-02-26 00:10 -0500
Re: Latest IOS/OS X SSL security flaw Walter Bushell <proto@panix.com> - 2014-04-13 15:11 -0400
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-04-13 15:43 -0400
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-26 02:42 +0000
Re: Latest IOS/OS X SSL security flaw Walter Bushell <proto@panix.com> - 2014-04-13 15:08 -0400
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-04-13 15:41 -0400
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-25 19:18 -0500
Re: Latest IOS/OS X SSL security flaw Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-02-26 23:39 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-27 17:09 -0500
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-23 13:03 -0500
Re: Latest IOS/OS X SSL security flaw Bill Findlay <yaldnif.w@blueyonder.co.uk> - 2014-02-23 01:32 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-23 10:07 -0500
Re: Latest IOS/OS X SSL security flaw Paul Sture <nospam@sture.ch> - 2014-04-06 02:44 +0200
Re: Latest IOS/OS X SSL security flaw JF Mezei <jfmezei.spamnot@vaxination.ca> - 2014-02-22 17:49 -0500
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-22 19:07 -0500
Re: Latest IOS/OS X SSL security flaw JF Mezei <jfmezei.spamnot@vaxination.ca> - 2014-02-22 22:23 -0500
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-23 03:49 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-23 10:12 -0500
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-23 16:42 +0000
Re: Latest IOS/OS X SSL security flaw nospam <nospam@nospam.invalid> - 2014-02-23 14:38 -0500
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-23 10:11 -0500
Re: Latest IOS/OS X SSL security flaw nospam <nospam@nospam.invalid> - 2014-02-23 14:38 -0500
Re: Latest IOS/OS X SSL security flaw Jim Gibson <jimsgibson@gmail.com> - 2014-02-24 10:42 -0800
Re: Latest IOS/OS X SSL security flaw JF Mezei <jfmezei.spamnot@vaxination.ca> - 2014-02-24 17:07 -0500
Re: Latest IOS/OS X SSL security flaw Kevin McMurtrie <mcmurtrie@pixelmemory.us> - 2014-02-22 23:01 -0800
Re: Latest IOS/OS X SSL security flaw nospam <nospam@nospam.invalid> - 2014-02-23 14:38 -0500
Re: Latest IOS/OS X SSL security flaw billy@MIX.COM - 2014-02-24 01:46 +0000
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-03-01 21:52 +0000
Re: Latest IOS/OS X SSL security flaw nospam <nospam@nospam.invalid> - 2014-03-02 00:05 -0500
Re: Latest IOS/OS X SSL security flaw Paul Sture <nospam@sture.ch> - 2014-02-24 22:24 +0100
Re: Latest IOS/OS X SSL security flaw mcarels@xs4all.nl (Maarten Carels) - 2014-02-24 10:43 +0100
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-24 18:39 -0500
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-24 19:16 -0500
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-22 14:18 -0500
Re: Latest IOS/OS X SSL security flaw Tim McNamara <timmcn@bitstream.net> - 2014-02-22 13:43 -0600
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-22 14:52 -0500
Re: Latest IOS/OS X SSL security flaw Richard Kettlewell <rjk@greenend.org.uk> - 2014-02-22 20:05 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-22 15:16 -0500
Re: Latest IOS/OS X SSL security flaw Richard Kettlewell <rjk@greenend.org.uk> - 2014-02-22 21:10 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-22 16:25 -0500
Re: Latest IOS/OS X SSL security flaw Richard Kettlewell <rjk@greenend.org.uk> - 2014-02-22 22:13 +0000
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-22 22:19 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-22 18:55 -0500
Re: Latest IOS/OS X SSL security flaw Richard Kettlewell <rjk@greenend.org.uk> - 2014-02-23 09:38 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-23 10:17 -0500
Re: Latest IOS/OS X SSL security flaw Richard Kettlewell <rjk@greenend.org.uk> - 2014-02-23 15:42 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-23 10:45 -0500
Re: Latest IOS/OS X SSL security flaw Richard Kettlewell <rjk@greenend.org.uk> - 2014-02-23 17:09 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-23 13:51 -0500
Re: Latest IOS/OS X SSL security flaw Richard Kettlewell <rjk@greenend.org.uk> - 2014-02-23 20:07 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-23 15:14 -0500
