Apple Fixes Major SSL Bug In OS X, iOS

← Back to Stories (view on slashdot.org)

Apple Fixes Major SSL Bug In OS X, iOS

Posted by Soulskill on Tuesday April 22, 2014 @08:30AM from the more-broken-security-stuff dept.

Trailrunner7 writes: "Apple has fixed a serious security flaw present in many versions of both iOS and OS X and could allow an attacker to intercept data on SSL connections. The bug is one of many the company fixed Tuesday in its two main operating systems, and several of the other vulnerabilities have serious consequences as well, including the ability to bypass memory protections and run arbitrary code. The most severe of the vulnerabilities patched in iOS 7.1.1 and OSX Mountain Lion and Mavericks is an issue with the secure transport component of the operating systems. If an attacker was in a man-in-the-middle position on a user's network, he might be able to intercept supposedly secure traffic or change the connection's properties."

96 comments

Min score:

Reason:

Sort:

Also fixed in Lion by Valdrax · 2014-04-22 08:32 · Score: 2

Also fixed in Lion, according to the link, for those of us still using older Macs.

--
If it's for-profit but free, you're not the customer -- you're the product (e.g., the Slashdot Beta's "audience").
1. Re:Also fixed in Lion by ArcadeMan · 2014-04-22 08:33 · Score: 2
  
  What about iOS 6? There's still a lot of older iPhones out there.
  
  --
  Get free satoshi (Bitcoin) and Dogecoins
2. Re:Also fixed in Lion by dimeglio · 2014-04-22 08:48 · Score: 1
  
  Good point. According to the FA, it looks like it affects iOS 7.1 and earlier. A good excuse to upgrade your iDevice. I don't expect Apple to patch unsupported hardware but if people complain, they might get it done.
  
  --
  Views expressed do not necessarily reflect those of the author.
3. Re:Also fixed in Lion by ArcadeMan · 2014-04-22 08:50 · Score: 1
  
  iOS6 did receive a patch about another SSL vulnerability a few months back, I think.
  What I'm hoping for is for Apple to enable FaceTime Audio for the iPhone 3G and iPhone 3GS. All this talk about Earth Day is nice, but what's really helpful for users and the environment is to use older devices longer before recycling them.
  
  --
  Get free satoshi (Bitcoin) and Dogecoins
4. Re:Also fixed in Lion by sconeu · 2014-04-22 11:40 · Score: 1
  
  Only for older iPods/iPhones. If your device is capable of running 7, you will not have the 6.x upgrade available.
  
  --
  General Relativity: Space-time tells matter where to go; Matter tells space-time what shape to be.
Neat by Anonymous Coward · 2014-04-22 08:46 · Score: 0

That's swell!
NOT Fixed by Anonymous Coward · 2014-04-22 08:49 · Score: 0

NOT fixed is the issue that IOS 7 does not work properly with authenticated proxy servers.
It forgets your password.
This means every service which uses the HTTP port needs you to enter your password. Got sick and tired of doing this dozens of times a day, every day so wifi gets turned off at work.
All features by Anonymous Coward · 2014-04-22 08:54 · Score: 0

not bugs.
Geeze, they're getting rid of all the features now.
Not a open source issue. by Anonymous Coward · 2014-04-22 08:56 · Score: 3, Insightful

Tell me again how this whole issue with SSL is due to the nature of open source and how it's only the commie OpenSSL which can't be trusted...
Seems to me Apple's got a bit of a quality control issue itself.
What's Apple's excuse ?
1. Re:Not a open source issue. by x0ra · 2014-04-22 09:02 · Score: 5, Insightful
  
  'apple' is smart enough not to give the issue a sexy name as "heartbleed", and thus it will go unnoticed among non tech people...
2. Re:Not a open source issue. by omnichad · 2014-04-22 09:24 · Score: 2, Insightful
  
  But the bug probably is heartbleed. They're just not disclosing that they were affected.
3. Re:Not a open source issue. by buchner.johannes · 2014-04-22 09:34 · Score: 5, Informative
  
  It's a MITM attack. Heartbleed is not MITM.
  
  --
  NB: The message above might reflect my opinion right now, but not necessarily tomorrow or next year.
4. Re:Not a open source issue. by MikeMo · 2014-04-22 09:35 · Score: 1
  
  It is not related to Heartbleed.
5. Re:Not a open source issue. by Anonymous Coward · 2014-04-22 09:37 · Score: 0
  
  It is definitely not heartbleed, though I guess that would require RTFA.
6. Re:Not a open source issue. by gnasher719 · 2014-04-22 09:50 · Score: 1
  
  But the bug probably is heartbleed. They're just not disclosing that they were affected.
  What do you mean by "they were affected"? Only _servers_ were affected by the "heartbleed" bug. Apple was lucky enough that its major services (App Store, iTunes, iCloud) didn't use OpenSSL.
7. Re:Not a open source issue. by jo_ham · 2014-04-22 09:51 · Score: 1
  
