Longtime viewers of this trashy little soap are well aware that we're perfectly happy to wander off-topic to engage in a little gleeful and petty gloating about the security flaw du jour afflicting all those poor saps running software slapped together by Microsoft. (Heck, it's one of the few hobbies we have left that isn't fattening, cancer-causing, or guaranteed to send us to hell.) Well, this time we've got something a little more relevant on deck: Apple's latest security hole. Da da da da dummmmmmm!

(That last bit there was an ominous chord, for those of you missed it.)

Yes, folks, faithful viewer Jonboy pointed us toward a WIRED article which describes an exploit that could have been used to compromise your Apple ID-- you know, that thing that lets you post soon-to-be-deleted obscenity-ridden rants to Apple's support forums, download developer tools from the Apple Developer Connection, and, most importantly in this context, make One-Click purchases from the Apple Store and the iTunes Music Store. Apparently somebody discovered that a little judicious cutting and pasting of data hidden in the HTML source of Apple's "Forgot Your Password?" page allowed him to reset the password of any Apple ID without needing to know anything except the victim's email address. Oops.

Now, before you go running off looking for details on how to pull this little stunt so you can score an iPod or six on someone else's dime, there are two things you should know. First of all, bad karma, man-- that's stealing, plain and simple, and you should be ashamed of yourselves for even considering such a thing. Secondly, Apple already fixed the bug. Don't ask us how we know. (Quit looking at us like that.)

Since an Apple ID account contains a user's credit card data, at first this exploit sounds pretty nasty, but it's not as bad as it could have been; while nefarious and new-iPod-less ne'er-do-wells could indeed have ordered up some gear using the stored credit card info, they couldn't have accessed the actual credit card data itself, and thus the damage would have been limited to Apple's stores. Since it's Apple's bug that would have led to the charges in the first place, we can't believe the company would try to hold the Apple ID holder liable-- and, of course, there's all sorts of legal protection for credit card users in the case of fraud. On top of that, Apple claims that no one ever exploited this bug in the first place. No harm, no foul.

Once we thought about it a bit longer, though, we came to the conclusion that this exploit was at least as heinous as all those Microsoft holes that are constantly letting through malicious viruses. Trashing our hard drives is something from which we could probably recover, but finding out that someone used our credit cards to buy eighty bucks' worth of Céline Dion and Faith Hill songs, well... there are some dark places in the corners of the soul from which a man may never return.