FaceTime bug lets you hear audio of person you are calling before they pick up - <AUTHOR> https://9to5mac.com/2019/01/28/facetime-bug-hear-audio/ <comment><USER2> I'm always curious how a bug like this ships. I mean QA & Testing should catch it, sure. But even before then. Some engineer wrote code for FaceTime that has it open the microphone before the call is accepted. And transmit the audio over the network before the call is accepted. Who did that? And why? I'm not suggesting malice but I do wonder at the lack of defensive programming.

<comment><USER3> It reminds me of this MacOS bug from last year, where simply hitting the login box over and over with no password would eventually bypass the security entirely:

[https://www.theregister.co.uk/2017/11/28/root_access_bypass_...](https://www.theregister.co.uk/2017/11/28/root_access_bypass_macos_high_sierra/)

And this other MacOS bug, also from last year, where the password hint would contain the plain text encryption password:

[https://www.theregister.co.uk/2017/10/05/apple_patches_passw...](https://www.theregister.co.uk/2017/10/05/apple_patches_password_hint_bug_that_revealed_password/)

All within a month of each other.

<comment><USER4> Edit: Deleted my comment because I felt it wasn't constructive.

<comment><USER5> There was one guy on reddit who had a scare when his computer flashed a picture of a dead person when shutting down, and he thought his computer was haunted. It turned out to be a frame from a youtube video he was watching earlier. It may be that macOS is not that good at clearing out GPU memory sometimes.

<comment><USER6> I have the exact opposite problem. When I reboot after system updates, half a dozen YouTube videos in Chrome tabs start playing over each other on the password screen. They get through about 20 seconds before I can stop the last of them.

Audio only on the password screen, but all audible.

</comment></comment></comment></comment></comment><comment><USER7> Rumor mill: FaceTime bug was submitted to Apple on 20 January 2019 by a concerned mother after .. her 14-year-old son discovered it.

>My teen found a major security flaw in Apple's new iOS. He can listen in to your iPhone/iPad without your approval. I have video. Submitted bug report to @AppleSupport...waiting to hear back to provide details. Scary stuff! #apple #bugreport @foxnews

[0] [https://twitter.com/mgt7500/status/1087171594756083713?s=21](https://twitter.com/mgt7500/status/1087171594756083713?s=21)

<comment><USER8> Interesting twitter account. First tweet 1/1/19, few followers, mostly politics, then a major bug report (not only in discovery but in knowing how to go through the reporting process). Not saying it's fake at all - it looks 100% legitimate - but it adds some extra bit of weirdness to this story. Quite the providence, and a really bad bug. (edited for clarity)

<comment><USER9> The genuineness of the Twitter account is absolutely irrelevant in contrast to the validity of the bug itself.

Apple was reported a high priority bug at a specific time. Who reported it, how they look like, what their Twitter profile looks like should have no impact on Apple's bug fixing process and how long/short they took to fix the bug.

<comment><USER8> Oh I'm not questioning the existence or importance of the bug. It's important and a big screwup.

However, I _am_ extra sensitive to the degree to which twitter is being manipulated for all sorts of ends. Sometimes things look more than a bit fishy. Usually major bug reports don't come from 2019's version of egg avatar + letters/numbers username + very recent activity consisting almost entirely of political posts + past tweets with interactions with obvious political manipulation bots. That is on the stranger end of things, you have to admit. To be clear I think it's real, but also real weird.

<comment><USER10> What possible motivation would anyone have for reporting a real bug of this nature like this? Other than, yeah, found a crazy bug.

<comment><USER8> Stock manipulation perhaps? Happens a lot with Tesla apparently, short sellers will pump up any negative story and try to get it into press. This person was making several attempts to get in contact with press after all, and a story about a teenager finding a big privacy bug in a company that publicly touts its privacy chops has 'news at 11' written all over it.

Personally I think a bug report story is not a particularly plausible strategy for such a thing - this person's concern seems entirely genuine - but crazier things have been done for money. I'm relatively skeptical of complaints from companies about short sellers and bad press, but also recognize that stock manipulation happens a lot more than most ppl are aware of.

<comment><USER9> Is it still called stock manipulation if the bug is critical and for real and the company deserves to lose shareholder value simply for the critical nature of the bug?

Imagine how many people are vulnerable out there - I'm already starting to read some complaints on the internet that some people were unknowingly sharing a video of them taking a shower, etc.

<comment><USER11> If you're are in possesion of information with the potential to impact the stock price when released and you use it in your own favor to try to make a profit, then I believe it can be characterized as an attempt of stock manipulation.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> Security and privacy are two big parts of the marketing for the iPhone.

I'm curious how they can mitigate the reputational damage.

Edit:

It gets worse:

[https://www.theverge.com/2019/1/28/18201383/apple- facetime-b...](https://www.theverge.com/2019/1/28/18201383/apple-facetime-bug- iphone-eavesdrop-listen-in-remote-call-security-issue)

If the recipient rejects the call by pressing the power button, it starts sending video.

<comment><USER13> Why would this be any more reputationally damaging than the numerous other bugs with iPhone behavior?

It's not like iPhones have a reputation for not having bugs; it seems like every version has a passcode bypass or a DoS-via-iMessage. By some standards, this is worse (remotely triggerable, leaks audio/video), but in other cases it's not as bad: the attacker's Apple ID ends up in the call logs of the affected person.

Are there prior examples of any phone manufacturer being reputationally damaged by vulnerabilities like this? Heck, Samsung's phones literally caught fire and they're still selling phones just fine.

<comment><USER14> > Why would this be any more reputationally damaging than the numerous other > bugs with iPhone behavior?

Oh I don't know, someone denied the call because they're possibly in the shower, or other inappropriate moments. Oh look now they're naked on a video call... Yikes!

