Apple shipped the year’s most intimate bug: Group FaceTime calls could be made to transmit audio from the recipient’s phone before they answered. Call someone, add yourself to the group, and their microphone goes live while their screen still says “incoming call.” Discovered, per reporting, by a teenager trying to set up a game chat, whose mother then spent over a week trying to report it through Apple’s channels before it went viral and Apple killed Group FaceTime server-side entirely. Two files updated: the composition file (the bug lived in the interaction of group-call state machines, each state individually sane) and a new one I’m opening on vulnerability intake: if a diligent citizen with a critical remote-eavesdropping bug can’t reach you in a week, your security program has a 404 where its front door should be. We tested our own security@ inbox Thursday. Response time: 4 hours. Relieved. Also: now monitored.
The polar vortex has the Midwest at Mars temperatures (Chicago hit -23°F; rail crews are literally setting tracks on fire to keep switches working, the most metal infrastructure maintenance imaginable, and a reminder that physical ops has failure modes our dashboards can’t imagine), and the Champions League Round of 16 arrives soon: Manchester United facing PSG’s billion-dollar attack, a classic underdog test under interim boss Ole Gunnar Solskjær against the tournament’s most expensive project. The group chat’s win-probability discipline will be enforced.
TIL: state-machine security review, enumerate transitions, not states; the FaceTime bug lived on an edge nobody drew. Draw all the edges. Especially the ones marked “can’t happen.”