  Tell me again how this whole issue with SSL is due to the nature of open source and how it's only the commie OpenSSL which can't be trusted...
  Seems to me Apple's got a bit of a quality control issue itself.
  What's Apple's excuse ?
  Apple's SSL implementation is also open source.
  Oh, sorry, I interrupted you in the middle of an uninformed Apple bash. Do carry on. My apologies.
  Their excuse is "open source means lots of eyes!" No wait, it's "whatever we do we'll be attacked, so we just dropped the ball and said 'fuck it'".
8. Re:Not a open source issue. by jo_ham · 2014-04-22 09:52 · Score: 1
  
  You know, information like that should really be in the article.
  Oh wait.
9. Re:Not a open source issue. by Anubis+IV · 2014-04-22 10:15 · Score: 1
  
  How do you figure? This bug is specific to MITM attacks from an attacker on one's on network, has nothing to do with the heartbeat functionality that Heartbleed relied on, and the nature of the attack is that the attacker can execute arbitrary code, change the properties of the connection, or get data traveling over the network, rather than merely being able to access random 64K bits from memory. This is something wholly separate from Heartbleed, and likely ties back in with the ongoing security audit they've been rumored to be doing after finding themselves on the NSA's PRISM list.
  Not all network security bugs happening in the same temporal proximity as Heartbleed are Heartbleed. It's not uncommon for Microsoft, Apple, and the various Linux distros/their dependencies to push out updates of this sort. It's just getting more attention right now because of Heartbleed. But suggesting that this "bug probably is Heartbleed" indicates that you really don't have a good grasp of what Heartbleed is even about, since it bears very little resemblance.
10. Re:Not a open source issue. by Anonymous Coward · 2014-04-22 10:17 · Score: 0
  
  Tell me again how this whole issue with SSL is due to the nature of open source and how it's only the commie OpenSSL which can't be trusted...
  Where were the people claiming this crap? I never saw it. Of course, there are always trolls.
  What I saw was the open source zealots hooting about Apple's move to an in-house solution (note: not closed source, but still under Apple's control) being completely stupid, and this would never happen in an open source yum yum this crow sure is tasty.
11. Re:Not a open source issue. by Espectr0 · 2014-04-22 11:00 · Score: 1
  
  decided posting instead of modding you down, since you may not know that Apple does not use OpenSSL, therefore you are just wrong.
  
  --
  Open Source Java Web Forum with LDAP authentication
12. Re:Not a open source issue. by Cinder6 · 2014-04-22 12:07 · Score: 1
  
  Not sure it's luck, since Apple went out of its way to replace OpenSSL in 2011 because they didn't think it was secure enough. (Granted, their own replacement wasn't perfect, either, as seen by both this and the "goto fail" bug.)
  
  --
  If you can't convince them, convict them.
13. Re:Not a open source issue. by David+Jao · 2014-04-22 14:31 · Score: 2
  
  Clients are also affected. https://www.schneier.com/blog/...
14. Re:Not a open source issue. by Anonymous Coward · 2014-04-22 14:41 · Score: 0
  
  I'll give it a sexy name the media can use ... Apple's GoTo Fail Part Duex
15. Re:Not a open source issue. by jeremyp · 2014-04-22 23:33 · Score: 2
  
  Only _servers_ were affected by the "heartbleed" bug.
  Wrong.
  
  --
  All I want is a secure system where it's easy to do anything I want. Is that too much to ask ~~ Randall Munroe
Ability to run arbitrary code. by Anonymous Coward · 2014-04-22 08:57 · Score: 0

"the ability to bypass memory protections and run arbitrary code"
I wish I could run arbitrary code on my iPhone without a developer account. Can I put in a feature request for them to unpatch it?
1. Re:Ability to run arbitrary code. by am+2k · 2014-04-22 12:40 · Score: 1
  
  Executing arbitrary code is how the jailbreaks work. They exploit some weakness to patch the system, removing a few safeguards in the process (that's why there are some viruses out there that only affect jailbroken iOS devices).
Snow Leopard by Anonymous Coward · 2014-04-22 09:07 · Score: 3, Insightful

I have a perfectly good MBP of early 2007 vintage running Snow Leopard which can't be upgraded, and it still does the job I need of it today. I can't bring myself to 'upgrade' to the modern MBP's as I hate the chicklet keyboard, so I'm swinging back to windows laptops (linux+windows) to avoid Apple abandonware in the future.
For all the criticism Microsoft gets, at least they don't abandon semi-old stuff.
1. Re:Snow Leopard by Noah+Haders · 2014-04-22 09:14 · Score: 0
  
  To be fair, that's a 7yo computer... What's the rightlifetime so an os doesn't count as abandon ware? They still do snow leopard updates I think.
2. Re:Snow Leopard by mk1004 · 2014-04-22 09:24 · Score: 1
  
  No, I've got a 2008 Mac Mini that was updated to Snow Leopard, and I haven't seen any updates for awhile. Newegg also wouldn't let me order using the Mini because of the older version of Safari that runs on SL.
  If I upgrade to 2G of RAM, it looks like I can upgrade to Lion, but not Mountain Lion. I was going to upgrade the RAM anyway because it seems to run a bit sluggish, but the Mini maxes out at 2G, which is the lower limit of Lion. So it may be a wash, performance-wise.
  