<comment><USER13> I feel like you're answering a different question that I asked. I don't think the bug is low-severity.

I'm asking:

Is there any historical evidence that high-severity bugs in iPhones (or really any mobile phone) are reputationally damaging, sufficiently that Apple would worry about the impact of this bug?

I'm not aware of any instance in the past where a high-sev iPhone bug had noticable long-term impact. This is similar to other issues, like the Sony PSN hack, where despite the gravity of the issue, everything continued long-term as if nothing had happened.

<comment><USER15> > Is there any historical evidence that high-severity bugs in iPhones (or > really any mobile phone) are reputationally damaging, sufficiently that > Apple would worry about the impact of this bug?

I'm sure Apple "worries" about any bug and its potential impact on its reputation, particularly in the area of privacy, where it has a leg up on Android at least in perception.

That said, what historical bug is up to this one for iOS? This is a big deal and I cannot recall anything similar.

edit 1: this hasn't exactly been a banner couple of months for iPhone. You'd expect that mitigating _any_ negative news about the device would be paramount

edit 2: look to Facebook. I find it encouraging that people have reacted so negatively to a company acting so cavalier with their personal data and privacy. Yes, I think Apple cares, moreso than with other bugs.

<comment><USER13> [https://www.zdnet.com/article/ios-mac-flaw-exposes-your- pass...](https://www.zdnet.com/article/ios-mac-flaw-exposes-your-password- with-one-image-file/)

Where sending somebody a .tiff file via iMessage, web page, or email would give the attacker RCE on the device.

<comment><USER16> The article slug is misleading, and suggests a fundamental misunderstanding of the scope of the bug. A RCE in Messages does not allow attackers to steal your passwords.

<comment><USER13> The ask from the comment I'm responding to was for comparable vulnerabilities to this one, since this comment thread is discussing reputational damage from high-sev vulnerabilities. This vuln gives RCE in iMessage, which is an app that has microphone/camera access, so I'd say it's clearly comparable.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> Apple's bug handling is broken.

Anyone who has filed a few rdars knows it is thankless work. The amount of work you have to invest for anyone to even look at your bug is high. In the instance of this particular bug, I wouldn't be surprised if at least part of the reason it took a week and a half to handle since it was reported was that the initial reply to the reporter was "please send us the exact steps to reproduce" and then nothing was done until the bug reporter replied back. I wouldn't be surprised to learn there were even a few iterations of this, since I personally experienced it.

Then, your bug gets looked at. But you don't know anything about its status. Until anything from a few days to a few months later, it gets closed as a duplicate. Of course there is no way to know in advance that the bug was already opened, and that you could save an hour of work time instead of making a minimal reproducible version of your app which reproduces the bug.

At least, that's been my unfortunate experience.

/rant

</comment><comment><USER18> Apple has disabled group FaceTime on their end. [https://www.apple.com/support/systemstatus/](https://www.apple.com/support/systemstatus/)

<comment><USER19> Oh damn, they can do it just like that?

I thought FaceTime was a P2P thing... but it appears group FT requires Apple's servers?

<comment><USER20> Very few communication services are truly P2P; it's way more likely to have syncing issues and is virtually impossible without at least a handshake. Even Signal, which does have syncing issues due to being mostly P2P, requires a server for the initial handshake.

<comment><USER21> Especially on mobile, where you want to conserve battery life.

</comment></comment></comment></comment><comment><USER22> It may be entirely unrelated, however this is the exact sort of behaviour you would expect to see associated with providing compatibility with Australia's newly introduced AABill, or to implement GCHQ's ghost participant proposal ([https://www.lawfareblog.com/principles-more-informed- excepti...](https://www.lawfareblog.com/principles-more-informed-exceptional- access-debate)).

<comment><USER23> The bizarre thing is how little people seem to have paid attention to Snowden. Apple joined the NSA's PRISM program in 2012. [1] PRISM enables the government to access data from participating companies including audio, video, and _live_ chat. I'm linking to Wiki there only as a catalogue of sources. The page itself is useless and has overtly fake (though at least mildly amusing) quotes from Google. There's no need for new bills for these sort of issues to be a concern.

I also tend to agree with you that this is not necessarily related to these programs. The reason I mention this at all is because I think there is a reasonable chance that this is related, that this overall issue is very important, and that the amount of cognitive dissonance on this is surprising and regressive. These programs are real. Companies facilitating access, including real time, to your data and "private" conversations is real. And it seems to only be getting worse. Yet people seem to convince themselves otherwise, including throughout this thread. Part of the reasons these programs are able to carry on mostly unchallenged is because people convince themselves that what is happening, is not.

[1] - [https://en.wikipedia.org/wiki/PRISM_(surveillance_program)#M...](https://en.wikipedia.org/wiki/PRISM_\(surveillance_program\)#Media_disclosure_of_PRISM)

</comment></comment><comment><USER24> That's a pretty huge flaw. Millions if not billions of people can suddenly remotely spy on almost any other ios or mac anywhere in the world, just by knowing their email address or phone number?

Perhaps Apple should simply pull the plug on the facetime servers for now.

<comment><USER25> _That 's a pretty huge flaw. Millions if not..._

Is it just me, or is such a phrase applicable to Apple far too many times in the past several years? I think their engineering is losing quality or is falling behind on what they have to cover.

<comment><USER26> Comparable examples?

<comment><USER25> Just off the top of my head: I think on three separate occasions, specifically crafted text messages have made the Messages app disappear from iOS, requiring a reboot. There was a comparable MacOS login bug not too long ago.

</comment></comment></comment></comment><comment><USER27> Perhaps their NSA PRISM code got mixed up with their user facing code? I'm not just joking, we all know Apple only pays lip service to privacy and got caught red-handed during the Snowden leaks.