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-23 15:20 -0500
Re: Latest IOS/OS X SSL security flaw billy@MIX.COM - 2014-02-24 02:18 +0000
Re: Latest IOS/OS X SSL security flaw JF Mezei <jfmezei.spamnot@vaxination.ca> - 2014-02-22 17:51 -0500
Re: Latest IOS/OS X SSL security flaw nospam <nospam@nospam.invalid> - 2014-02-22 17:55 -0500
Re: Latest IOS/OS X SSL security flaw Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-02-22 21:50 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-22 19:09 -0500
Re: Latest IOS/OS X SSL security flaw Alan Baker <alangbaker@telus.net> - 2014-02-22 12:35 -0800
Re: Latest IOS/OS X SSL security flaw nospam <nospam@nospam.invalid> - 2014-02-22 16:59 -0500
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-22 22:14 +0000
Re: Latest IOS/OS X SSL security flaw nospam <nospam@nospam.invalid> - 2014-02-22 17:53 -0500
Re: Latest IOS/OS X SSL security flaw JF Mezei <jfmezei.spamnot@vaxination.ca> - 2014-02-22 18:01 -0500
Re: Latest IOS/OS X SSL security flaw nospam <nospam@nospam.invalid> - 2014-02-22 18:22 -0500
Re: Latest IOS/OS X SSL security flaw nospam <nospam@nospam.invalid> - 2014-02-22 18:29 -0500
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-22 23:33 +0000
Re: Latest IOS/OS X SSL security flaw nospam <nospam@nospam.invalid> - 2014-02-23 18:23 -0500
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-24 01:08 +0000
Re: Latest IOS/OS X SSL security flaw Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-02-22 21:49 +0000
Re: Latest IOS/OS X SSL security flaw Kevin McMurtrie <mcmurtrie@pixelmemory.us> - 2014-02-22 22:57 -0800
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-23 16:36 +0000
Re: Latest IOS/OS X SSL security flaw Alan Browne <alan.browne@FreelunchVideotron.ca> - 2014-02-23 11:58 -0500
Re: Latest IOS/OS X SSL security flaw nospam <nospam@nospam.invalid> - 2014-02-23 14:35 -0500
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-23 21:03 +0000
Re: Latest IOS/OS X SSL security flaw nospam <nospam@nospam.invalid> - 2014-02-23 18:23 -0500
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-02-24 01:07 +0000
Re: Latest IOS/OS X SSL security flaw billy@MIX.COM - 2014-02-24 01:53 +0000
Re: Latest IOS/OS X SSL security flaw Jolly Roger <jollyroger@pobox.com> - 2014-03-01 21:53 +0000
Page 9 of 10 — ← Prev page 1 … 7 8 [9] 10 Next page →
| From | Richard Kettlewell <rjk@greenend.org.uk> |
|---|---|
| Date | 2014-02-22 22:13 +0000 |
| Message-ID | <wwvha7q3ifb.fsf@l1AntVDjLrnP7Td3DQJ8ynzIq3lJMueXf87AxnpFoA.invalid> |
| In reply to | #56848 |
Alan Browne <alan.browne@FreelunchVideotron.ca> writes: > Richard Kettlewell wrote: >> Alan Browne <alan.browne@FreelunchVideotron.ca> writes: >>> The word "only" is not required to keep that sentence restrained to >>> the case described. And logically, to be MitM, one has to be "inside" >>> the router/WiFi firewall. >> >> MITM refers to an attacker capable of reading, deleting, modifying and >> synthesizing messages between legitimate actors. See, for instance, >> s3.1 of Applied Cryptography for more detail. It is not limited to any >> particular network configuration. > > Fair enough. OTOH It's pretty clear in this case that the MitM has to > within your network. The opposite is clear. I’ve listed several possible mechanisms for actually carrying out the MITM element in a previous post. They are not speculation. As just one example, see: http://www.renesys.com/2013/11/mitm-internet-hijacking/ for multiple recent observations of BGP-based active interception. -- http://www.greenend.org.uk/rjk/
[toc] | [prev] | [next] | [standalone]
| From | Jolly Roger <jollyroger@pobox.com> |
|---|---|
| Date | 2014-02-22 22:19 +0000 |
| Message-ID | <bmsm46Fn3b4U4@mid.individual.net> |
| In reply to | #56857 |
