Well this article is so much better written than its counterpart on IGM that they ought to either quit publishing or find a real writer.

I'm confused here.

Whose computer is jeopardized when CST puts even a proof-of-concept security exploit in the wild? Oh, right. It's MINE. And YOURS.

CST isn't simply saying, "If Apple doesn't tell everyone about this security flaw and fix it, we will." They're actually saying, "If Apple doesn't tell everyone about this security flaw and fix it, we'll show everyone how to exploit it."

If this is actually the practice of *all* security companies, perhaps their should be a DoJ investigation here. Being lax (a la Microsoft and, apparently, Apple) on security breaches is not nearly on the same level as being accomplice to taking advantage of it.

I don't mind that CST found the flaw. I'm kind of glad they did. But they're not holding on to just an arbitrary, abstract piece of information. They've got a weapon here, and they're not just telling the best and worst of us that they've got it--they're telling the best and worst of us how we can get one, too. This is not the same as saying, "There's a guy in Santa Barbara with the Ebola virus, and if Apple doesn't tell everyone, we will." It's more like, "There's a guy in Santa Barbara with the Ebola virus, and if Apple doesn't tell everyone, we're going to take this guy to every major city in the U.S. until they do."

I think the argument that Apple isn't moving "fast enough" for crackpot CoreSecurity is a completely moot point. The fact is, it is not in CoreSecurity's rights to hold ***my*** computer's security hostage with this information just so they can get some publicity.

Perhaps they can make a PRIVATE, SECURE filing with some government agency that they've found the security hole, and could demand a certain amount of $$$ from Apple for finding it. But it is ***NOT*** their prerogative to open up iCal users to any security flaw, whatever its size, just because Apple doesn't jump when they say to.

As an iCal user, do I have the right to sue CST as an accomplice to any future iCal-borne attack because my computer has been made vulnerable, since they've proliferated the exploit? They're AT LEAST as responsible as Apple.

I read the history on CST's web site about their exchange with Apple. It appears that Apple has been quite forthcoming and responsive to CST. All I see is that CST believes a "null-pointer" bug is a "security flaw" whereas Apple doesn't. So that's the crux of it. Everything is now a security flaw.

Two of the issues quoted will crash iCal, and the third leads to memory corruption, which "might" allow an attacker to execute arbitrary code.

BUT... in order to do it, the user must import the ical entry, open it up for editing and change the alarm setting on the item! Even if someone puts it onto a server, you must still manually edit the alarm. (http://db.tidbits.com/article/9624).

So...until a patch is issued, if someone sends you an invitation, just don't edit the alarm, and you will be fine.

Do you think that it is possible that the slipping dates published reflect the delays in getting 10.5.3 out?

There are 8 iCal fixes listed in the developer seed notes for 10.5.3.....

the software update is out now and there are no indications that neither of the bugs have been exploited. Apparently all those arguing that CST was putting people at risk by letting them know fo the problem and the way to avoid attacks were simply wrong and barking at the wrong tree. The disclosure talked about 3 bugs: one that let attackers take control of computer that is vulnerable the other two let attackers crash somebody else's iCal application. the first one is fixed the other two are not.

The lack of authentication for published iCal calendars is what I think is the REAL security issue.

If I know someone's .Mac username, there is a very good chance that I can subscribe to their home.ics calendar file from ANY Mac or PC (Outlook 2k7) without being prompted for authentication! I do a lot of calendar publishing/subscribing between two copies of Outlook and of course iCal, and using icalx and calgoo I am able to make it so that calendars published to those services require authentication to subscribe to them, but NOT CALENDARS PUBLISHED FROM ICAL! They are free for all to see.

Pathetic.

It's stuff like this and the default configuration of mail.app to not encrypt login/password info even on Apple's own .mac service (using mail.app) that makes me cringe every time Apple touts superior security.