Slashdot Mirror
Mac OS X 10.2.8 Update, Take Two
javaxman writes "OS X users will find Mac OS X Update version 10.2.8 is available via 'Software Update'. If you did not install the previous 10.2.8 update, the size of the new update is 40.6MB. If you installed the previous update, the size of the new update is small, ~680K... if you can connect to the network, that is. Clearly you get different downloads depending on what you did with the previous 10.2.8 update. Apple Knowledge Base article 25524 has the details. It looks very familiar. I'm installing mine right away, how about you?"
In the immortal words of George "DoubleYa":
"Fool me once...shame on you....
Fool me twice...umm....
Shame..on...Shame...on...
Well you're not gonna fool me again..."
I'll wait for some other people to install first..
I'm installing mine righ
[NO CARRIER]
/* oops I accidentally made a comment, sorry */
This may fix the ethernet problem, I don't know, it didn't affect me, but there were other problems with 10.2.8, www.MacFixIt.com made a fairly extensive list.
./System/Library/Filesystems/hfs.fs/hfs.util. New permissions are 33261 ./System/Library/Filesystems/hfs.fs/hfs.util, should be -rwxr-xr-x , they are -rwsr-xr-x ./System/Library/Filesystems/hfs.fs/hfs.utilm issions corrected on ./System/Library/Filesystems/hfs.fs/hfs.utilu p differs on ./private/var/run/utmp, should be 0, group is 1 ./private/var/run/utmp ./private/var/run/utmp
This definitely does not fix the crashing problem. (on my beige G3)
It can happen at any time, and is sometimes mistaken as an inability to wake from sleep, but you can get it to happen reliably by trying to repair permissions.
It outputs the following, then shuts down the display, and needs to be hard-restarted.
2003-10-03 17:36:12 -0400 - Repair of privileges has started
We are using special permissions for the file or directory
Permissions differ on
Owner and group corrected on
Per
Gro
Owner and group corrected on
Permissions corrected on
"The worst tyrannies were the ones where a governance required its own logic on every embedded node." - Vernor Vinge
I don't want to start a holy war here, but I was really scared that 10.2.8 ate my battery life for good. I'm so happy to see the familiar 4h+ is back (battery is about a year old; iBook 800 12").
It's a little unclear whether the new problems in OpenSSL have been patched. According to the CERT page, Apple is reporting the vulnerability as fixed in 10.2.8. On the other hand, I have a 10.2.8 machine that still indicates OpenSSL version 0.9.6i, which is supposedly vulnerable.
Again, on a side note, I wish Apple would allow security updates to be installed independently of the main bulk upgrade.
WORKSFORME
(ok that's really 3, but bugzilla users will understand)
Perhaps, if SSH and Sendmail were enabled in a default install, you might have a point.
>If you installed the previous update, the size of >the new update is small, ~680K... if you can >connect to the network, that is.
Well, you could always put it on a floppy di....damnit.
%\
Meanwhile sendmail is not only not enabled by default, but there is no way to enable without the command line.
As for ssh, is there a working root exploit out? Just about *everything* that connects to the internet is vulnerable to connection overloading via a DoS. This makes it easier, sure, but that a DoS is possible isn't exactly a deal breaker.
Finally, if you are using these in a production environment where security patches are time-critical, you should probably be compiling your own versions of these services and not depending on Apple.
I would have liked to see the security patches to come faster as well, but for these kinds of things its not a big deal to me if they are a bit lax.
Integrate Keynote and LaTeX
The message from Apple Product Security includes advice on fixing the sendmail vulnerability on 10.1.5 - which is a very good thing - but nothing similar for OpenSSH or OpenSSL.
Now, OK, from what I gather the sendmail bug is more serious in that the vulnerabilities in OpenSSH and OpenSSL seem to be limited to DoS, but wouldn't similar instructions to updating OpenSSH/SSL on 10.1.5 be useful?
Well, maybe Apple has once failed to manage to do the grunt work for you in a timely manner. If i recall well, most other security holes had been addressed very rapidly in the past. This particular one tanked because it was rolled out as part of a buggy overall update. Big deal. That security hole existed on a service that is not enabled by default. And unless you are an Xserve customer with a valid, active support license, Apple doesn't owe you shit. Complain all you want. But if you enable "remote access" from your control panel, you should have a minimal understanding of the risks it presents and be prepared to cope with potential security issues, and unless you pay Apple, be prepared to wait for a patch.
But you see, in the end, you still benefit from Apple's original architecture decision for the core of their operating system: An open-source operating system. Full disclosure as to where the bug lives. As you said it, even the OS X server people had to remove the system-installed version and compile their own to not be vulnerable to Denial of Service attacks.
Be GLAD you were able to do that. Systems administrators who maintain production-environment servers have had OPTIONS as to how to deal with this situation, based on priorities. Sure it would have been nice to let Apple do the work for you. But hey, if you maintain something of importance, you'd better know your way around the operating system you maintain. But since those are all open-source components, chances are there were about 892739847238974 other people who had found a workaround and/or a solution to your problem within hours of the vulnerability being found, and chances are a good chunk of them have shared those solutions with the community at large.
There is no such thing as a secure operating system. A secure operating system is not connected to any network and doesn't otherwise interact with anything or anybody. Security is a frame of mind, procedures and processes surrounding the usage of computing facilities, and does not exist in an absolute form. Certain practices and philosophies allow administrators to build systems that are more secure than others. But it is all relative.
Take an off-the-shelf Jaguar installation, install it on a mac, then run nmap on that machine. How many ports will you find open? ZERO. NONE. NADA. ZILCH. not one. Why? How many will you find on windows? 5 to 10 depending on which flavor you're installing.
Extraordinary Vacations. Exceptional Prices