On 2014-02-22, Richard Kettlewell <rjk@greenend.org.uk> wrote: > Alan Browne <alan.browne@FreelunchVideotron.ca> writes: >> Richard Kettlewell wrote: >>> Alan Browne <alan.browne@FreelunchVideotron.ca> writes: >>>> The word "only" is not required to keep that sentence restrained to >>>> the case described. And logically, to be MitM, one has to be "inside" >>>> the router/WiFi firewall. >>> >>> MITM refers to an attacker capable of reading, deleting, modifying and >>> synthesizing messages between legitimate actors. See, for instance, >>> s3.1 of Applied Cryptography for more detail. It is not limited to any >>> particular network configuration. >> >> Fair enough. OTOH It's pretty clear in this case that the MitM has to >> within your network. > > The opposite is clear. I’ve listed several possible mechanisms for > actually carrying out the MITM element in a previous post. They are not > speculation. As just one example, see: > http://www.renesys.com/2013/11/mitm-internet-hijacking/ > for multiple recent observations of BGP-based active interception. Great writeup. Thanks. -- E-mail sent to this address may be devoured by my ravenous SPAM filter. I often ignore posts from Google. Use a real news client instead. JR
[toc] | [prev] | [next] | [standalone]
| From | Alan Browne <alan.browne@FreelunchVideotron.ca> |
|---|---|
| Date | 2014-02-22 18:55 -0500 |
| Message-ID | <XOmdnYHoGIdppZTOnZ2dnUVZ_q-dnZ2d@giganews.com> |
| In reply to | #56857 |
On 2014.02.22, 17:13 , Richard Kettlewell wrote:
> Alan Browne <alan.browne@FreelunchVideotron.ca> writes:
>> Richard Kettlewell wrote:
>>> Alan Browne <alan.browne@FreelunchVideotron.ca> writes:
>>>> The word "only" is not required to keep that sentence restrained to
>>>> the case described. And logically, to be MitM, one has to be "inside"
>>>> the router/WiFi firewall.
>>>
>>> MITM refers to an attacker capable of reading, deleting, modifying and
>>> synthesizing messages between legitimate actors. See, for instance,
>>> s3.1 of Applied Cryptography for more detail. It is not limited to any
>>> particular network configuration.
>>
>> Fair enough. OTOH It's pretty clear in this case that the MitM has to
>> within your network.
>
> The opposite is clear. I’ve listed several possible mechanisms for
> actually carrying out the MITM element in a previous post. They are not
> speculation. As just one example, see:
> http://www.renesys.com/2013/11/mitm-internet-hijacking/
> for multiple recent observations of BGP-based active interception.
You've got my attention. So, how do those relate to the bug at hand?
--
... it may be that "in the cloud" really isn't the best term
for the services these companies offer. What they really
want is to have us "on the leash."
-David Pogue, Scientific American, 2014.02
[toc] | [prev] | [next] | [standalone]
| From | Richard Kettlewell <rjk@greenend.org.uk> |
|---|---|
| Date | 2014-02-23 09:38 +0000 |
| Message-ID | <wwvzjli183x.fsf@l1AntVDjLrnP7Td3DQJ8ynzIq3lJMueXf87AxnpFoA.invalid> |
| In reply to | #56869 |
Alan Browne <alan.browne@FreelunchVideotron.ca> writes: > Richard Kettlewell wrote: >> The opposite is clear. I’ve listed several possible mechanisms for >> actually carrying out the MITM element in a previous post. They are not >> speculation. As just one example, see: >> http://www.renesys.com/2013/11/mitm-internet-hijacking/ >> for multiple recent observations of BGP-based active interception. > > You've got my attention. So, how do those relate to the bug at hand? 1. The bug is that signatures on server key exchange messages are not checked. 2. An attacker who can arrange that a client is talking to their server, rather than the real one, will therefore go undetected. 3. To achieve this the attacker needs to be able to redirect your communication to and from the real server to their substitute. 4. Redirecting traffic via bogus BGP announcements, as described above, is one method of achieving this (it’s far from the only one). -- http://www.greenend.org.uk/rjk/
[toc] | [prev] | [next] | [standalone]
| From | Alan Browne <alan.browne@FreelunchVideotron.ca> |
|---|---|
| Date | 2014-02-23 10:17 -0500 |
| Message-ID | <cvOdnVhPPKmHjJfOnZ2dnUVZ_rGdnZ2d@giganews.com> |
| In reply to | #56886 |
On 2014.02.23, 04:38 , Richard Kettlewell wrote:
> 1. The bug is that signatures on server key exchange messages are not
> checked.
