Slashdot Mirror


Apple To Review Software Practices After Patching Serious Mac Bug (reuters.com)

Apple said on Wednesday it would review its software development process after scrambling to patch a serious bug it learned of on Tuesday in its macOS operating system for desktop and laptop computers. From a report: "We greatly regret this error and we apologize to all Mac users, both for releasing with this vulnerability and for the concern it has caused," Apple said in a statement. "Our customers deserve better. We are auditing our development processes to help prevent this from happening again."

192 comments

  1. I just need to know by Anonymous Coward · · Score: 1, Insightful

    Was it an H1-B developer or something that was sent to India?

    1. Re: I just need to know by Anonymous Coward · · Score: 0

      Oddly enough I saw this bug coming a mile away. There was a similar bug in windows years ago (that caused NASA to be hacked), and all you had to do to not be affected was set an administrator/root password.

    2. Re:I just need to know by Anonymous Coward · · Score: 0

      Of course not. This kind of feature is planned by their UX team, who mandate that their users should not be bothered with passwords. The developers must have just obeyed the UX gods, who have all the knowledge of the universe.

    3. Re: I just need to know by Anonymous Coward · · Score: 0

      Was it an H1-B developer or something that was sent to India?

      While I've seen my share of American dumbasses writing code, probably. But nobody will ever admit it. Can't shatter the myth of H1-B (Indians, who are we kidding?) being some kind of super tech geniuses. The truth is they're people like everyone. Some are geniuses. Most are dumbasses.

  2. Maybe... just maybe. by Anonymous Coward · · Score: 0, Flamebait

    Apple should start giving a shit about something besides hardware for but a moment. Their software quality has been in the gutter the past two years. Which then means their expensive hardware isnâ(TM)t even worth toilet paper because itâ(TM)s not usable.

    I hate android but iOS has been such a hot pile of shit lately Iâ(TM)m gonna try one out again.

    1. Re:Maybe... just maybe. by Anonymous Coward · · Score: 0

      isnâ(TM)t

      ...posted from an iphone. Maybe an ipad.
      You do know why slashdot fucks up your apostrophies, yes?

    2. Re:Maybe... just maybe. by Anonymous Coward · · Score: 1

      Apple should start giving a shit about something besides hardware for but a moment.

      They do, in the form of animated turd emojis.

    3. Re:Maybe... just maybe. by ledow · · Score: 1, Insightful

      I'm sorry... Apple's hardware is the GOOD bit?

      Fuck...

    4. Re:Maybe... just maybe. by Aaden42 · · Score: 2

      Because it's 2017 and the green site STILL can't handle Unicode?

    5. Re:Maybe... just maybe. by jellomizer · · Score: 1

      I think in terms of software Apple is a victim of its own success.
      iOS is nearly the same as it was back in the original iPhone, sure we got a lot of new stuff in it, but it is based on what was popular. If apple risked Thinking Differently, then their product may scare off customers.

      If the iPhone wasn't as popular of a device I expect to see a lot more changes in the iPhone and iOS devices, as well in OS X.

      Apples biggest changes in its OS was from 1999 - 2005 Where Apple was nearly dead, and Microsoft was the Big unstoppable name in town. Having to change from MacOS 9 to OS X (A complete OS Rewrite) and putting a lot of big changes until 2007 where XP was starting to show its age, and Vista was failing to impress.
      However Apple used this time and put their resources to the iPhone, but this has been successful for a long time, so much of the software hasn't been rethought, because it works and it is popular.

      --
      If something is so important that you feel the need to post it on the internet... It probably isn't that important.
    6. Re: Maybe... just maybe. by Anonymous Coward · · Score: 0

      You obviously never owned a Mac ..

    7. Re: Maybe... just maybe. by ilsaloving · · Score: 4, Insightful

      It *used* to be. Now their hardware is nothing more than a gratuitously expensive appliance.

      If I could easily run OSX on non-apple hardware, I'd do it in a heartbeat. (And when I say run, I mean perfectly, flawlessly, without something not working right)

      I'm still using a 2010 MBP because every version they put out afterward is more and more annoying. Can't replace the battery. Can't replace storage. Can't replace ram. Now you don't even get a USB 3 or HDMI port. It's offensive.

      They claim that it's "future proofing" the machine. That's nothing but a lie to mask their efforts to gouge the crap out of people on dongles.

    8. Re: Maybe... just maybe. by Anonymous Coward · · Score: 0

      Incompetence?

    9. Re: Maybe... just maybe. by ledow · · Score: 1

      Correct.

      I manage several hundred of them, however.