  --
  I can mend the break of day, heal a broken heart, and provide temporary relief to nymphomaniacs.
3. Re:Snow Leopard by LDAPMAN · 2014-04-22 09:38 · Score: 1
  
  So you have a six year old machine that was the lowest specs you could buy at that time. Your surprised you can't run the latest and greatest???
4. Re:Snow Leopard by dk20 · 2014-04-22 09:47 · Score: 1
  
  You know a lot of times those limits are artificial right? People have figured out how to trick mavericks into installing on "unapproved" systems.
5. Re:Snow Leopard by koan · 2014-04-22 09:48 · Score: 1
  
  Install Linux or Windows.
  
  --
  "If any question why we died, Tell them because our fathers lied."
6. Re:Snow Leopard by PlusFiveTroll · 2014-04-22 09:50 · Score: 1
  
  Windows Vista still receives security patches, which was released in 2007. Most computers of that age will install W7 fine, though you might want to bump the RAM if you want it to be enjoyable. XP was supported with patches for over a decade. Apple locks you into expensiev hardware and wants you to buy new every few years,
7. Re:Snow Leopard by jo_ham · 2014-04-22 09:58 · Score: 4, Informative
  
  An "early 2007 vintage" MBP can run Lion.
  If your machine is stuck on 10.6 then it's not "early 2007" but "early 2006".
  The youngest macbook pro that can't run anything later than 10.6 is the Early 2006 with the Core Duo CPU and 2GB RAM.
  Yeah, really "abandonware" there. *eyeroll*
8. Re:Snow Leopard by LDAPMAN · 2014-04-22 10:00 · Score: 1
  
  Depends on what you mean by "artificial". If it runs like molasses on less than 2GB or RAM and an ancient processor then limiting it to newer hardware is a reasonable choice.
9. Re:Snow Leopard by Guest316 · 2014-04-22 10:03 · Score: 1
  
  Why not? I can run the latest Solaris on 12 year old Ultras, and if I had an early '90s Vax I believe I could still run the latest VMS version.
10. Re:Snow Leopard by Anonymous Coward · 2014-04-22 10:05 · Score: 0
  
  wait, you think a Windows laptop is going to have a better keyboard? I recently had to use someone's Windows RT "laptop" and the keyboard was awful, rough plastic already covered in dirt and grime that you can't even click the button down you just press it and hope Windows recognizes it. Seriously fucking awful. Stop being a cheap lil' bitch and buy a MBP.
11. Re:Snow Leopard by Cyrano+de+Maniac · 2014-04-22 10:19 · Score: 3, Informative
  
  If I upgrade to 2G of RAM, it looks like I can upgrade to Lion, but not Mountain Lion. I was going to upgrade the RAM anyway because it seems to run a bit sluggish, but the Mini maxes out at 2G, which is the lower limit of Lion. So it may be a wash, performance-wise.
  No, it will be a huge step backwards. Do not, under any circumstance, install Lion if you can possibly avoid it. Not only is 2GB not enough to run Lion in any reasonable manner, but even if you have more RAM than that, Lion is a molasses sucking pig. The last OS for any hardware I used that was that bad and that much of a step backwards from what came before it was... umm... Wow, can't think of one. Lion wins. Or, actually, loses.
  Installing it was the worst single decision I've made regarding Apple software on my early 2008 MacBook Pro. I even did a clean install from official Apple USB media (i.e. the USB fob you had to pay extra for instead of just downloading it) and upgraded RAM to 4GB on account of Lion. Take it from myself and several of my coworkers who regretted every getting within 100 feet of Lion that it is best avoided. Mountain Lion didn't suck, but only by comparison to Lion. Mavericks is a little bit better yet, but still not nearly as snappy as Snow Leopard.
  My gut reaction: Don't worry about Snow Leopard being out of date, even security-wise. A man-in-the-middle is rare in most environments, and Snow Leopard is already quickly diminishing in market share, so it's not terribly likely to be widely exploited. Compared to the every day pain you'll cause yourself by installing Lion or later, the tiny risk profile of running a vulnerable Snow Leopard is worth it, in my opinion.
  