>
> 2. An attacker who can arrange that a client is talking to their server,
> rather than the real one, will therefore go undetected.
>
> 3. To achieve this the attacker needs to be able to redirect your
> communication to and from the real server to their substitute.
>
> 4. Redirecting traffic via bogus BGP announcements, as described above,
> is one method of achieving this (it’s far from the only one).
I'm not convinced that that allows one to inject from outside ones own
network as the router firewalls should also be rejecting.
--
Those who have reduced our privacy, whether they are state
or commercial actors, prefer that we do not reduce theirs.
- Jaron Lanier, Scientific American, 2013.11.
[toc] | [prev] | [next] | [standalone]
| From | Richard Kettlewell <rjk@greenend.org.uk> |
|---|---|
| Date | 2014-02-23 15:42 +0000 |
| Message-ID | <wwvr46t25v0.fsf@l1AntVDjLrnP7Td3DQJ8ynzIq3lJMueXf87AxnpFoA.invalid> |
| In reply to | #56892 |
Alan Browne <alan.browne@FreelunchVideotron.ca> writes: > Richard Kettlewell wrote: >> 1. The bug is that signatures on server key exchange messages are not >> checked. >> >> 2. An attacker who can arrange that a client is talking to their server, >> rather than the real one, will therefore go undetected. >> >> 3. To achieve this the attacker needs to be able to redirect your >> communication to and from the real server to their substitute. >> >> 4. Redirecting traffic via bogus BGP announcements, as described above, >> is one method of achieving this (it’s far from the only one). > > I'm not convinced that that allows one to inject from outside ones own > network as the router firewalls should also be rejecting. Have another look at the renesys article, the redirection happens whether or not you personally believe in it. -- http://www.greenend.org.uk/rjk/
[toc] | [prev] | [next] | [standalone]
| From | Alan Browne <alan.browne@FreelunchVideotron.ca> |
|---|---|
| Date | 2014-02-23 10:45 -0500 |
| Message-ID | <3Y6dnbVSqIEHipfOnZ2dnUVZ_vOdnZ2d@giganews.com> |
| In reply to | #56893 |
On 2014.02.23, 10:42 , Richard Kettlewell wrote:
> Alan Browne <alan.browne@FreelunchVideotron.ca> writes:
>> Richard Kettlewell wrote:
>
>>> 1. The bug is that signatures on server key exchange messages are not
>>> checked.
>>>
>>> 2. An attacker who can arrange that a client is talking to their server,
>>> rather than the real one, will therefore go undetected.
>>>
>>> 3. To achieve this the attacker needs to be able to redirect your
>>> communication to and from the real server to their substitute.
>>>
>>> 4. Redirecting traffic via bogus BGP announcements, as described above,
>>> is one method of achieving this (it’s far from the only one).
>>
>> I'm not convinced that that allows one to inject from outside ones own
>> network as the router firewalls should also be rejecting.
>
> Have another look at the renesys article, the redirection happens
> whether or not you personally believe in it.
It's the connection to the bug at issue that I'm not convinced about.
Anyway, end of this little thread for me.
--
Privacy has become an essential personal chore that most
people are not trained to perform.
- Jaron Lanier, Scientific American, 2013.11.