VOIP is indeed listed. [https://cdn.vox- cdn.com/thumbor/6r9jLyDaTuh8MlCgiL-9Uq588TQ=...](https://cdn.vox- cdn.com/thumbor/6r9jLyDaTuh8MlCgiL-9Uq588TQ=/0x0:700x525/1820x1213/filters:focal\(294x206:406x318\):format\(webp\)/cdn.vox- cdn.com/uploads/chorus_image/image/61159115/prism-slide-4.1419979622.0.jpg)

</comment><comment><USER28> I just called my friend who was already on a call talking to his brother. He could hear me and his brother but his brother and I couldn't hear each other.

I was also able to call him, have him hang up and then see his video and hear his audio. He couldn't hear me, but I could hear and see everything.

I'm turning my phone off tonight!

<comment><USER29> is it not enough to disable FaceTime for the time being?

<comment><USER30> It probably is, but when you are freaked out you want certainty.

<comment><USER31> Better remove the battery too. [https://www.tomsguide.com/us/nsa-remotely- turn-on-phones,new...](https://www.tomsguide.com/us/nsa-remotely-turn-on- phones,news-18854.html)

<comment><USER32> Which you cannot do on iPhones.

<comment><USER33> ifixit.com :-)

</comment></comment></comment></comment></comment></comment><comment><USER34> The other day my friend Alice (not real name) attempted a FaceTime call to Bob. To both our surprise my phone rang with a FaceTime call from Alice (and as far as we know, Bob never received the call). Holding both our phones together, Alice phone was showing a call to Bob while my phone was showing a call from Alice. A very strange fluke which makes me wonder how robust the FaceTime code is.

<comment><USER35> Not sure if this was intentional but in security, Alice and Bob wre the names in hypotheticals for the attacker and unwitting victim since the RSA paper.

[https://en.m.wikipedia.org/wiki/Alice_and_Bob](https://en.m.wikipedia.org/wiki/Alice_and_Bob)

<comment><USER36> Your comment shows a clear lack of contextual insight into general software security. Alice (A) and Bob (B) are ubiquitous in discussions:

[https://en.wikipedia.org/wiki/Alice_and_Bob](https://en.wikipedia.org/wiki/Alice_and_Bob)

<comment><USER37> Not sure his comment deserved a response like that.

</comment></comment></comment></comment><comment><USER38> Fun story: I tested this bug, initiating a call from my phone and then joining it on my Mac. After I had ended the call, the Mac's camera LED stayed on, even though the FaceTime app was not showing a video preview (in fact it had no windows open). Was it transmitting? Who knows! State management seems to be a mess all over the place.

<comment><USER16> This means your camera was in use by some application. Whether that video left your device is harder to ascertain, but you can try quitting FaceTime to see if the light turns off.

</comment></comment><comment><USER39> While they're getting a fix ready, might be smart to just disable FaceTime if you don't rely on it.

[https://www.imore.com/how-to-turn-on-off-restrict- facetime-i...](https://www.imore.com/how-to-turn-on-off-restrict-facetime- iphone-ipad)

<comment><USER40> That just seems like a good idea anyways. FaceTime as a product just flat out seems stupid.

<comment> yoz-y Why? I use it all the time and in terms of simplicity it beats all other video calling products.

<comment><USER41> I'll take a stab at that, although I don't think it's stupid per-se. Everyone I talk to, I talk to via WhatsApp, LINE, or FB Messenger, and generally I only use that method to talk to them, whatever else they're on. All of those have easy one-press buttons to initiate video call. Using some kind of Apple-only technology?

I mean I think most people I know are probably on an iPhone, but having to remember everyone's device to know if they can FaceTime? Ugh. I suspect I could work out how to FaceTime someone if you made me, but I'd have to work it out rather than just knowing it.

<comment><USER42> But isn't everyone being on WhatsApp or FB Messenger or whatever just elevating the device uncertainty to platform uncertainty? You still have to remember or check who is on what.

It seems like if they generally are all on iPhone, FaceTime is the one thing you could reliably call them on, and it will even tell you right in the messages app if you can FaceTime them.

<comment><USER41> > You still have to remember or check who is on what.

For some reason this comes pretty naturally to me. I guess I'm only talking to 15-20 people pretty regularly...

> it will even tell you right in the messages app

Maybe this is the disconnect. The last time I sent a message from Messages was apparently in November.

</comment></comment></comment></comment></comment></comment><comment><USER43> I wonder if the Apple representative who said this would be "fixed later this week" realizes this allows any attacker to wiretap any iPhone user (that has the vuln)

<comment><USER44> Yeah, that's bizarre. If my team were responsible for a bug like this, we'd be fixing it before we went home.

<comment><USER16> The team might be able to fix it today, but the fix needs to go through testing and then be built alongside the rest of iOS (a multi-hour process). I wouldn't be surprised if this takes two or three days to roll out.

<comment><USER45> You didn't even bring into consideration the app store approval process which can take 2-3 weeks and likely would reject this as a feature removal without user notification.

<comment><USER16> The update notes might include it ;)

</comment></comment></comment></comment></comment><comment><USER46> As an apple user I'm concerned. I hope it doesn't turn out that Apple has known about this for weeks/months/whatever.

On the upside I have a lot of confidence that they can fix this, and that I can receive that patch in a timely fashion.

<comment><USER47> They said later this week, which seems surprisingly untimely given the severity of this bug.

<comment><USER48> Also, lets not forget Trump, against security advice, has remained using his iphone. oof.

</comment></comment></comment><comment><USER49> This sort of thing is why I'd prefer devices to come with hardware killswitches for mic, video, and various radio modules.

