"Jon Ellch was one of the presenters of the now infamous 'faux disclosure' at Black Hat and DEFCON last month. Ellch and co-presenter Dave Maynor have gone silent since then, fueling speculation that the entire presentation may have been a hoax. Ellch finally broke the silence in an email to the Daily Dave security mailing list over the weekend, and one thing is clear: he is chafing under the cone of silence which has been placed over the two of them."
To view parent comment, click here.
To read all comments associated with this story, please click here.
Member since:2006-01-24
Member since:2005-07-06
I'd happily buy that if they were kind enough to specifically lay out the legal threats and not just imply them. If they even showed proof that Apple was threatening them with more than raw slander I'd take that as some evidence in favor of their claims. But just general "I'd prove it too you, but the results would just be too bad" just doesn't do it for me.
Member since:2005-07-13
So you wouldn't mind giving these guys access to your crack legal team? We cannot over look the possibility of legal encumberments placed to full disclosure. Read what he says about the involvement of legal elements.
That's the part that seems overlooked, we're talking about Apple here. The company that litigates bloggers. Whether justified or not is moot, Apple has worked hard at generating a mentality of fear when it comes to discussing that which should not be discussed.
Certainly I would agree that any reported security exploit should be taken with a grain of salt unless the researchers can document it and it can be reproduced. I can also understand the risks with releasing critical vulnerability information without providing time for manufacturers to patch and release, so for something like this I'd be satisfied for now if it could at least be reproduced by a trusted and objective third-party without necessarily providing full disclosure. As "researchers", they also slightly shot themselves in the foot with the offhand remarks they initially made about smug Mac users since that impacts the perception of their objectiveness and hence their credibility.
But Apple deserves a bit of a cloud hanging over them until this is resolved one way or the other, since the researchers have a very legitimate concern for legal repercussions given Apple's own history. The researchers imply they can't discuss for fear of legal retaliation from Apple, and Apple won't actually state emphatically that the flaw does not exist. For that reason alone I'll give the researchers the benefit of the doubt. For now, at least.
If Apple's concerned that public information on the flaw puts their customers at risk, I can live with that though it at least deserves an acknowledgement that they're taking it seriously and assessing it. But if they're simply worried about their image being tarnished and hoping to simply slide in a future update to address it without anybody noticing, well then their customers deserve better.
Anyways, just my 2c.
EDIT: Ok, so after a little more googling I see now that Apple has firmly stated that they have not received any exploit code or proof of concept from Secureworks, and Atheros has stated the same. So maybe I'm leaning more towards Apple in this one, though with Apple's crack legal team I'm still willing to give the researchers some benefit of the doubt, just incrementally less than I originally was.
But I will admit that short of an NDA they may have had in place previously with Secureworks or some loophole they're exploiting by claiming EULA or DMCA or some such violation, I'm not even sure I could imagine exactly what legal hold Apple could have. But then again, IANAL. So I guess I just don't trust Apple more than I don't trust the researchers.
Edited 2006-09-05 03:20
The Verge pointed me to a blog post by Leap Motion - which reveals how their Kinect-like motion control works with Windows 8. "From the second you plug in your Leap Motion Controller, you'll be able to browse the web and interact with your computer just by moving your hands and fingers in the air. With Leap Motion technology and Windows, you can do everything that's possible with multi-touch inputs - without actually touching anything. This also means that existing applications in Windows 7 and 8 will respond to your natural hand and finger movements. Soon, we'll show you how Leap Motion will work with Mac OS X." Quite cool.
PocketNow interviews Marc Dillon, and there's an interesting note about why Jolla is keeping the display properties under wraps: "We're leaving some of those details out because we do understand that there are a lot of really big players in the market and they tend to take certain components in the market and dominate them. We created the ability to actually be able to run Sailfish on multiple hardware displays and be able to swap components, so this is part of the demand and supply planning phase. We are committed to this industrial design which is a 4.5-inch display, an 8 megapixel camera on the back and a front-facing camera at the front, and the exact specs of the display we'll provide when we're close to delivery." Something you rarely hear anything about.