[toc] | [prev] | [next] | [standalone]
| From | Richard Kettlewell <rjk@greenend.org.uk> |
|---|---|
| Date | 2014-02-23 17:09 +0000 |
| Message-ID | <wwvios521sy.fsf@l1AntVDjLrnP7Td3DQJ8ynzIq3lJMueXf87AxnpFoA.invalid> |
| In reply to | #56894 |
Alan Browne <alan.browne@FreelunchVideotron.ca> writes: > On 2014.02.23, 10:42 , Richard Kettlewell wrote: >> Alan Browne <alan.browne@FreelunchVideotron.ca> writes: >>> Richard Kettlewell wrote: >>>> 1. The bug is that signatures on server key exchange messages are not >>>> checked. >>>> >>>> 2. An attacker who can arrange that a client is talking to their server, >>>> rather than the real one, will therefore go undetected. >>>> >>>> 3. To achieve this the attacker needs to be able to redirect your >>>> communication to and from the real server to their substitute. >>>> >>>> 4. Redirecting traffic via bogus BGP announcements, as described above, >>>> is one method of achieving this (it’s far from the only one). >>> >>> I'm not convinced that that allows one to inject from outside ones own >>> network as the router firewalls should also be rejecting. >> >> Have another look at the renesys article, the redirection happens >> whether or not you personally believe in it. > > It's the connection to the bug at issue that I'm not convinced about. I urge you to revisit that article. If you don’t see the connection then you have not fully understood it. Your router cannot detect this redirection because there is no difference between forged and legitimate packets. -- http://www.greenend.org.uk/rjk/
[toc] | [prev] | [next] | [standalone]
| From | Alan Browne <alan.browne@FreelunchVideotron.ca> |
|---|---|
| Date | 2014-02-23 13:51 -0500 |
| Message-ID | <ffidnewCz4_V3pfOnZ2dnUVZ_sadnZ2d@giganews.com> |
| In reply to | #56904 |
On 2014.02.23, 12:09 , Richard Kettlewell wrote:
> Alan Browne <alan.browne@FreelunchVideotron.ca> writes:
>> On 2014.02.23, 10:42 , Richard Kettlewell wrote:
>>> Alan Browne <alan.browne@FreelunchVideotron.ca> writes:
>>>> Richard Kettlewell wrote:
>>>>> 1. The bug is that signatures on server key exchange messages are not
>>>>> checked.
>>>>>
>>>>> 2. An attacker who can arrange that a client is talking to their server,
>>>>> rather than the real one, will therefore go undetected.
>>>>>
>>>>> 3. To achieve this the attacker needs to be able to redirect your
>>>>> communication to and from the real server to their substitute.
>>>>>
>>>>> 4. Redirecting traffic via bogus BGP announcements, as described above,
>>>>> is one method of achieving this (it’s far from the only one).
>>>>
>>>> I'm not convinced that that allows one to inject from outside ones own
>>>> network as the router firewalls should also be rejecting.
>>>
>>> Have another look at the renesys article, the redirection happens
>>> whether or not you personally believe in it.
>>
>> It's the connection to the bug at issue that I'm not convinced about.
>
> I urge you to revisit that article. If you don’t see the connection
> then you have not fully understood it. Your router cannot detect this
> redirection because there is no difference between forged and legitimate
> packets.
Well, reread it.
1) No stated connection to Apple code (OS X or iOS) at all. eg: the
packets they were watching could have been for any OS.
2) QUOTE What’s not known is the exact mechanism, ... END QUOTE.
3) QUOTE Until the day when all routes are signed and secured (and that
day may never fully arrive), the best way to prevent manipulation of
trust-based routing will be ..."
So I'm still out on a limb connecting the bug discussed and the article
linked.
(The article is very interesting, to be sure, esp. the on/offagainness
over a long period).
--
Those who have reduced our privacy, whether they are state
or commercial actors, prefer that we do not reduce theirs.
- Jaron Lanier, Scientific American, 2013.11.
Privacy has become an essential personal chore that most
people are not trained to perform.
- Jaron Lanier, Scientific American, 2013.11.
... it may be that "in the cloud" really isn't the best term
for the services these companies offer. What they really
want is to have us "on the leash."
-David Pogue, Scientific American, 2014.02
[toc] | [prev] | [next] | [standalone]
| From | Richard Kettlewell <rjk@greenend.org.uk> |
|---|---|
| Date | 2014-02-23 20:07 +0000 |
| Message-ID | <wwvd2id1tl7.fsf@l1AntVDjLrnP7Td3DQJ8ynzIq3lJMueXf87AxnpFoA.invalid> |
| In reply to | #56912 |
Alan Browne <alan.browne@FreelunchVideotron.ca> writes: > On 2014.02.23, 12:09 , Richard Kettlewell wrote: >> Alan Browne <alan.browne@FreelunchVideotron.ca> writes: >>> It's the connection to the bug at issue that I'm not convinced about. >> >> I urge you to revisit that article. If you don’t see the connection >> then you have not fully understood it. Your router cannot etect this >> redirection because there is no difference between forged and legitimate >> packets. > > Well, reread it. > > 1) No stated connection to Apple code (OS X or iOS) at all. eg: the > packets they were watching could have been for any OS. Indeed, it’s a general mechanism for redirecting traffic. See previous articles for its relevance to this bug. > 2) QUOTE What’s not known is the exact mechanism, ... END QUOTE. Mechanism isn’t particularly relevant here, only the effect. > 3) QUOTE Until the day when all routes are signed and secured (and > that day may never fully arrive), the best way to prevent manipulation > of trust-based routing will be ..." > > So I'm still out on a limb connecting the bug discussed and the > article linked. I’m losing the will to live here. -- http://www.greenend.org.uk/rjk/
[toc] | [prev] | [next] | [standalone]
| From | Alan Browne <alan.browne@FreelunchVideotron.ca> |
|---|---|
| Date | 2014-02-23 15:14 -0500 |
| Message-ID | <CP-dnX3pk-01y5fOnZ2dnUVZ_oadnZ2d@giganews.com> |
| In reply to | #56918 |
On 2014.02.23, 15:07 , Richard Kettlewell wrote:
> Alan Browne <alan.browne@FreelunchVideotron.ca> writes:
>> On 2014.02.23, 12:09 , Richard Kettlewell wrote:
>>> Alan Browne <alan.browne@FreelunchVideotron.ca> writes:
>
>>>> It's the connection to the bug at issue that I'm not convinced about.