  --
  Cyrano de Maniac
12. Re:Snow Leopard by dk20 · 2014-04-22 10:34 · Score: 2
  
  It is funny how words like "ancient" are thrown around in discussions like this.
  
  Here's an interesting point similar to what someone posted down below.
  In my basement I have a SUN X4500 Storage server (circa 2007) and it is currently running Solaris 11.1 without issues. The system has two "ancient" AMD Opteron's but since little has changed in terms of processor instruction sets they run fine.
  So this is a system from 2007 running an OS released in 2011 and supported until 2024. Heck, I might upgrade to 11.2 when it is released in the next month or so.
  
  Artificially preventing you from upgrading in this case seems more like a means to sell hardware then to "protect the user experience".
  
  He has a 2008 mac mini, lets assume the mid 2007 model with a T7200 Intel Core 2 Duo whereas the 2009 mini uses 2.53 GHz (P8700) Intel Core 2 Duo
  
  Go to any benchmark sites and do a comparison of those processors, they are pretty close yet one supports Mavericks, the other tops out at lion?
13. Re:Snow Leopard by chuckugly · 2014-04-22 10:35 · Score: 1
  
  To be fair, that's a 7yo computer... What's the rightlifetime so an os doesn't count as abandon ware? They still do snow leopard updates I think.
  Do we apply that same logic to Windows XP?
14. Re:Snow Leopard by LDAPMAN · 2014-04-22 10:55 · Score: 1
  
  Unless it's slightly earlier than he thinks and is a Core Duo instead of a Core 2 Duo. Then there is the RAM requirement. Comparing support lifetime for a server OS and Hardware to a Mac Mini running a desktop OS is ridiculous.
15. Re:Snow Leopard by dk20 · 2014-04-22 11:07 · Score: 1
  
  According to Apple's website 2GB is the minimum for Maverics: http://support.apple.com/kb/ht...
  
  They also say a 2009 or later mini, does the small difference in processing powre really make a difference then?
16. Re:Snow Leopard by LDAPMAN · 2014-04-22 11:14 · Score: 1
  
  It's not just processing power. Some of the earlier processors are not fully 64bit and some have limitations on the memory they can address.
17. Re:Snow Leopard by guruevi · 2014-04-22 11:22 · Score: 1
  
  There is no such thing as a 2008 Mac Mini, you probably got a Mid 2007 Mac Mini which runs up to Mac OS X 10.7.5 which is still supported and can actually take up to 3GB of memory (2GB was the maximum configuration by Apple).
  If you want to, you can install Linux on the machine. I don't know why NewEgg would crap out on the browser because that Safari supports common versions of ECMAScript and HTML5, try Firefox otherwise.
  
  --
  Custom electronics and digital signage for your business: www.evcircuits.com
18. Re:Snow Leopard by LDAPMAN · 2014-04-22 11:29 · Score: 1
  
  And Windows 7 was released when??? Mavericks was released a few months ago. The versions of OS X that were released around that time are still receiving security updates too and will still run fine on six year old hardware. The issue here is Mavericks is 64bit only and it makes some assumptions on the hardware. Nothing different here. Would you rather they did what MS did with Windows 8 and certify hardware they knew would run like crap?
19. Re:Snow Leopard by Anonymous Coward · 2014-04-22 12:09 · Score: 0
  
  Are Windows RT devices being sold as laptops? I hadn't noticed that.
20. Re:Snow Leopard by Cinder6 · 2014-04-22 12:11 · Score: 1
  
  Everyone has different experiences. I never had problems with Lion (mid-2011 MBA), but I saw enough people complaining that I won't doubt you. On the other hand, I could never go back to Snow Leopard after Mountain Lion, and especially not after Mavericks.
  
  --
  If you can't convince them, convict them.
21. Re:Snow Leopard by Lakitu · 2014-04-22 12:12 · Score: 1
  
  Looks like it's the opposite to me. He's complaining that he's forced to purchase upgrades to the latest and greatest major versions of his OS, and purchase hardware that it says it will run on, just for a security patch.
22. Re:Snow Leopard by LynnwoodRooster · 2014-04-22 12:15 · Score: 1
  
  Oh, I don't know... Maybe 12 years or so?
  
