Subject: [saag] Is Apple ever going to fix its certificate chain handling code?

From: Phillip Hallam-Baker <[email-masked]>
Date: Sun, 22 Nov 2015 10:05:47 -0500

I am still getting validation failures for perfectly TLS good certs on
Safari and Chrome.

The bug is caused by the path math failing when a machine has somehow
acquired a cert chain containing a roll over root that isn't in the
Apple trust store.

Reporting it here since reports to Apple security team over the past
two years have had absolutely no effect or resulted in a response.
Suggest you guys fix it before I appear on CNBC or the like. I don't
think Tim Cook would appreciate discovering you folk are asleep at the
switch on security and you never ever respond to bug reports.

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Sun, 22 Nov 2015 18:39:39 -0500

Just to be clear, I realize this is not a SAAG responsibility. It is
just that at this point I am running out of options and I would prefer
to avoid more aggressive tactics.

I am quite capable of thinking up a cute name for the attack and
calling up the trade press. But I prefer to avoid such approaches.

I note that under Apple Inc. bylaws, 5.14 any business to be put
before the shareholder's meeting has to be notified to the company
Secretary in the next few weeks.