>>>
>>> I urge you to revisit that article. If you don’t see the connection
>>> then you have not fully understood it. Your router cannot etect this
>>> redirection because there is no difference between forged and legitimate
>>> packets.
>>
>> Well, reread it.
>>
>> 1) No stated connection to Apple code (OS X or iOS) at all. eg: the
>> packets they were watching could have been for any OS.
>
> Indeed, it’s a general mechanism for redirecting traffic. See previous
> articles for its relevance to this bug.
>
>> 2) QUOTE What’s not known is the exact mechanism, ... END QUOTE.
>
> Mechanism isn’t particularly relevant here, only the effect.
>
>> 3) QUOTE Until the day when all routes are signed and secured (and
>> that day may never fully arrive), the best way to prevent manipulation
>> of trust-based routing will be ..."
>>
>> So I'm still out on a limb connecting the bug discussed and the
>> article linked.
>
> I’m losing the will to live here.
Have a safe passage to the other side.
--
Those who have reduced our privacy, whether they are state
or commercial actors, prefer that we do not reduce theirs.
- Jaron Lanier, Scientific American, 2013.11.
[toc] | [prev] | [next] | [standalone]
| From | Alan Browne <alan.browne@FreelunchVideotron.ca> |
|---|---|
| Date | 2014-02-23 15:20 -0500 |
| Message-ID | <CP-dnXzpk-2TxZfOnZ2dnUVZ_oadnZ2d@giganews.com> |
| In reply to | #56918 |
On 2014.02.23, 15:07 , Richard Kettlewell wrote:
> Alan Browne <alan.browne@FreelunchVideotron.ca> writes:
>> On 2014.02.23, 12:09 , Richard Kettlewell wrote:
>>> Alan Browne <alan.browne@FreelunchVideotron.ca> writes:
>
>>>> It's the connection to the bug at issue that I'm not convinced about.
>>>
>>> I urge you to revisit that article. If you don’t see the connection
>>> then you have not fully understood it. Your router cannot etect this
>>> redirection because there is no difference between forged and legitimate
>>> packets.
>>
>> Well, reread it.
>>
>> 1) No stated connection to Apple code (OS X or iOS) at all. eg: the
>> packets they were watching could have been for any OS.
>
> Indeed, it’s a general mechanism for redirecting traffic. See previous
> articles for its relevance to this bug.
>
>> 2) QUOTE What’s not known is the exact mechanism, ... END QUOTE.
>
> Mechanism isn’t particularly relevant here, only the effect.
>
>> 3) QUOTE Until the day when all routes are signed and secured (and
>> that day may never fully arrive), the best way to prevent manipulation
>> of trust-based routing will be ..."
>>
>> So I'm still out on a limb connecting the bug discussed and the
>> article linked.
>
> I’m losing the will to live here.
You've shown no direct connection between the two. At all.
--
... it may be that "in the cloud" really isn't the best term
for the services these companies offer. What they really
want is to have us "on the leash."
-David Pogue, Scientific American, 2014.02
[toc] | [prev] | [next] | [standalone]
| From | billy@MIX.COM |
|---|---|
| Date | 2014-02-24 02:18 +0000 |
| Message-ID | <leea6g$4jt$2@reader2.panix.com> |
| In reply to | #56912 |
Alan Browne <alan.browne@freelunchvideotron.ca> writes:
> So I'm still out on a limb connecting the bug discussed and the article
> linked.
The article simply describes one way to exploit the bug. And, of course,
the article shows that this sort of thing is being done.