    10. Re: Maybe... just maybe. by ctilsie242 · · Score: 4, Interesting

      Even OS X has gone from great to "meh". I don't see many companies bothering to write Mac specific games. macOS is the only mainstream OS with no iSCSI capability. Apple is sitting on a ton of cash, they might as well throw a bit to make macOS a generation or two ahead of the pack. A few ideas that Apple can do:

      1: Things like hierarchical storage volumes, where when accessing a file, macOS will fetch it, or prompt you to connect the media (external HDD, CD, etc.) so it can access it. That way, you can store documents locally, have them get moved to iCloud, and transparently backed up to Time Machine, as well as a third party cloud provider (Amazon S3, Wasabi, Backblaze, etc.) It handles where the files and their backups are and warns the user if backups are not accessible... the user just accesses them through a volume. Security/encryption can be done at a file/folder level, so files can be easily shared or secured.

      2: Better enterprise-tier management, as in being able to be managed via GPOs. Companies would move to Macs en masse if they could be managed as easily as the Windows desktops.

      3: Better remote access, perhaps bring Back to my Mac up to par with LogMeIn or TeamViewer, with two-factor authentication, as well as optional authentication to the machine.

      4: The ability to virtualize macOS for VDI systems.

      5: The XServe back, with a built in hypervisor and license. It would be nice if it were bundled with ESXi, to help with item #4.

      Apple has so much cash, it is surprising why they haven't just tossed some man-hours into keeping well ahead of their competition with their products.

    11. Re: Maybe... just maybe. by ilsaloving · · Score: 2

      I hate that Slashdot doesn't let you mod in the same thread you posted in. I'd totally give this a +1. I agree entirely.

      The only saving grace is that they haven't fucked up Mac OS as badly as Microsoft has fucked up Windows.

      Although apparently you *can* have multiple users log in remotely to a single computer, VDI style. The problem is that they use some variation of VNC so your trapped in the resolution of the physical monitor. Apparently some company tried to put out an RDP server for OSX but Apple shut them down. RDP support on Mac would be phenominal.

    12. Re: Maybe... just maybe. by Anonymous Coward · · Score: 0

      You obviously never owned a Mac ..

      The screens are good and the chassis build quality is good but everything else is commodity PC hardware and in general Apple's choices of that are far from cutting edge. People who say Apple's hardware is good don't really understand that in the context of computer systems Apple is not a hardware vendor, they are system integrator and use generic CPU, GPU and RAM components from the same factories as every other vendor. The concept that Apple's hardware is something special is pure confirmation bias.

    13. Re: Maybe... just maybe. by LDAPMAN · · Score: 1

      Absolutely! Every PC laptop has a direct PCI ssd that can read at 3GB/s and has 4 40Gb external connections that can also drive multiple 4K displays. /s

    14. Re: Maybe... just maybe. by Anonymous Coward · · Score: 0

      Is that the one with the 5400 RPM spinning hard drive?

    15. Re: Maybe... just maybe. by brantondaveperson · · Score: 1

      commodity PC hardware

      Except the trackpad. And the logic board is custom-designed, like all laptops are, so sure, it's made of PC parts, but that's because it's an intel-based personal computer, so exactly how else you'd like them to make it is hard to understand.

      And the keyboard, which is also custom-built, and so nice that many actual PC laptops copy its design. And the hinge, which actually feels solid, and that magnet-closed lid, which has also been very widely copied, and is perfectly engineered.

      Often I hear the complaint that apple parts aren't easily replaceable, which is true on the newer models, and yet here someone's arguing that apple suck because they *do* use commodity standard parts.... so which is it?

      The fact is that apple laptops are simply better built, and better designed, and on average outlast competing PC laptops. And they do this because apple do not bother to compete on price, since the only endgame with price competition is lower and lower quality. Instead they compete on physical hardware quality - cases, hinges, finish, keyboard, trackpad, etc - and also on OSX, which is the real reason that an apple machine is superior to everything else on the market. OSX is just better. It performs better, its APIs are better, its development environment is better. Have you ever written any code for iOS, or for a mac? You should give it a try. Coming from windows and android development, it's an absolute joy.

    16. Re:Maybe... just maybe. by brantondaveperson · · Score: 1

      iOS is nearly the same as it was back in the original iPhone

      It looks a bit similar. It is very, very far from 'nearly the same' in every other respect.

    17. Re: Maybe... just maybe. by Anonymous Coward · · Score: 0

      2. JAMF Pro (formally Casper) does this. I admin a mixed Mac and Windows network with around 400 clients, and I prefer keeping these worlds mostly separate - GPO for Windows, JAMF for Macs.

      5. Yes it would be nice if Apple offered XServe, and stopped butchering the "Server App", and stopped slowly trashing NetBoot/NetRestore or give me another way to quickly (under 15 minutes) reset a system to a known starting point from which I can do some simple config and hand back to the user.

    18. Re: Maybe... just maybe. by Anonymous Coward · · Score: 0

      All that you've listed is a stupid junk. No way I need that on my Mac. FUCK OFF, Monkeysoft Corp shill.