  --
  Browsing at +1 - no ACs, I ignore their posts. So refreshing!
23. Re:Snow Leopard by Anonymous Coward · 2014-04-22 13:35 · Score: 0
  
  Windows is the only one without opensource implementation. Should be a lot safer because it is harder to find bugs in the code!
24. Re:Snow Leopard by Anonymous Coward · 2014-04-22 15:01 · Score: 0
  
  Have you ever seen anyone using a Windows RT device as a tablet? It's always used as a wannabe Macbook Air kind of thing with the cheesy keys and little monitor stand in the back.
25. Re:Snow Leopard by Kremmy · 2014-04-22 16:18 · Score: 1
  
  We hit a level of computing power in 2006 that makes it so computers that old are still very likely to run most things just fine. Throw Windows 7 on anything that was honestly Vista Capable and you're good to go. Hey, that ought to include those Macs...
26. Re:Snow Leopard by Lord_Jeremy · 2014-04-22 17:39 · Score: 1
  
  No, you don't have a 2008 Mac Mini. There is no such thing as a 2008-year-model Mac Mini (source). The Mid 2007 model runs 10.7. The Early 2009 model runs 10.9. The 2007 can't run anything beyond than 10.7 natively because 10.8 and newer require a 64-bit EFI firmware. This is due to the newer version always booting the kernel in 64-bit mode. Some older Macs that had 64-bit CPUs, such as your Mini and a couple gens of Mac Pros still had 32-bit EFIs. You *could* run Mountain Lion or Mavericks by using a 3rd-party boot loader (such as Chameleon) that translates the 64-bit EFI calls to 32-bit. I'm actually doing that myself on an older Mac Pro. Of course then you'll discover that the video drivers for you Mini are only compiled for 32-bit in older systems and are totally absent from newer OS X versions. At a certain point, Apple (very reasonably) decided that maintaining two architectures of OS X and all included software, as well as implicitly requiring other developers to do the same was not worth support Macs beyond six years old.
27. Re:Snow Leopard by Anonymous Coward · 2014-04-22 21:35 · Score: 0
  
  You know a lot of times those limits are artificial right? People have figured out how to trick mavericks into installing on "unapproved" systems.
  I have a child that's turning 6 this year. Should I throw him out too?
  Consumerist hogwash!
28. Re:Snow Leopard by supercrisp · 2014-04-22 23:46 · Score: 1
  
  I upgraded to Mavericks from Snow Leopard because a lot of my mainline apps were only getting Mavericks-compatible updates. The best thing I can say about Mavericks is that it doesn't suck as much as I expected. I'm not noticing a slowdown, but I moved to an SSD for the OS drive at the same time, and I'm on an '09 MacBook Pro with 8GB of RAM, so those things may be concealing an OS-related slowdown. At any rate, I'd say that you shouldn't make the move to Mavericks if you don't have to, especially if you have an older machine. It's mostly just a bunch of stupid eye-candy. Yes, I know: App Nap!* Memory efficiency! Battery efficiency! But my battery use was already fine, RAM is often dirt cheap, and App Nap's main function on my machine is to pop up the rainbow pinwheel when I'm in a hurry.
29. Re:Snow Leopard by AmiMoJo · 2014-04-23 00:31 · Score: 1
  
  Lion doesn't have any PPC support, so might not be an option. Even if it is Lion runs very poorly on machines of that age, so would be a massive downgrade in terms of performance and productivity.
  Remember all the stick Microsoft got about "Vista compatible" machines that ran it like a dog? "Possible" and "advisable" or "practical" are different things.
  
  --
  const int one = 65536; (Silvermoon, Texture.cs)
  SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
30. Re:Snow Leopard by Gr8Apes · 2014-04-23 01:20 · Score: 1
  
  Yes, everything prior to the Santa Rosa machines circa 2009 I believe have essentially a hamstrung memory controller. Intel wasn't fully into the game yet, still playing catchup to AMD. I have a pre Santa Rosa MBP running SL still, because Lion/ML really aren't stable enough to warrant an upgrade. Yes, I have(had) machines running every thing from panther on up to mavericks, and Grand Central, while a great idea, was a massive architectural change that caused quite a few instabilities in the OS. Mavericks seems to be about as stable as Leopard, which isn't terrible, but even it isn't yet quite at the SL level yet.
  
  --
  The cesspool just got a check and balance.
31. Re:Snow Leopard by Gr8Apes · 2014-04-23 01:51 · Score: 1
  
  I was pretty sure that Vista was EOL'd already. W7 is scheduled for next year. Win8 is ended this year, all of course as far as "free" patches go.
  Snow Leopard was still getting patches until Mar 2014. As for it being on sale, it's only there as a gateway for pre- Snow Leopard systems to get to Mavericks, however small that number may be. It's also a way to run PPC software on newer macs via Parallels or the like. Yes you can run that (accidentally) free copy of Adobe PS 2 you downloaded.
  
  --
  The cesspool just got a check and balance.
32. Re:Snow Leopard by Gr8Apes · 2014-04-23 01:55 · Score: 1
  
  Except the version of the OS on his machine isn't affected by that bug...
  