Billy Y..
--
sub #'9+1 ,r0 ; convert ascii byte
add #9.+1 ,r0 ; to an integer
bcc 20$ ; not a number
[toc] | [prev] | [next] | [standalone]
| From | JF Mezei <jfmezei.spamnot@vaxination.ca> |
|---|---|
| Date | 2014-02-22 17:51 -0500 |
| Message-ID | <530929f0$0$9676$c3e8da3$aae71a0a@news.astraweb.com> |
| In reply to | #56841 |
On 14-02-22 15:16, Alan Browne wrote: > The word "only" is not required to keep that sentence restrained to the > case described. And logically, to be MitM, one has to be "inside" the > router/WiFi firewall. Or be the NSA, GCHQ CSEC and all the other privacy invading agencies that capture as much internet traffic as they can. Imagine if this bug was put in by NSA ?
[toc] | [prev] | [next] | [standalone]
| From | nospam <nospam@nospam.invalid> |
|---|---|
| Date | 2014-02-22 17:55 -0500 |
| Message-ID | <220220141755504410%nospam@nospam.invalid> |
| In reply to | #56862 |
In article <530929f0$0$9676$c3e8da3$aae71a0a@news.astraweb.com>, JF Mezei <jfmezei.spamnot@vaxination.ca> wrote: > Imagine if this bug was put in by NSA ? already been suggested, although not by the nsa: <https://twitter.com/i0n1c/status/437185572856430592>
[toc] | [prev] | [next] | [standalone]
| From | Lewis <g.kreme@gmail.com.dontsendmecopies> |
|---|---|
| Date | 2014-02-22 21:50 +0000 |
| Message-ID | <slrnlgi6s9.22tr.g.kreme@oswin.local> |
| In reply to | #56835 |
In message <QYOdnZ14PrOOZZXOnZ2dnUVZ_t-dnZ2d@giganews.com> Alan Browne <alan.browne@FreelunchVideotron.ca> wrote: > On 2014.02.22, 13:56 , Ted Lee wrote: >> The press and gossip rag reports say the recently discovered security >> flaw with SSL is present in both IOS and OS X. The patch for IOS showed >> up last night. The reports say the OS X one will be out soon. Has >> anyone run across a technically competent (as opposed to sensationalized >> fear-mongering amateur drivel) discussion of the flaw *and* a conclusive >> statement that it is indeed present in OS X? Given Apple's policy of >> not discussing or acknowledging security flaws until a patch is >> available, I have to wonder if the flaw is in fact present in OS X -- >> for, if it were, wouldn't they wait to release anything (including a >> fix) about it until the patch was available for both? > http://9to5mac.com/ has a writeup on it (quoting Crowdstrike). May not > be deep enough for you. > The key thing is the exploit is on the near side of your router firewall > so unless you think junior is attacking from the basement I don't think > there's much to worry about. (I'll assume you're using WPA2 with a > non-trivial shared secret, or better). > QUOTE > To pull off the attack an adversary has to be able to Man-in-The-Middle > (MitM) network connections, which can be done if they are present on the > same wired or wireless network as the victim. > ENDQUOTE The Hacker, he's calling from inside the house! -- "Thank you for sending me a copy of your book; I'll waste no time reading it." - Moses Hadas
[toc] | [prev] | [next] | [standalone]
| From | Alan Browne <alan.browne@FreelunchVideotron.ca> |
|---|---|
| Date | 2014-02-22 19:09 -0500 |
| Message-ID | <L-SdnaXB-Z2uoZTOnZ2dnUVZ_uKdnZ2d@giganews.com> |
| In reply to | #56853 |
On 2014.02.22, 16:50 , Lewis wrote:
> In message <QYOdnZ14PrOOZZXOnZ2dnUVZ_t-dnZ2d@giganews.com>
> Alan Browne <alan.browne@FreelunchVideotron.ca> wrote:
>> On 2014.02.22, 13:56 , Ted Lee wrote:
>>> The press and gossip rag reports say the recently discovered security
>>> flaw with SSL is present in both IOS and OS X. The patch for IOS showed
>>> up last night. The reports say the OS X one will be out soon. Has
>>> anyone run across a technically competent (as opposed to sensationalized
>>> fear-mongering amateur drivel) discussion of the flaw *and* a conclusive
>>> statement that it is indeed present in OS X? Given Apple's policy of
>>> not discussing or acknowledging security flaws until a patch is
>>> available, I have to wonder if the flaw is in fact present in OS X --
>>> for, if it were, wouldn't they wait to release anything (including a
>>> fix) about it until the patch was available for both?