<comment><USER50> iPhones already have a "mute" slider switch. When I first looked into iPhones (after years of Androids), my instant reaction upon seeing the slider switch was "Ah! FINALLY! I can feel at peace in the knowledge that software vulnerabilities are powerless to hack my camera or microphone!"

Of course, stupidly, the slider doesn't "mute" my camera or microphone, but only my speaker. For Apple to modify this slider so that it mutes my camera and microphones would require the daunting addition of two transistors. And the act of such a simple modification would put an end to the incredibly creepy, Orwellian possible reality that we all risk taking a part in every time we glance at the familiar tiny screens we have become so intimately glued to.

Apple should add those two transistors.

<comment><USER51> Frankly, I'm totaly in favour of hardware interrupt switches for the camera/mic - but I think I understand why it's not likely to happen. First, to a lot of people it will look like admitting your thing is hackable, which makes it seem vulnerable. Second, now every time I accept a call I have to check this switch - sounds like a switch most people will leave in the on- position 100% of the time and then when it accidentally gets flicked they'll bring their phone to the Apple store because "it's broken".

Also, I don't want my ringer to have to be on any time I take a call... but that's just a debate about if it should be one switch or two.

Also the hardware switch doesn't interrupt the speaker, it just turns the ringer to silent/vibrate mode - you can put someone on speakerphone or play music with it on.

<comment><USER52> _sounds like a switch most people will leave in the on-position 100% of the time and then when it accidentally gets flicked they'll bring their phone to the Apple store because "it's broken"._

laptops with hardware wifi and bluetooth switches. Took plenty of support calls about those.

</comment></comment></comment></comment><comment><USER53> I encountered a bug a while back — when I would connect to a dial-out call to get onto my company's conference service from its app, while using a pair of cheap Bluetooth headphones (I've upgraded since then!) the mute button didn't work.

As in, the mute button would be clearly activated, but my audio still carried through to the call. As in, I discovered this in quite an embarrassing way.

I filed a radar but never got a real response about it. Really there appears to be a strong need at Apple to ensure QA is checking for confirmations of user interaction. As I haven't experienced anything like this since I'm still with them but these types of problems are the very thing that would lead me to shake my deep investment in the Apple ecosystem.

<comment><USER54> I have serious trust issues with mute buttons. I rather not say anything I may regret while the mic is muted.

</comment></comment><comment><USER55> If I were Apple, I would be implementing a server side migration right now:

\- if someone adds their own email or phone number again to a group chat, immediately terminate the call

As far as I know, this would mitigate the vulnerability.

Alternatively, disable Group FaceTime calls altogether.

<comment><USER38> It might trigger the bug to just invite any additional participant (say, a second phone the attacker possesses), in which case blocking only inviting oneself is not sufficient.

My theory is that the server routes messages to everyone who has been invited to the call, even if they have not accepted it. One message might be "participant left," in which case if you are the last one, the call ends.

Another would be "participant joined." The bug would center around the fact that the logic for handling a "participant joined" message does not check if the call has been accepted and makes an unexpected transition to a state that it should not be in.

The "participant joined" code likely handles the case that the new participant was already present on the call. Why? Apple wants to support seamlessly transitioning your call from one device to another. That's why blocking might not be so straightforward from the server side.

</comment></comment><comment><USER56> I would like to bring up something that happened to someone I know during WhatsApp call. Person A was in US and person B in India and were audio calling through Whastapp on something work related. Person A starts hearing someone else on his side, nothing unexpected on Bs side. A started a new call and everything was fine. A said it reminded him of the crosstalk that was common during the landline days. Could it be a bug or was someone listening and forgot to turn off their mic? No idea.

</comment><comment><USER57> An quick stop for the possbile privacy disaster for Apple is to stop group facetime call at once but not wait for later this week for bug fix. Could image that quite some one might already try to peek for privacy using this.

</comment><comment><USER29> Premature optimization, perhaps. Don't optimize by sending audio too early (as others have suggested) and why should I be able to add my own number to the conversation if I that number is the call's initiator? Makes no sense.

<comment><USER58> >why should I be able to add my own number to the conversation

You might want to add several devices with the same facetime handle to the same call.

</comment></comment><comment><USER59> With the advent of microphone embedded computing devices, a bug can really become a bug.

</comment><comment><USER60> It is super crazy that when you apply for a dev job in companies like this you have to be like a small Alan Turing and yet things like this happens.

</comment><comment><USER61> A fun though experiment for a bug like this would have been to test lists of emails against validating the ability to FaceTime call with the email and determine if it was used as the iCloud email address...

Had this bug gone unknown longer - then you'd have a list of all the endpoints you could spy on.

</comment><comment><USER62> People always ask me why I have the camera on my computer covered. There is still far too much trust in technology.

</comment><comment><USER63> What about updates for people who don't update often or don't even see that there's an update? This is way too critical a bug for people who don't follow the news to not be taken care of (their devices, I mean). Apple keeps pushing major new version iOS downloads forcefully down to devices without any way of opting out, yet what I've seen is that point updates are left as optional and may not even show up unless one checks for an update.

As much as forced new feature updates take freedom away from users, Apple needs to up its game on security fixes like this (that could be standalone) being pushed to all compatible devices ASAP (no waiting for the phone to be on the charger overnight, etc.).

<comment><USER16> > Apple keeps pushing major new version iOS downloads forcefully down to > devices without any way of opting out

iOS upgrades are not mandatory by any means.

> no waiting for the phone to be on the charger overnight, etc.

This is how you get phones running out of battery halfway through an update.

<comment><USER63> > iOS upgrades are not mandatory by any means.