  --
  The cesspool just got a check and balance.
33. Re:Snow Leopard by Gr8Apes · 2014-04-23 02:11 · Score: 1
  
  On the other hand, I could never go back to Snow Leopard after Mountain Lion, and especially not after Mavericks.
  Why? (I'm honestly curious)
  Note: I'm running SL, ML, and Mavericks, and I have to say, SL is the most stable, followed by Mavericks, ML is "ok", and my brief experience with Lion was only because ML came out and I decided to jump directly to it even though I had had a Lion disk for a year. (Yes, the "bad" stories made me hold off long enough for the "fix" to come out.)
  I'm still not 100% happy with the effects of Grand Central, only because the stability has not been returned to SL standards. However, Mavericks is quite usable. The occasional "crash" is mediated by a 500+MB/s SSD, so restarts are sub 15s and used to occur maybe once every 30-45 days. The 10.9.1 patch has actually allowed me to reboot for reasons other than a crash. Oh, and I should mention that these crashes do not come with a dump, just blammo - restart. That never happened in SL, at least you got the infamous crash screen, if you ever had a crash that is. (You will occasionally if you're running a slew of PPC software)
  All that said, for me, the main benefit of Grand Central is better handling of messaging and performance for applications that have the ability to be run in parallel. This is a major plus. I have barely changed my interface habits since panther, primarily because I use QuickSilver for launching apps and Cmd[-SHFT]-Tab and Cmd[-SHFT]-` to navigate apps and windows within an app. So all the Launchpad, Mission Control, Expose, Dashboard, Dockbar etc garbage don't even figure in my daily computer use. I minimize and hide the dockbar right after installing QuickSilver, and pretty much never see it again.
  
  --
  The cesspool just got a check and balance.
34. Re:Snow Leopard by strikethree · 2014-04-23 02:16 · Score: 1
  
  My Macbook Pro is from mid 2010. I stopped "upgrading" at Snow Leopard because that is when OS X went off the deep end. Snow Leopard itself actually annoys me with the "integrated app store" bullshit. I wanted a Unix based laptop with a semi-reasonable GUI and all I would have if I upgraded to the latest is an ugly IOS device doing everything it can to get me to buy shit.
  
  --
  "Someone needs to talk to the tree of liberty about its ghoulish drinking problem." by ohnocitizen
35. Re:Snow Leopard by Gr8Apes · 2014-04-23 02:16 · Score: 1
  
  So the hackintosh community benefits us again. I'll have to see about the video drivers for my MBP. If they're available in 10.9, I'll upgrade it someday. For now, it's fine on SL.
  
  --
  The cesspool just got a check and balance.
36. Re:Snow Leopard by Anonymous Coward · 2014-04-23 03:21 · Score: 0
  
  I love the people pointing to XP as if it were something other than a statistical outlier for Microsoft. XP had it's support period extended *several* times because the only available replacement (for MS OS users) was considered so crappy that entire fortune 500 companies were refusing to go through with the upgrade. Not extending the support timeline for XP would have meant that Microsoft would have been pushing its best customers to use other products by other vendors. For years.
  Microsoft extended XP support because they had no other viable option.
37. Re:Snow Leopard by Anonymous Coward · 2014-04-23 05:12 · Score: 0
  
  If you insist on using an unsupported OS, at laease try to use a current(ish) browser, i.e. stay away from safari and use Firefox or Chrome instead.
38. Re:Snow Leopard by mk1004 · 2014-04-23 05:35 · Score: 1
  
  You're right; it's a 2007 model purchased in 2008. The point is, it can't run anything beyond 10.7 (without limited workarounds), and 10.6 is not getting any updates. My point was that Snow Leopard isn't getting any updates, and older hardware is limited as to what you can upgrade to.
  It seems to be a shame that hardware that can last for 6+ years has to be abandoned because the OS is no longer supported.
  
  --
  I can mend the break of day, heal a broken heart, and provide temporary relief to nymphomaniacs.
39. Re:Snow Leopard by jo_ham · 2014-04-23 05:48 · Score: 0
  
  My Macbook Pro is from mid 2010. I stopped "upgrading" at Snow Leopard because that is when OS X went off the deep end. Snow Leopard itself actually annoys me with the "integrated app store" bullshit. I wanted a Unix based laptop with a semi-reasonable GUI and all I would have if I upgraded to the latest is an ugly IOS device doing everything it can to get me to buy shit.
  Loving the hyperbole.
  OS X looks nothing like iOS. It has the launchpad, which is clearly derived from the iOS springboard, but using it is totally optional (I never do - I just launch apps the way I've been doing it since 10.1).
  OS X also doesn't "do everything it can" to get you to buy shit - using the App Store is optional for anything other than the core apps and OS. It's where you get core updates from (for the OS and built in apps), but it is far from the sole source of software, nor is it intrusive.
  I'm struggling to think of what you mean when you say OS X is "doing everything it can" to "force you" to buy things. Can you give me some specific examples?
  Also, I wasn't aware that they removed all of the Unix underpinnings and command line with OS X beyond 10.6. Again, can you give me some specific examples of what is missing from OS X after Snow Leopard that means it would no longer be a "Unix-based laptop with a semi-reasonable GUI"?
40. Re:Snow Leopard by jo_ham · 2014-04-23 05:51 · Score: 1
  
