Hacker News
points by fastily 4 days ago | 0 comments
Respectfully, I think you're missing my point here. When someone presents a claim, I hope you understand that the onus is on the claimant to provide evidence of their claim. Extraordinary claims require extraordinary evidence. I could just as easily assert that aliens from Jupiter visited me yesterday afternoon for tea but I can imagine you would like to see some evidence before wholeheartedly agreeing with me. Again, I don't think you're necessarily lying about the "plaintext god-mode access", but I am hoping you'll show us some evidence; "trust me bro" isn't good enough
[–] lrvick 4 days ago
I -did- give you clear public evidence of severe gaps in their supply chain security on at least one heavily relied on Apple software library. Same is true of all their public repos and code.

What better evidence could I possibly provide?

Also see the other commenter in this thread who identified themselves as a former Apple contractor admitting Apple uses Jenkins. -Jenkins-.

[–] fastily 4 days ago
> plaintext God access to all of it from their individual engineer ssh keys

Scroll up, I asked for evidence of this specifically. This is a pretty damning allegation and worthy of further examination given the security implications for many, many users. Frankly, whatever they're doing in unrelated public repositories is concerning in a different context but otherwise thoroughly irrelevant to this claim above

[–] lrvick 4 days ago
Was easier to find public proof than I expected.

https://jobs.apple.com/en-us/details/200440680-3337/senior-l...

Puppet does not have quorum signing or approval support. By -design- it means one god server that ultimately trusts every ssh key of every admin to make changes to a fleet of -malleable- RedHat servers via ssh like it is 2005.

But for just one attack chain to humor you:

1. Malicious party gets access to one Apple engineer ssh key (Or literally just their email account since they sign nothing and the key could be swapped out temporarily)

2. They make a PR injecting a subtle malicious dependency to any of the core Apple component repos almost certainly used on prod servers on the Apple github.

3. They use their stolen key to merge the PR.

4. Code lands in next release and eventually lands in Apple production servers because nothing is signed so how would anyone know?

We learned nothing from xz.