Patch Notes #041 — Security Is a People Problem

Confirmed: Amazon bought Twitch for about $970 million. Called it. (I called it after the rumors told me to call it. This counts.)

The ugly story of the fortnight: hundreds of celebrities’ private photos leaked from iCloud accounts. Early panic said “iCloud was hacked,” but the emerging picture is more mundane and scarier: targeted phishing and password guessing, plus a find-my-phone endpoint that reportedly didn’t rate-limit login attempts. No zero-day, just the oldest tricks against the weakest links. At work we turned on mandatory 2FA for everything the same week. Should’ve been years ago. It always should’ve been years ago.

Apple’s big event is Tuesday: bigger iPhones (“6 Plus”?), payments, maybe the long-rumored watch. The Apple Pay rumor interests me most. If anyone can make paying-by-phone not weird in America, it’s the company that made pulling out a phone the default human gesture.

EPL is back. My Fantasy Premier League team is drafted (manually this year, one goalkeeper, growth) and named “Null Pointer Exception.”

TIL: rate limiting is a security control, not just a traffic control. Every login endpoint we have now has one. Every. Single. One.