  That's true - if you need Rosetta support, you are stuck on 10.6. Most apps have x86-native binaries by now, but not all, especially if you have older, unsupported software. I guess for many people this will be Adobe CS1.
41. Re:Snow Leopard by Anonymous Coward · 2014-04-24 00:11 · Score: 0
  
  To be fair, that's a 7yo computer... What's the rightlifetime so an os doesn't count as abandon ware? They still do snow leopard updates I think.
  Do we apply that same logic to Windows XP?
  Is it Apple's fault that XP's successor all were late? Blackcomb was promised for 2003 in 2000, then delayed for an intermediate release of Longhorn, which was then scraped for Vista. And Blackcomb ultimately became Windows 7, which came out 2009, only 6 years late.
  If it had been on time, it likely wouldn't even be supported anymore.
Anyone having trouble with connecting today? by Anonymous Coward · 2014-04-22 09:26 · Score: 0

Is anyone having trouble getting through to Slashdot today?
Seeing 90% packet loss betweet AT&T and something closer to Slashdot's end of the pipe than my end of the pipe.
5 10 ms 8 ms 9 ms 12.122.81.73 6 11 ms 11 ms 10 ms 192.205.33.98 7 12 ms 13 ms 12 ms 206.28.98.117 8 * 63 ms 63 ms 204.70.196.246 9 * * * Request timed out. 10 * * * Request timed out. 11 * * * Request timed out. 12 65 ms 63 ms * star.slashdot.org [216.34.181.48] 13 67 ms 85 ms * star.slashdot.org [216.34.181.48] 14 * * 64 ms star.slashdot.org [216.34.181.48]
Tests from a non-AT&T ISP show normal operation. The problem may be on AT&T's end and not Slashdot's, or it may be between AT&T and /.'s immediate upstream provider - but this has been an ongoing issue for about 8 hours so far today.
A ping reveals about 90% packet loss between here and Slashdot. (Again, no or negligible packet loss between a non-AT&T ISP). I have verified this with as many IPs as I can get from my own netblock, but they all funnel through the same rout past 12.83.88.173
1. Re:Anyone having trouble with connecting today? by Kazoo+the+Clown · 2014-04-22 10:36 · Score: 1
  
  Yes, I've been having a lot of trouble getting slashdot to load as well. Some browsers seem to be doing better than others. On an iPad.
Not related to hearthblled by Anonymous Coward · 2014-04-22 09:30 · Score: 1

Impact: An attacker with a privileged network position may capture
data or change the operations performed in sessions protected by SSL
Description: In a 'triple handshake' attack, it was possible for an
attacker to establish two connections which had the same encryption
keys and handshake, insert the attacker's data in one connection, and
renegotiate so that the connections may be forwarded to each other.
To prevent attacks based on this scenario, Secure Transport was
changed so that, by default, a renegotiation must present the same
server certificate as was presented in the original connection.
Marketshare? by Anonymous Coward · 2014-04-22 09:33 · Score: 0

Hardly anyone serious uses Apple's server OS, especially in datacenters, so the footprint affected would most likely be super tiny.
1. Re:Marketshare? by Kalriath · 2014-04-22 16:22 · Score: 1
  
  Irrelevant, since the issue is the client implementation.
  
  --
  For a site about things like basic rights, Slashdot users sure do like to censor "dissent".
2. Re:Marketshare? by Anonymous Coward · 2014-04-23 03:44 · Score: 0
  
  Why did OS X get a mention?
3. Re:Marketshare? by Kalriath · 2014-04-23 10:08 · Score: 1
  
  Because OSX uses Apple's SSL implementation?
  
  --
  For a site about things like basic rights, Slashdot users sure do like to censor "dissent".
4. Re:Marketshare? by Anonymous Coward · 2014-04-23 10:18 · Score: 0
  
  So hardly irrelevant in that context then.
5. Re:Marketshare? by Kalriath · 2014-04-23 10:47 · Score: 1
  
  No, it's irrelevant. Noone uses OS X server in a datacenter as their client PC. The web server that OS X uses in the server context is Apache - so... OpenSSL.
  
  --
  For a site about things like basic rights, Slashdot users sure do like to censor "dissent".
Laugh by koan · 2014-04-22 09:46 · Score: 0, Flamebait

Just here to scoff at Apple *again* feel free to mod down.