The upgrades are not mandatory, but the downloads certainly are. I've had to delete the iOS downloads several times over years (including the downloads for iOS 12) because iOS doesn't have an option to disable this, and it automatically downloads the upgrade in the background when on WiFi for a long enough time. It's a cumbersome process to delete the download. It's even worse when you consider that a downloaded update would be installed overnight if you leave the device on the charger and connected to WiFi and by mistake tap on install when that prompt appears at some random time. The user interface for controlling and managing iOS upgrades does not exist.

> This is how you get phones running out of battery halfway through an update.

The OS could always put a limit saying the phone should be charged at least 30-40% for an update to start installing. Even now, the upgrades and updates are allowed to go through for iPhones without them having to be on the charger.

</comment></comment></comment><comment><USER64> I must admit that when reading yet another privacy-invasion-headline I saw "Facebook", not FaceTime/Apple. Not sure whether it's more indicative of unjustified prejudice or actual precedent.

<comment><USER65> The difference is that Facebook does it intentionally.

</comment></comment><comment><USER66> Tomorrow's earnings call should be fun

</comment><comment><USER67> FaceTime audio ducking is the worst thing about FaceTime. Impossible to watch something online with another person.

Also, FaceTime never closes after a call cleanly. Camera stays up until you right click + quite the app...

</comment><comment><USER68> Isn't it fantastic that the exact same bug works on 2 different OSes?

<comment><USER69> Not exactly. There is likely a lot of common, if not identical code.

</comment></comment><comment><USER70> Oof. I am reasonably sure very very soon there will be a number of very polite but very pointed questions on Apple's desk from concerned lawmakers, data protection authorities and such not only from the USA but the European Union as well about how this happened and what are they doing to make sure this doesn't happen again. I can very well see the European Data Protection Supervisor fining them to some very interesting amount as well.

</comment><comment><USER71> "Sagem GSM phone let's you hear the other party's audio before you pick up" \- Demonstrated this last time about 6 years ago calling my phone from different networks: fixed, and two other GSM. My conclusion was that it's an implementation bug easy to trip on or a provision in standard that it's easy to misread.

Now - if the audio channel is _right there_ for you to read, what chances are for this to be only a Sagem firmware bug?

</comment><comment><USER72> Just thinking out loud here - why isn't there legislation that makes it mandatory for phone manufacturers to send out a notification to all devices affected by serious security flaws (like this one)? Not only will fixing and rolling out an update take a while, there is also no guarantee that the update will be installed. Meanwhile, hackers will have a field day.

Or maybe there is already one, and I'm blissfully ignorant!

<comment><USER73> Just to play devil's advocate (not a lawyer though):

What constitutes a "phone"? Any device with cellular capabilities? What about WiFi calls? What if it's an industrial device with no network (LTE/data) access? Is a laptop with a 3G modem covered under this?

I would suspect the problem is in defining what devices to target, and also the fact that forcing any company to modify the functionality could be perceived as a slippery slope (i.e. security notifications first, NSA backdoors later...)

In Apple's defense, it is pretty difficult to miss an update alert considering it comes through as (a) a push notification, (b) a mandatory alert, and (c) a persistent red badge on the Settings app.

I agree that it might be a good idea to differentiate between a normal update and a security critical one, though.

<comment><USER72> Valid points. How about restricting the scope to devices connected to a network and having some sort of push notification capability?

> In Apple's defense, it is pretty difficult to miss an update alert > considering it comes through as (a) a push notification, (b) a mandatory > alert, and (c) a persistent red badge on the Settings app.

> I agree that it might be a good idea to differentiate between a normal > update and a security critical one, though.

But there is no mention of severity like you pointed out, and that is crucial. And till such a patch is available, Apple should notify users to disable offending apps/features if possible.

<comment><USER74> So... every computer running some sort of syslogd?

<comment><USER72> Not sure if I'll define it that way, but why not? If my mobile device is capable of showing inane ads as push notifications, why can't I expect security advisories to be delivered that way?

</comment></comment></comment></comment></comment><comment><USER75> > In a statement, an Apple spokesperson said the company is "aware of this > issue and we have identified a fix that will be released in a software > update later this week."

[https://www.buzzfeednews.com/article/nicolenguyen/facetime-b...](https://www.buzzfeednews.com/article/nicolenguyen/facetime- bug-iphone)

</comment><comment><USER76> Reminds me of the time I FaceTimed my mother (in Australia) only to see the call answered by a total stranger (in Texas).

</comment><comment><USER77> On the 1st of November a friend shared with me a screenshot from the Instagram of a concerned parent explaining a situation in which her child was being cyber bullied, and it was clear from the content of the messages that the bully could her their private conversations.

I guess this bug has been know and abused for at least three months?

</comment><comment><USER78> I'll admit I have limited knowledge on iPhone security... But would it be technically possible to do this with other apps? For example if one has Wechat, can there be a backdoor to be listened in on? Thinking about state actors...

</comment><comment><USER79> I don't want to be harsh, but Apple really should walk the talk regarding privacy. It has its heart in the right place but bugs like this show how careless they are.

<comment><USER80> I never thought of Apple as caring much about privacy given the insane amount of third party tracking scripts loaded in apps on the AppStore. What I would give for LittleSnitch running on iOS...

<comment><USER81> Set up [https://www.charlesproxy.com/](https://www.charlesproxy.com/) on the same network as your phone, then set it to be the phone's proxy server. Voila, you can now be horrified by the amount of tracking going on. You can even MITM SSL traffic by adding a trusted CA to your phone.

</comment></comment></comment><comment><USER82> Amazon calls this a feature in Alexa!

<comment><USER83> This has been disproven time and time again.

<comment><USER84> OP is referring to the ability to tap into any Alexa device, a feature Amazon calls Drop In ([https://www.amazon.com/gp/help/customer/display.html?nodeId=...](https://www.amazon.com/gp/help/customer/display.html?nodeId=202153130)).

