Gosh, now that the findings are published, I'll have to be sure I don't put a third-party network card in my Mac - 'cos, you know, I couldn't live with the threat of someone in physical range maybe trying to exploit a hole that was plugged by Apple more than a year ago.

Thanks for the heads-up.

You still don't get it. It works with an out of the box MacBook. That's how he discovered it. If you'd taken the time to read the paper you would have known. Incredibe: fanboys have to back off and they're still nasty.

There is very little in this to prove that he actually found the hole in the first place. (Which was what a lot of the uproar was about.)
It seems a convenient excuse to blame an NDI for why he couldn't provide the exploit method until after a legitimate exploit was found. (Noting here that Apple themselves noted that the exploits they found were unrelated to what David Maynor was originally referring to.)

It's no more legitimate than me claiming to have found the Ping-of-death, but not allowed to tell anyone because of my NDI with a random company. It's a weak excuse.

Quote

Guest wrote:
You still don't get it. It works with an out of the box MacBook. That's how he discovered it. If you'd taken the time to read the paper you would have known. Incredibe: fanboys have to back off and they're still nasty.

Gee, you're right. Let me re-word my response:

Gosh, now that the findings are published, I'll have to be sure I don't use my laptop within range of suspicious chacters - 'cos, you know, I couldn't live with the threat of someone in physical range maybe trying to exploit a hole that was plugged by Apple more than a year ago.

Thanks for the heads-up.

So what's the fucking difference? Little, really. Same outcome.

Quote

coaten wrote:

Quote

Guest wrote:
You still don't get it. It works with an out of the box MacBook. That's how he discovered it. If you'd taken the time to read the paper you would have known. Incredibe: fanboys have to back off and they're still nasty.

Gee, you're right. Let me re-word my response:

Gosh, now that the findings are published, I'll have to be sure I don't use my laptop within range of suspicious chacters - 'cos, you know, I couldn't live with the threat of someone in physical range maybe trying to exploit a hole that was plugged by Apple more than a year ago.

Thanks for the heads-up.

So what's the fucking difference? Little, really. Same outcome.

Well, dispite your outburst of profanity, maybe you could like, go read the uniformed paper and realize that the title of Jeff's article doesn't accurately sum up what was done here. The uninformed.org article isn't about releasing the exploit, which an NDA expiring allowed him to do. The article is about his approach to doing security research on Mac OS X, and it simply uses that vulnerability as the real world example for the processes he uses. I think the point of the original reply though was to highlight the degree to which you reacted to the story without actually knowing the facts. Your responses were both very emotionally charged, but failed to grasp the details of what you were commenting on.

If you're into security research though, and are into Mac OS X, the uniformed piece is worth checking out.