--
"If any question why we died, Tell them because our fathers lied."
They. by Anonymous Coward · 2014-04-22 10:46 · Score: 0, Troll

If an attacker was in a man-in-the-middle position on a user's network, he might be able to intercept supposedly secure traffic or change the connection's properties.
Why add gender to this statement?
1. Re:They. by Anonymous Coward · 2014-04-22 11:05 · Score: 0
  
  Did you read the subject line?
  Using 'she' is every bit as ridiculous as 'he'. Why add gender to a theoretical person that doesn't actually exist?
2. Re:They. by Anonymous Coward · 2014-04-22 11:26 · Score: 0
  
  Because our language isn't easily structured that way. I guess you could do, "If an attacker was in a person-in-the-middle position on a user's network, they might be able to intercept supposedly secure traffic or change the connection's properties." - "they" is a plural form, but I think you could get away with it in that case. We just don't have a single word singular gender neutral pronoun for "person".
3. Re:They. by Anonymous Coward · 2014-04-22 11:53 · Score: 0
  
  I did read the subject and assumed as much (could have used they instead).
  
  My comment was an off topic to the off topic comment wondering if others have noticed this trend.
4. Re:They. by flyingfsck · 2014-04-22 15:36 · Score: 1
  
  Most Amerikins do not realize that the gender neutral form is 'one', as in anyone, no-one, someone, or 'body', as in somebody, anybody and nobody. If everyone would realize that one could use one instead of he, she or it, then the gender issue in politically correct speak would largely go away.
  
  --
  Excuse me, but please get off my Pennisetum Clandestinum, eh!
5. Re:They. by Anonymous Coward · 2014-04-22 16:52 · Score: 1
  
  Most Amerikins do not realize that the gender neutral form is 'one', as in anyone, no-one, someone, or 'body', as in somebody, anybody and nobody. If everyone would realize that one could use one instead of he, she or it, then the gender issue in politically correct speak would largely go away.
  The use of "one" when attempting to be PC regarding gender is offensive to conjoined twins. Especially conjoined fraternal twins and conjoined identical twins where one twin is transgendered.
VAX/VMS supported into late 1990s by erikscott · 2014-04-22 14:39 · Score: 1

Sadly, VMS support for VAX ended around 7.1 or 7.3 or something - it was in the late nineties. But every alpha ever made (at least "that ever ran VMS in the first place") can run the latest version.
All UltraSPARCS can run solaris 10.X. Hardware from this millenium is required for Solaris 11.X (more or less). Pre-Ultra machines are kind of limited - A microsparc machine (sparcStation 5 and similar) is supported on 2.9, but unless you max out the RAM you're better off at 2.8. Sparcs with VME busses (4/110, 4/280, etc) are stuck further back - maybe Solaris 2.4, but I'm not sure. These are better off running OpenBSD anyway. :-)
Yeah, I get a laugh out of what constitutes "support" these days. :-)
False by Anonymous Coward · 2014-04-22 14:40 · Score: 0

I have a perfectly good MBP of early 2007 vintage running Snow Leopard which can't be upgraded.
A Macbook pro of that "vintage" can be upgraded Lion, for a grand total of $20.
10.6.8 is A OK Fuck U by Anonymous Coward · 2014-04-22 16:08 · Score: 0

Just goes to show.
FU
I shit my pants by Anonymous Coward · 2014-04-22 16:09 · Score: 0

I also jerked off into the ear holes of a corpse.
Stick Dynamite UP Cook's Anus by Anonymous Coward · 2014-04-22 16:15 · Score: 0

Cook want to be Gay, because in Federal Employment, 'Gay' is the new 'Black.'
Let's help !
Kidnap Cook.
Stick a stick of dynamite wrapped in a Trojen Condum up Cook's ass !
Apply SuperGlue to the "Hams" generously.
Apply Duck Tape around the butt and pelvis tightly.
Light Up.
Retreat to a protected bunker.
"BLOUIE BAM"
Wooooooooo ! What a fucker fire cracker !
Just goes to show.
Ha ha
Indeed by Anonymous Coward · 2014-04-22 17:39 · Score: 0

The Russkie and the FtMeade Mafia will never lower themselves to the use of a powerful assembly-debugger or a decompiler. We know that. Neither will the North Korean Long Range Recon Forces do that.
with all the media attention lately... by Anonymous Coward · 2014-04-22 20:48 · Score: 0

doesn't surprise me that apple finally "fixes" a longstanding security issue.
it also would not surprise me if there are others, yet undiscovered (by the PUBLIC), present.
Apple's a small company, they can't afford to offe by Anonymous Coward · 2014-04-22 20:57 · Score: 0

Apple's a small company, they can't afford to offer long term support.
oh...
Errr... by porkchop_d_clown · 2014-04-22 23:34 · Score: 1

Heartbleed affects clients, too. Android phones running 4.1.1, for example. http://www.bloomberg.com/news/...

--
Clear, Dark Skies
Let me know how it goes by porkchop_d_clown · 2014-04-22 23:35 · Score: 1

when you try to put windows 8.1 on a 7 year old computer.

--
Clear, Dark Skies