Securosis is an information security research firm whose analysts write about cloud security, Apple security features, and industry practice.
HN links it for technical security explainers on iMessage, Gatekeeper, NoSQL injection and cloud billing; commenters cite it to support points in discussions.
> "They are not asking for some general thing, they are asking for a particular case."
Was hoping Gates would be less naive in thinking this legal precedent has anything to do with this specific case which has close to 0% chance of providing any real-world information and more to do with the fact that this tragedy is used as political theatre and being exploited for maximum PR and political influence.
> "Should governments be able to access information at all or should they be blind, that's essentially what we are talking about"
That's one way to frame the debate, the other is "Do We Have a Right to Security?" https://securosis.com/blog/do-we-have-a-right-to-security
Given the US Govt is coming from a position of no trust who've shown a willingness to over reach and break the law whilst continuing to deceive and mislead the public - US citizens have every right to privacy that's insulated from the Government: http://blog.easydns.org/2016/02/22/the-us-government-has-no-credibility-to-compel-anybody-to-weaken-security/
When Mac OS X updates the signature on a binary (for instance, when you configure a firewall rule for a previously unsigned binary), the actual Mach-O file will be changed -- and your digest will be incorrect.
Skype (which has notoriously complex obfuscation) had this problem for a short time when Mac OS X 10.5 was released:
http://securosis.com/blog/leopard-firewall-code-signing-breaks-skype-and-other-applications
You can work around this by validating only the important subset of the Mach-O contents, but it's probably not worth it. Cracked applications (rather than, say, reverse engineered serial number generators) are an annoying thing to use -- you'll have to refrain from applying updates until you get a new crack, trust the person distributing the crack, etc.
It's not something I (or, afaik, most other small Mac developers) really worry about.
This seems to be the natural outcome of Amazon's excellent customer service policy, where they have on numerous occasions[0] refunded costs for hacked instances. When they commit to that policy, they have a huge incentive to limit customer security breaches.
I love examples like that where a company's policies result in incentives that are so well-aligned with those of their users. Does anyone have other good examples to share?
[0] https://securosis.com/blog/my-500-cloud-security-screwup and http://vertis.io/2013/12/17/an-update-on-my-aws-bill.html are two examples.
Many devs I speak and work with are either ambivalent or disillusioned about agile. In my circles this article keeps coming up in discussions about agile - https://securosis.com/blog/agile-development-and-security/.
Server-Side JavaScript Injection: Attacking NoSQL and Node.js https://securosis.com/blog/nosql-and-no-security
Here's a good reply http://securosis.com/blog/ranums-right-for-the-wrong-reasons