"This is my NeXTstation Turbo Color booting the Mac System 7.1 Operating System using a hardware add-on called 'Daydream'. The Daydream has a Mac ROM and a few custom ICs in it and hooked up to the NeXTs DSP port. Turns your NeXT into a full fledged 68k powered Mac." So cool.
"The NetBSD Project is pleased to announce NetBSD 6.1, the first feature update of the NetBSD 6 release branch. It represents a selected subset of fixes deemed important for security or stability reasons, as well as new features and enhancements. Please note that all fixes in the prior security/bugfix updates (NetBSD 6.0.1 and 6.0.2) are also in 6.1."
"At the end of a week in which Electronic Arts confirmed it wasn't developing a thing for the Wii U, one of the software engineers in EA Sports' Canada studio, in a series of since-deleted tweets, disparaged the console as 'crap' and suggested Nintendo should give up on hardware altogether. 'The Wii U is crap. Less powerful than an Xbox 360. Poor online/store. Weird tablet', tweeted Bob Summerwill, listed as a senior software engineer at EA Canada, in a reply to a tweet posting a link about EA's no-Wii U news. 'Nintendo are walking dead at this point'." The Wii U is turning into the 21st century's Virtual Boy.
"In NixOS, the entire operating system - the kernel, applications, system packages, configuration files, and so on - is built by the Nix package manager from a description in a purely functional build language. The fact that it's purely functional essentially means that building a new configuration cannot overwrite previous configurations. Most of the other features follow from this." Interesting approach. A Linux distribution, sure, but with some very refreshing ideas about system configuration.
Appfour added, among other features, C/C++ support to its new version of AIDE. From Android-IDE, "Now you can write parts of your app or your whole app in C/C++ on your device. AIDE supports the Standard Android NDK toolchain (GCC 4.6 + Bionic, STL, ...). No changes are necessary if you want to build an app developed on a PC with Eclipse. C/C++ development is fully integrated: Build errors appear in the error list and files can easily be navigated to with Go to file. The editor supports C/C++ syntax highlighting."
Ars nails it: "The answer is that Google did announce what amounts to a fairly substantial Android update yesterday. They simply did it without adding to the update fragmentation problems that continue to plague the platform. By focusing on these changes and not the apparently-waiting-in-the-wings update to the core software, Google is showing us one of the ways in which it's trying to fix the update problem."
"It is good for programmers to understand what goes on inside a processor. The CPU is at the heart of our career. What goes on inside the CPU? How long does it take for one instruction to run? What does it mean when a new CPU has a 12-stage pipeline, or 18-stage pipeline, or even a 'deep' 31-stage pipeline? Programs generally treat the CPU as a black box. Instructions go into the box in order, instructions come out of the box in order, and some processing magic happens inside. As a programmer, it is useful to learn what happens inside the box. This is especially true if you will be working on tasks like program optimization. If you don't know what is going on inside the CPU, how can you optimize for it? This article is about what goes on inside the x86 processor's deep pipeline."
"It was the only moment I heard regret slip into Otellini's voice during the several hours of conversations I had with him. 'The lesson I took away from that was, while we like to speak with data around here, so many times in my career I've ended up making decisions with my gut, and I should have followed my gut,' he said. 'My gut told me to say yes.'" The world would've been a much different place - Apple would have been less dependant on Samsung for its chips, which probably would've meant less money for Samsung to develop its Galaxy business.
Member since:
2005-07-06
I think that's not really that reasonable honestly. I mean the position is that if you decided to actually prove your claims the opposition would just deny reality in the face of your evidence. Which while that in itself is indeed quite a possibility and comes up in many arguments these days concerning topics such as religion.. it doesn't seem to fly that well when we're talking about something this simple. If you have something pretty fantastic but refuse to prove it because you don't think anyone will believe you, typically you just look like a nut. As a Mac user and a rather big fan honestly, if he can prove this I want to freaking know. I don't care about Apple's rep on this. If the problem's real I want a fix. However this story just keeps getting more convoluted and harder to believe.