    19. Re: Maybe... just maybe. by ctilsie242 · · Score: 1

      JAMF Pro is a nice utility... but, boy, it is not cheap. IMHO, this functionality should be part of the OS. The "server app" is also something that needs revisited. In the real world, other than MDM capabilities, something like LANrev/JAMF shouldn't be required.

      PXE/NetBoot is also important. Maybe some way to have the machine grab code from a local server rather than Apple when there is no usable software on the drive, and one doesn't have a USB flash drive ready.

    20. Re: Maybe... just maybe. by Anonymous Coward · · Score: 0

      Absolutely! Every PC laptop has a direct PCI ssd that can read at 3GB/s and has 4 40Gb external connections that can also drive multiple 4K displays. /s

      Why is it mac fanboys don't care if they look like complete idiots just so long as they make an effort to defend the Apple corporation? I suppose you don't understand the difference between something being "commodity PC hardware" and that hardware being available in every PC laptop. It's an important distinction but perhaps in your haste to defend Apple from criticism you didn't understand that? It's really not that complicated.

      Yes Apple's macbooks have some cutting edge hardware but the core system components (CPU, RAM, GPU, disk space) fall far short of professional systems.

    21. Re: Maybe... just maybe. by david_thornley · · Score: 1

      If I could easily run OSX on non-apple hardware, I'd do it in a heartbeat. (And when I say run, I mean perfectly, flawlessly, without something not working right)

      Not going to happen. The advantage of running OSX on Apple hardware is that that's what it's designed to run on. There's no reason why it should have what it needs to run on a Dell or a homebuilt.

      --
      "When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
    22. Re: Maybe... just maybe. by david_thornley · · Score: 1

      That's a lot less true of the iPhone. Apple designs the CPU for that, and does a pretty good job.

      --
      "When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
    23. Re: Maybe... just maybe. by Anonymous Coward · · Score: 0
      I'm not really sure whether such a vomit of Apple's PR is flamebait, corporate shilling or just an ignorant fanboy.

      And the hinge, which actually feels solid, and that magnet-closed lid, which has also been very widely copied, and is perfectly engineered.

      Yeah it's a good hinge, if only they did something about the creaking panel they screw to the bottom. Some things are good, some things are poor.

      Often I hear the complaint that apple parts aren't easily replaceable, which is true on the newer models, and yet here someone's arguing that apple suck because they *do* use commodity standard parts.... so which is it?

      Who argued that Apple suck because they do use commodity standard parts? Clearly while you were gushing about Apple you failed to actually read what you were responding to. The fact that they use commodity standard parts is a *good* thing, it means that because they use the same hardware as everybody else that's one less barrier to compatibility. They aren't easily replaceable because they take commodity components and package them in such a way that they are not easily replaceable, so they are compatible but not easily interchangeable.

      It performs better, its APIs are better, its development environment is better.

      Those things are either subjective, untrue or lack enough context to make the statement. In fact Apple has always lagged years behind in their support of the OpenGL API long before Metal became their choice for example which is why their 3D graphics performance has been so poor in macOS compared to the same system running Windows (or even Linux). Metal itself suffers from not being a properly explicit API which is why it suffers in performance in comparison to Vulkan (and to a lesser extent DX12) so that eschewing of standards does hurt the mac. By contrast the poor performance of the Apple-supported OpenCL versus CUDA demonstrates that this goes both ways, Apple just made a poor choice there too. The flip side is the Swift language an accompanying APIs are quite good, the language and toolchain is available on other platforms too and not exclusive to Apple platforms which is nice.

      Of course anybody who is just going to gush about how fantastic and joyful and perfectly engineered something is likely does not have a broad depth of experience with it or the alternatives or has a clear agenda in being dishonest.

      Have you ever written any code for iOS, or for a mac?

      Yes, I write a LOT of code for iOS and macOS. I write quite a lot of code that is portable across systems so I get the exposure to the differences and understand the strengths and weaknesses of the different platforms. In many ways the iOS and Mac platforms are brilliant and in many ways they are very poor, in terms of platform to develop for personally I most definitely choose iOS over Android but Windows or Linux over macOS. As far as a desktop platform to use I prefer macOS as a more polished UNIX experience.

  3. We apologize for the fault in the root access. by Anonymous Coward · · Score: 0

    Those responsible have been sacked.

    1. Re:We apologize for the fault in the root access. by BigFire · · Score: 1

      You mean put in a sack and beat with a stick?

    2. Re:We apologize for the fault in the root access. by DontBeAMoran · · Score: 1

      We apologise again for the fault in the post above. Those responsible for sacking the people who have just been sacked have been sacked.

      --
      #DeleteFacebook
    3. Re:We apologize for the fault in the root access. by sconeu · · Score: 2

      Mynd you, moose bites Kan be pretty nasti...