<comment><USER48> Google Duo does offers it as well.

<comment><USER85> I think you're referring to the Duo feature which shows a video of the caller to the person being called prior to answering. Basically the opposite of drop in and of this FaceTime issue.

</comment></comment></comment></comment></comment><comment> d-sc Just tried this with my brother. Apparently I can listen to his iMac audio from my phone. This could mean and increase in the time to fix the bug.

</comment><comment><USER86> I guess when it's virtually impossible to get into contact with the developers they will get their "bug reports" via the news.

</comment><comment><USER87> They forgot to turn the NSA flag off in production

</comment><comment><USER88> I wonder how many devices are affected. Just tested between two iPhones running latest iOS and could not reproduce.

</comment><comment><USER89> We noticed a similar bug many years ago on a GSM enabled PDA device. I cannot recall the brand/model.

</comment><comment><USER90> I feel like around three years ago Apple engineering changed QA leadership or restructured org in that dept and the quality has been down. Prior to IOS9, I have had barely noticed bugs. But now I am in that "used-to" mode that I have learned to ignore such bugs or nuances.

</comment><comment><USER91> Damn! And it was a feature they would disclose in the next apple event...

</comment><comment><USER92> Is it just me, or does it seem Apple can't secure their services as well as Google?

There's always 'concerns' about Google spying, but no proof, meanwhile there's been major hacks involving Apple that are quickly forgotten because the CEO claims to be all about privacy.

<comment><USER93> the quantity of papers with major security flaws in android versus ios shows you all you need to know. there is an endless stream of android ones but very few ios okes

<comment><USER92> Key word is services. iCloud had a very public hack, now this. What Google services have been exploited?

</comment></comment></comment><comment><USER94> They'll fix it fast. People just love to crucify Apple for everything.

</comment><comment><USER95> Are there any specific Faraday bags that folks recommend?

<comment><USER16> Why not just turn on airplane mode?

<comment><USER96> If you don't trust the software in the first place, there's no real reason for you to trust that airplane mode is actually effective.

<comment><USER16> If you can't trust the software at all, you might be better served with turning your phone off :/

<comment><USER97> Off may not be enough: [https://www.wired.com/2014/06/nsa-bug- iphone/](https://www.wired.com/2014/06/nsa-bug-iphone/)

Like the SamuelAdams said, you might do better with a Faraday bag.

</comment></comment></comment></comment></comment><comment><USER98> This will always happen with non-open source software.

<comment><USER16> This also happens with open-source software too. It just takes a bit longer to figure out what's going on with closed-source software.

</comment></comment><comment><USER99> Should the engineers who were responsible for this be punished or retrained?

<comment><USER100> The more pertinent question in this kind of situation is to the Lead/Architect. Namely, why have you created an environment in which quality can slip like this, and what are you going to change?

</comment></comment><comment><USER101> Open. Source.

</comment><comment><USER102> Imagine, all this time Five Eyes actually had a way of breaching privacy and they only started making noise about access enablement recently because they knew someone was going to report the vulnerability to Apple.

</comment><comment><USER103> NSA calling, please pick up. ;)

</comment><comment><USER104> once i had to talk to my boss i didnt really like

this explains it.

</comment><comment><USER105> Looks like iPhone spyware. I doubt that FaceTime is the first use of this "bug"!

</comment><comment><USER106> I am unaware of this problem..as I am an android user.

<comment><USER107> Yeah, with the long list of things you have to worry about, I wouldn't be worried about an iPhone problem either.

</comment></comment><comment><USER108> Seriously, I don't think that this is so bad. Google advertised something similar like this as feature. Don't get me wrong: it should be fixed. But the shitstorm is way too big

</comment><comment><USER109> "Bug"? What came to my mind was "bugged."

Zuckerberg needs to answer more questions before Congress, this time under oath.

</comment><comment><USER110> Not for long. Will be patched in hours, I bet.

<comment><USER111> This would actually be a fun interview question - how to emergency patch 1B+ globally distributed mobile devices. I would say at least several days for the obvious QA which needs to be done.

<comment><USER112> >I would say at least several days for the obvious QA which needs to be done.

And you would unfortunately, not get the job.

<comment><USER113> Well, there's probably a new position on the QA team opening up soon in any case.

</comment></comment></comment></comment><comment><USER114> My colleague and I experienced the same thing last week on his Samsung phone. Another colleague was calling us to talk about a project, we were chatting away and in the few seconds before the phone was 'answered' our colleague heard what we were talking about.

</comment><comment><USER115> This is due to the very poor QA efforts Apple has, coupled with junior developers who lack a security-aware mindset. This is, sadly, the case with most companies these days. Zero secure coding training, zero push for security reviews, zero push for security QA, zero accountability.

<comment><USER16> > Zero secure coding training, zero push for security reviews, zero push for > security QA, zero accountability.

What makes you think this?

<comment><USER115> The amount of bugs like this, specifically lock screen evasion bugs, bug also disk management bugs we've seen, etc. As I said, this is not specific to Apple. The whole industry lacks security awareness, and because people don't hold these companies accountable, there is little financial incentive to change that.

<comment><USER16> Your specific claim was that Apple has "zero secure coding training, zero push for security reviews, zero push for security QA, zero accountability"–this isn't true at all. Sure, Apple's software has had some serious bugs in it, but this does not mean that they have no security practices in place.

<comment><USER115> I am not speaking about dedicated security teams. What security training is there for end-user app developers at Apple? From discussions with developers I know, it doesn't seem to exist, or at least not spread everywhere.

<comment><USER16> Maybe it's not enough for your satisfaction, but there are resources available for writing safe and secure code (I'm not sure if this is required, though), as well as regular audits by the security team.

