Tuesday, July 9, 2002

The media's all abuzz about a security problem in Apple's Software Update, which is susceptible to a DNS spoof attack. While this is admittedly a problem, I have to say that I don't really think it's a big deal. If someone's spoofing DNS on your network they can trick you into doing more or less anything, so the fact that they can do it via Software Update isn't really impressive. Should Apple fix it? Sure. They just have to sign their downloads and they'll never have to hear about it again. But I'd much rather see them focus on changing password files to not be world-readable first. I'm surprised that hole hasn't received far more attention than the DNS spoofing problem. [Eric's Weblog] 10:05:27 AM    comment []