>
>> http://9to5mac.com/ has a writeup on it (quoting Crowdstrike). May not
>> be deep enough for you.
>
>> The key thing is the exploit is on the near side of your router firewall
>> so unless you think junior is attacking from the basement I don't think
>> there's much to worry about. (I'll assume you're using WPA2 with a
>> non-trivial shared secret, or better).
>
>> QUOTE
>> To pull off the attack an adversary has to be able to Man-in-The-Middle
>> (MitM) network connections, which can be done if they are present on the
>> same wired or wireless network as the victim.
>> ENDQUOTE
>
> The Hacker, he's calling from inside the house!
I used to leave dirty messages on my neighbor's laptop public folder
until they sorted out their router. Now she complains that I don't
write, I don't call...
--
Privacy has become an essential personal chore that most
people are not trained to perform.
- Jaron Lanier, Scientific American, 2013.11.
[toc] | [prev] | [next] | [standalone]
| From | Alan Baker <alangbaker@telus.net> |
|---|---|
| Date | 2014-02-22 12:35 -0800 |
| Message-ID | <leb1m4$dh8$1@news.datemas.de> |
| In reply to | #56833 |
On 2014-02-22 18:56:10 +0000, Ted Lee said: > The press and gossip rag reports say the recently discovered security > flaw with SSL is present in both IOS and OS X. The patch for IOS > showed up last night. The reports say the OS X one will be out soon. > Has anyone run across a technically competent (as opposed to > sensationalized fear-mongering amateur drivel) discussion of the flaw > *and* a conclusive statement that it is indeed present in OS X? Given > Apple's policy of not discussing or acknowledging security flaws until > a patch is available, I have to wonder if the flaw is in fact present > in OS X -- for, if it were, wouldn't they wait to release anything > (including a fix) about it until the patch was available for both? Yup. Here: <https://www.imperialviolet.org/2014/02/22/applebug.html> It would seem that the bug is a single extra "goto" which is not inside the "if" that precedes it.
[toc] | [prev] | [next] | [standalone]
| From | nospam <nospam@nospam.invalid> |
|---|---|
| Date | 2014-02-22 16:59 -0500 |
| Message-ID | <220220141659492743%nospam@nospam.invalid> |
| In reply to | #56842 |
In article <leb1m4$dh8$1@news.datemas.de>, Alan Baker <alangbaker@telus.net> wrote: > <https://www.imperialviolet.org/2014/02/22/applebug.html> > > It would seem that the bug is a single extra "goto" which is not inside > the "if" that precedes it. the problem is that there is no 'if' that precedes it. there are two gotos in a row, so it will always 'go to'. that's bad.
[toc] | [prev] | [next] | [standalone]
| From | Jolly Roger <jollyroger@pobox.com> |
|---|---|
| Date | 2014-02-22 22:14 +0000 |
| Message-ID | <bmslqmFn3b4U1@mid.individual.net> |
| In reply to | #56856 |
On 2014-02-22, nospam <nospam@nospam.invalid> wrote: > In article <leb1m4$dh8$1@news.datemas.de>, Alan Baker ><alangbaker@telus.net> wrote: > >> <https://www.imperialviolet.org/2014/02/22/applebug.html> >> >> It would seem that the bug is a single extra "goto" which is not inside >> the "if" that precedes it. > > the problem is that there is no 'if' that precedes it. LOL! mr.know-it-all always knows better than everyone and has to correct you even when you weren't wrong! Of course for him to be right, we must re-define the word "precede" to mean "immediately precede" rather than what the word actually means: to come before. Anyone with half a brain cell knows you meant "to come before" and there most certainly *is* an if before the errant goto statement, which is clear to see. What you said is factually correct, Alan. Because the author chose not to use curly braces in the if block, only the very first goto statement is included in the if clause, and the second goto statement is effectively outside of the if clause. -- E-mail sent to this address may be devoured by my ravenous SPAM filter. I often ignore posts from Google. Use a real news client instead. JR
[toc] | [prev] | [next] | [standalone]
Page 9 of 10 — ← Prev page 1 … 7 8 [9] 10 Next page →
Back to top | Article view | comp.sys.mac.system
csiph-web