Hacker News
points by lrvick 4 days ago | 0 comments
Apple does not brag about using Linux, and while I will not call anyone out directly because it is a great resource, resumes of current and former Apple DevOps/Security engineers describing what they worked on are quite telling.

All sorts of intel you can get about all sorts of companies that way.

[–] fastily 4 days ago
Yeah but that’s just hearsay right? To reiterate my original point, I’m not disagreeing with you, however I’d love to see some documentation and/or hard evidence of these alleged shoddy security practices at Apple
[–] lrvick 4 days ago
What company publicly documents their shoddy security practices?

That is part of the entire problem in the industry. No standards and no accountability. Those with the purse strings only invest in security that is marketable or protects IP. Anyone that invested in proper remotely attestable provably quorum managed systems is going to be bragging about it and happy to show off the proof to earn trust from their customers. I do.

When no one is bragging about doing these things, it is because they are not doing them, and they just have a bunch of humans running around with god powers to execute any code they want on production systems or in binaries that will end up on your laptop.

To get a clue about their internal practices, lets see what they do when everyone is watching in public.

https://github.com/apple/foundationdb/commits/main/

No signed commits, no signed reviews. Merges done via browser. One Github API token away from being supply chain attacked. Also put one of those recent usernames into "forgot my password" and you can verify they do not mandate hardware 2FA. One compromised email account and you get to make a PR as a rando, then merge it with an Apple account and huzzah, you now have code in a critical repo used internally at Apple. Also releases are not signed or reproducible and are just cut by github actions. Another API key you could use to be even sneakier.

Almost any community maintained Linux distro does way better than this. Inexcusable for an org of their resources.

If this is how poorly Apple handles supply chain integrity in public, why would anyone believe they do any of this internally. I have also talked with multiple current and former Apple employees close to such things off the record but obviously will not out which ones.

[–] fastily 4 days ago
Respectfully, I think you're missing my point here. When someone presents a claim, I hope you understand that the onus is on the claimant to provide evidence of their claim. Extraordinary claims require extraordinary evidence. I could just as easily assert that aliens from Jupiter visited me yesterday afternoon for tea but I can imagine you would like to see some evidence before wholeheartedly agreeing with me. Again, I don't think you're necessarily lying about the "plaintext god-mode access", but I am hoping you'll show us some evidence; "trust me bro" isn't good enough
[–] lrvick 4 days ago
I -did- give you clear public evidence of severe gaps in their supply chain security on at least one heavily relied on Apple software library. Same is true of all their public repos and code.

What better evidence could I possibly provide?

Also see the other commenter in this thread who identified themselves as a former Apple contractor admitting Apple uses Jenkins. -Jenkins-.

[–] fastily 4 days ago
> plaintext God access to all of it from their individual engineer ssh keys

Scroll up, I asked for evidence of this specifically. This is a pretty damning allegation and worthy of further examination given the security implications for many, many users. Frankly, whatever they're doing in unrelated public repositories is concerning in a different context but otherwise thoroughly irrelevant to this claim above

[–] lrvick 4 days ago
Was easier to find public proof than I expected.

https://jobs.apple.com/en-us/details/200440680-3337/senior-l...

Puppet does not have quorum signing or approval support. By -design- it means one god server that ultimately trusts every ssh key of every admin to make changes to a fleet of -malleable- RedHat servers via ssh like it is 2005.

But for just one attack chain to humor you:

1. Malicious party gets access to one Apple engineer ssh key (Or literally just their email account since they sign nothing and the key could be swapped out temporarily)

2. They make a PR injecting a subtle malicious dependency to any of the core Apple component repos almost certainly used on prod servers on the Apple github.

3. They use their stolen key to merge the PR.

4. Code lands in next release and eventually lands in Apple production servers because nothing is signed so how would anyone know?

We learned nothing from xz.