Slashdot Mirror
Apple Finally Removes DigiNotar Certs In Safari
Trailrunner7 writes "Apple has finally released a fix for the certificate trust issue caused by the attack on DigiNotar, more than a week after the fraudulent certificates were identified and other browser vendors moved to revoke trust in them. While Microsoft, Mozilla and Google had been communicating with users about the issue and pushing out new versions and updates to eliminate the compromised certificate authorities from their browsers, Apple had been mum about the attack and hadn't given any indication of when it might issue an update for Safari. On Friday the company published a security advisory for Mac OS X users, saying that it was removing DigiNotar's certificates from its trust list."
Yeah, curse those MAC addresses!
Oh, wait, I'm sorry, you're just another retard that capitalizes the whole word instead of the first letter. It's a proper noun, not an acronym, you dimwit.
So, it took them 1 week to come out with an update to patch their browser? That doesn't seem an egregious delay to me. I haven't yet patched any of my other browsers yet. I'd be surprised if most users patch within the week of bugfix releases anyway.
And if I understand it, this "security hole" is basically that you won't get bad-certificate warnings if you visit certain fraudulent sites... which isn't likely to happen unless you're clicking links in phishing emails.
This hyperbole about apple being slow seems like hot air to me.
I just applied the fix and now I have to restart my Mac. What the hell? Is my MacBook masquerading as a Windows machine all of the sudden?
It just works. After a slight delay.
Diginotar was just the beginning of the reports, but truth is, CAs have been broken for a long time and SSL sessions that depend on CA certs are useless. A couple weeks ago, there was a handy how-to page to show how you can go into Mac OS X's keychain to reject Diginotar... one CA entry down, but several hundred others. If you think the NSA, Mossad, MI6, and fifty other countries haven't slipped MitM SSL boxes on various trunks hoping to score a session depending on these CAs, you're deluded.
[
Except of course when they don't. When you create a culture of careless idiots by making them think they are invulnerable to any threats this is the only way to handle them.
Care to explain how this is a case of Macs not "just working"? Or how may "careless idiots" were adversely affected by this?
This looks like simple mindless anti-Apple trolling.
If they just came out and said "Yeah we got screwed too" they might have some credibility, but instead they have to act like something like this doesn't actually affect them and quietly sweep the dirt under the rug.
"Got screwed"? How, exactly? This is exactly how the system is supposed to work.
On the other hand of that is the legion of careless users that are made even more careless because they have been given the false belief that they are impervious to any kind of cyber threat. If they just said "Yeah all that 'most secure' stuff we've been telling you is utter nonsense" then they might lose a moron or two to the competition.
So, where are all the infected Macs? And where are all these people who say Macs are "impervious to any kind of cyber threat"? Straw men don't count, I'm talking about actual human beings.
The problem with you anti-Apple trolls is that you rail against an imagined Mac user being screwed over by an imagined Apple, neither of which *actually* exist. Apple isn't evil, Mac users aren't idiots. There are millions of highly intelligent, technologically adept people who use and prefer Macs. What's so difficult to understand about this? Just because a smart person likes a system you don't like, that's not an affront to you. There are smart people who happily use Macs, Windows, Linux...
Why so insecure?
On Slashdot, an "Apple Apologist Fanboi" is anybody who doesn't incessantly whine in a shrill voice about how awful Apple and Steve Jobs are, annoying anyone within a four-mile radius, most of whom don't care one way or the other.
Apple only cares about the sale of the product, not support
Sales of their products are affected by support.
that's why so many of their products fail 2-3 years off shelf life conveniently after warranty.
Then, why do so many *MORE* of their products *NOT* fail 2-3 years after warranty? You imply some sort of "planned failure" to get people to buy new products, but Apple (like most quality brands) take a different tact, and instead come out with new and improved products to entice new sales. And Apple, specifically, is having no problem whatsoever getting people to buy their new products.
That wouldn't happen if they kept failing on people.
And, what does this have to do with the story in question anyway?
1. What about Safari for Windows? 2. So...Leopard was released less than four years ago, after Windows Vista came out in 2006, yet Apple can't be bothered to patch it?
While he is a troll, having worked in support (at a University in Oregon) with Apple users they do often say the following repeatedly:
"Mac's don't get viruses"
"My Mac is secure"
Both are true. Neither mean (what the OP said), "they are invulnerable to any threats" or "they are impervious to any kind of cyber threat".
It's only for OS 10.6.8 and 10.7.1. Users of PowerPC Macs can't use any OS after 10.5.8, and many users of Intel based Macs won't update past 10.6.6 because 10.6.7/10.6.8 introduce some significant compatibility issues. It's great that they released a fix, but it's only a fix for 50%-80% of the user base. I guest the rest have to manually remove the Diginotar root cert?
make imaginary.friends COUNT=100 VISIBLE=false
Perhaps for the same reason that windows users think that because they have an anti virus program installed that they are immune to all malware. I should say some windows users. People are people and computer security is sufficiently complex that the majority don't really care to put in the brainpower required to understand it. So they end up repeating marketing bs. I happily use all of Mac, windows and Linux. And I feel that each of them sucks in their own special ways.
your point?
Microsoft is exceeding their patch target dates, while Apple is trailing the pack with shoddy patches only for its current-gen non-PPC machines?
Wrong - you should read the article before making knee-jerk statements. Microsoft accidentally published the security bulletins describing the upcoming patches. Then they scrambled to remove them.
In other words they posted specific information regarding vulnerabilities that will be patched next Tuesday. Hackers might find that a tad useful, what with a four-day window of opportunity.
#DeleteChrome