<comment><USER115> I come from a security background (6 years in a security firm), and I have seen some pretty paranoid practices. I do not wish that to be prevalent. One thing which I really did appreciate in that firm, and find very valuable, was putting every developer and product person on a security awareness and secure coding course, where basics are taught, but also an attempt is made to push a security-first mindset.

I am now in a consumer-oriented company, and while I appreciate the much more relaxed environment, I am often shocked at how no attention or thought is paid to security. It baffles me that management, at the very least, has little care for this stuff.

This is an industry-wide problem.

</comment></comment></comment></comment></comment></comment></comment><comment><USER116> I worry about Apple. Software quality has been dropping, but it's not Swift or some other specific technology that's the problem. It's talent. The company has had a hard time attracting very senior talent.

The difficulty is self-imposed and comes from leadership's strict policy of not paying market wages at the high end. Multiple hiring managers at Apple have complained to me that they've lost good people because the company just won't match offers from the Googles and Facebooks of the world. Apple refuses to acknowledge the reality of the market.

Given that Apple's most experienced people keep retiring and that Apple isn't replacing them with equals, I expect software quality to continue to drop until leadership decides to abandon its shortsighted comp restrictions.

[Posting from a throwaway for obvious reasons]</comment>


Moments of Weirdness with Ralph Northam - <AUTHOR> https://www.politico.com/story/2019/02/02/ralph-northam-yearbook-1144281 <comment><AUTHOR> Fascinating that social media, in any form [1], will follow you forever and pop up at inconvenient times.

\</comment><comment></comment><comment>----

[1] His analog yearbooks.</comment>


Museum of Hoaxes - <AUTHOR> http://hoaxes.org/ <comment><USER2> The Eruption of Mount Edgecumbe April Fool's Joke is hilarious [0]. Guy airdrops 70 kerosense-soaked tires to the crater of the volcano and sets them on fire, making everyone think the volcano was going to erupt.

Laughed pretty good at this bit in the PB & mayo story [1] too: "And then there was the Great Banana Peel hoax. In 1967, a rumor had swept the nation alleging that bananas could be used to get high. The technique, it was said, was to scrape the inside of a banana peel, boil the residue, dry it out, and then roll it into a joint and smoke it."

[0]: [http://hoaxes.org/af_database/permalink/the_eruption_of_moun...](http://hoaxes.org/af_database/permalink/the_eruption_of_mount_edgecumbe)

[1]: [http://hoaxes.org/weblog/comments/peanut_butter_and_mayonnai...](http://hoaxes.org/weblog/comments/peanut_butter_and_mayonnaise_panic)

<comment><USER3> That banana peel hoax was still doing the rounds when I was in secondary school in the early eighties in Ireland.

</comment></comment><comment><USER4> I'd also recommend the Museum of Jurassic Technology in LA. It's not exactly full of hoaxes (there is 'primary' evidence for all the exhibits), but it has a great mix of things that are true but weird, interesting but likely false, and completely bonkers but 'documented'.

Ask to see the library, if they still allow it.

[http://mjt.org/themainpage/main2.html](http://mjt.org/themainpage/main2.html)

<comment><USER5> I enjoy how many people go there expecting to find a small museum about dinosaurs, only to realize it's.... uh, not that.

</comment></comment><comment><USER6> Oh hey, I remember this site. Had one of the books the curator released to tie in to the project.

Either way, it's definitely got some fantastic articles about old school hoaxes here. The hoaxes through history archive is definitely worth looking through if you've got the time:

[http://hoaxes.org/archive/display/category/middleages/](http://hoaxes.org/archive/display/category/middleages/)

I just kinda wish they were a bit more consistent on the updates again. The site got tons of updates back in 2015 or so, with articles every day. Now? You'll be lucky to get one per month.

</comment><comment><USER7> It's the Second Coming of Snopes.</comment>


ReSeq: Repurposing HiSeq DNA Sequencers - <AUTHOR> https://reseq.hackteria.org/ <comment><USER2> Mikeselectricstuff has some teardown videos of DNA sequencers. Interesting stuff.

[https://www.youtube.com/watch?v=XaumUp4GpCw](https://www.youtube.com/watch?v=XaumUp4GpCw)

</comment><comment><AUTHOR> I am part of this project but just about to board a 2 hour flight. If you have any questions, feel free to post below and I will answer them later.

<comment><USER3> This is very cool. I hope you get some cool uses out of this.

What's the max frame rate you can get out of the cameras (without tiling)? Are you able to control focus and camera gain?

<comment><AUTHOR> Thanks, working out the max frame rate is a bit complicated by the fact it uses time delay integration (TDI) scanning. There are 4 TDI cameras each 2048 * 128 pixels. I couldn't find any official documentation (the cameras are Hamamatsu S10405 CCDs and there is one C10000-509 control board for 2 cameras each). I think it's the same sensor as this camera which quotes the line rate at 50khz. [https://www.hamamatsu.com/resources/pdf/sys/SCAS0085E_C10000...](https://www.hamamatsu.com/resources/pdf/sys/SCAS0085E_C10000-801.pdf)

This Ebay listing quotes the line rate as 1khz, not sure where they got that: [https://www.ebay.com/itm/4-Illumina- HiSeq-2000-Hamamatsu-S10...](https://www.ebay.com/itm/4-Illumina- HiSeq-2000-Hamamatsu-S10405-Line-CCD-Camera-/372264830253)

We were able to grab a live video feed from a single camera, that must have been 20fps at least, but we'll have to investigate fully.

Yes, we are able adjust the gain and are able to focus both by moving the stage and by adjusting the more fine-grained piezo focus actuator (but we'd like to be able auto-focus using Micro Manager: [https://micro- manager.org](https://micro-manager.org)).

<comment><USER3> Nice. I suspect there are quite a few Illumina engineers secretly cheering for you.

I'm in touch with a community of microscopy folks which includes the maintainers of Micro Manager. I'll send this link around, I bet they'll be interested.

</comment></comment></comment></comment><comment><USER4> What about reagents? The sequencers themselves are expensive, but library kits cost a lot of money, as do the reagents for running a flow cell. Even if I can get a sequencer for free, if I still have to pay through the nose for reagents it's no good. Especially as these sequencers become obsolete and people stop MAKING the relevant reagents, and their cost goes higher and higher.

<comment><USER5> I think the idea is to use these as "automatic microscopes" instead of as sequencers.

<comment><USER6> I'm also involved in the project. Ideally we'd like it to be able to be used both as both a microscope and as a sequencer. Potentially there are other uses too. For example this paper uses a customised Illumina GAIIx sequencer to do high throughput measurement of on and off rates: [https://www.pnas.org/content/114/21/5461](https://www.pnas.org/content/114/21/5461) While this does involve sequencing with Illumina reagents, my point is that it's possible to use customised flow cells and reagents for new assays that you might dream up. Software to run such assays could be built on top of what we are doing.

I have heard that the BGISEQ-500 ([https://www.bgi.com/resources/sequencing- platforms](https://www.bgi.com/resources/sequencing-platforms)) is a similar machine...

Our initial focus is on writing the device adapters that enable Micro-Manager ([https://micro-manager.org](https://micro-manager.org)) to talk to the HiSeq hardware. MM will then be able to drive it like a microscope as well as providing access to all the other fluidics switches, pumps, sensors etc. The MM user interface is extensible and plugins can be written to support assays such as sequencing. MM also exposes all of the devices and functionality in a scripting environment.

</comment></comment></comment><comment><USER7> Here's another series of posts where they tear down one of the original Illumina sequencers (the Genome Analyzer).

[https://blogs.swarthmore.edu/Illumina+GAIIx+Teardown/](https://blogs.swarthmore.edu/Illumina+GAIIx+Teardown/)

</comment><comment><USER8> Ooh. I got a HiSeq 2000 for a six pack of beer. Can't wait to try to hack it!

<comment><AUTHOR> You should become an alpha tester!

<comment><USER9> I just nabbed a cheap one as well. Happy to join the community.

Question for you though: it appears to be just an inch too big to fit into my building. How difficult is it to split into manageable chunks. Do the 4 modules separate without too much hassle, or are we talking full teardown?

<comment><AUTHOR> It's pretty modular. Urs Gaudenz removed the fluidic pump and fridge on his to reduce the size.

<comment><USER9> Where's the best place to chat with the community? Got a slack channel or anything?

<comment><AUTHOR> In the forum currently: [https://forum.hackteria.org/t/hiseq2000-next-level- hacking/3...](https://forum.hackteria.org/t/hiseq2000-next-level-hacking/325)

</comment></comment></comment></comment></comment></comment><comment><USER10> Boy, do I feel old. HiSeq 2500 was a gold-standard, $750k machine when I was starting grad school. Which was not that long ago, or so I thought.</comment>


Ask HN: Should I Remove an Online Pseudonym? - <AUTHOR> I've gone by a pseudonym online for around 8 years, but now that I'm older (over 18) I've considered replacing it with my actual name so online work I do can be easily attributed to me. This includes social media, GitHub, forums, and normal conversation. This is not a nickname, per se, but rather an actual name different from my own (like John Doe).
My primary consideration is GitHub - I would like to have projects I create hosted by my real account used in these online communities. Any form of migration I do would involve changing package name (com.mypsuedonym -> com.myactualname), so there is also a bit of a development aspect to this.
Has anyone gone through something like this before, or is able to offer resources on the process? Is this something that is a good idea, or should I prefer to keep using the pseudonym for as long as I'm involved in things online? My opinion is that if a change is to be made the sooner the better.
Thanks!
Note: I don't have anything online that's sketchy, illegal, inappropriate, or anything to hide from a potential employer or grandmother. <comment></comment>


Uzbekistan Airways to weigh passengers before boarding - <AUTHOR> http://www.telegraph.co.uk/travel/travelnews/11799490/Uzbekistan-Airways-to-weigh-passengers-before-boarding.html <comment><USER2> A bit less than thirty years ago, I was booked onto a Midway Air flight out of Dubuque, Iowa. The plane was a very small two-engine turboprop, carrying about a dozen passengers. The clerk did not weigh me, but she did ask my weight, after which she assigned my seat, I assume according to some rough and ready algorithm for maintaining trim. She did weigh my luggage.

The good news is that the trim appeared to be fine. The bad news was that a crack in the manifold of the port engine caused a little fire. It was extinguished, but the port engine had to be shut down, and we came back around to land again.</comment>


BleedingBit: Exposes Enterprise Access Points and Unmanaged Devices 2 Undetectab - <AUTHOR> https://armis.com/bleedingbit/ <comment><AUTHOR> [https://cert.europa.eu/static/SecurityAdvisories/2018/CERT-E...](https://cert.europa.eu/static/SecurityAdvisories/2018/CERT- EU-SA2018-028.pdf)</comment>


Germany passes law with fines for Internet companies that don't bar hate speech - <AUTHOR> https://arstechnica.com/tech-policy/2017/06/facebook-and-twitter-could-be-fined-up-to-57-million-under-new-german-law/ <comment><USER2> Discussed 1-2 days ago:

[https://news.ycombinator.com/item?id=14669516](https://news.ycombinator.com/item?id=14669516)

</comment><comment><USER3> >Failure to comply could lead to fines that start at 5 million euros and range up to 50 million euros, or about $57 million.

I somehow feel like with such ridiculous sums it makes more financial sense to just pull any kind of forum/social media/etc out of Germany.</comment>