      --
      General Relativity: Space-time tells matter where to go; Matter tells space-time what shape to be.
  4. It tells Mac fanboys right by Anonymous Coward · · Score: 0

    They say Macs never get viruses or get hacked. Now you know how Windows users feel. Linux and BSD users are next.

    1. Re:It tells Mac fanboys right by jellomizer · · Score: 3, Interesting

      Well other then this one, how many other viruses or gross hacks were there in the past 15 years?
      I can remember only 3 or 4 major ones during this time. The rest were on par with the normal security fixes that everyone puts out, mostly getting access to stuff as a user already logged into the system.

      --
      If something is so important that you feel the need to post it on the internet... It probably isn't that important.
    2. Re:It tells Mac fanboys right by Bert64 · · Score: 4, Informative

      The blank root password attack is only a local privesc in the default config too...
      It works over screen sharing, but that's not enabled by default.
      It doesn't seem to work on the local login screen, at least on the machine i've tried (plus by default the local login screen shows you a list of users and doesn't let you type a username).
      To exploit on a default system you need to have local access to an unprivileged user account, and from there you can get root.

      --
      http://spamdecoy.net - free throwaway anonymous email - avoid spam!
    3. Re:It tells Mac fanboys right by nine-times · · Score: 1

      It's not really worth arguing about. Anything can get "viruses" or "get hacked", especially when a lot of those "viruses" are trojans and a lot of "hacks" are social engineering.

      Macs are pretty solid. They have problems too. Why can't we just get over these petty arguments and stop feeding the trolls?

    4. Re:It tells Mac fanboys right by TheFakeTimCook · · Score: 1

      The blank root password attack is only a local privesc in the default config too...
      It works over screen sharing, but that's not enabled by default.
      It doesn't seem to work on the local login screen, at least on the machine i've tried (plus by default the local login screen shows you a list of users and doesn't let you type a username).
      To exploit on a default system you need to have local access to an unprivileged user account, and from there you can get root.

      Mod Parent Informative...

    5. Re:It tells Mac fanboys right by Anonymous Coward · · Score: 1

      So basically every Mac in every school where students use a generic login.

    6. Re:It tells Mac fanboys right by Anonymous Coward · · Score: 0

      Sorry, mis-typed that. So basically every shared Mac in every school.

    7. Re:It tells Mac fanboys right by PCM2 · · Score: 2

      To exploit on a default system you need to have local access to an unprivileged user account, and from there you can get root.

      It's not like that's a minor issue, though. People always go, "Well if you have physical access to the machine, anything goes..." But imagine this scenario: You hate somebody at work and they walk away from their Mac without putting it to sleep. You walk over, gain root access, AND set a password for the root account. So now, even if the machine is put to sleep or switched off, you still have access to it.

      --
      Breakfast served all day!
    8. Re:It tells Mac fanboys right by Bert64 · · Score: 1

      So leaving a logged in session is dangerous, and this bug makes the existing dangerous behaviour a bit worse...

      --
      http://spamdecoy.net - free throwaway anonymous email - avoid spam!
    9. Re:It tells Mac fanboys right by Anonymous Coward · · Score: 0

      To exploit on a default system you need to have local access to an unprivileged user account, and from there you can get root.

      This is incorrect. Physical access required, but not an account. Anyone can exploit the bug at the login screen using root/blank since username/password fields are just a click away.

    10. Re:It tells Mac fanboys right by Anonymous Coward · · Score: 1

      It will work on the local login screen if you have more than one user setup on the system.

    11. Re:It tells Mac fanboys right by Skuld-Chan · · Score: 1

      Rootpipe (an actual privilege escalation) - the issue with this one was Apple only patched it on the latest greatest OS at the time, but all the other OS's got patched 6 months after a lot of complaining by some seriously smart security experts.

      Apple really doesn't take security all that seriously. Biggest example - show me on Apple's website what OS's are supported and which OS's are end of life?

    12. Re:It tells Mac fanboys right by Anonymous Coward · · Score: 0

      Did you just write "other THEN"?

      Do you not know what the words "then" and "than" mean?

      Oh sorry, you're AMERICAN, how foolish of me.

    13. Re:It tells Mac fanboys right by Not-a-Neg · · Score: 1

      "To exploit on a default system you need to have local access to an unprivileged user account"

      You just described every single Mac in use at a corporation, school, and government office. Not to mention a double-digit percentage of home users. I can't even begin to tell you the number of iPhone users that don't have an AppleID. The unwashed masses don't care about security and want the least difficult barrier to using a device which means not creating an AppleID on anything they own.

      --
      -==- Buy a Mac and leave me alone!
    14. Re:It tells Mac fanboys right by david_thornley · · Score: 1

      So, I hate someone at work and they walk away from their patched Mac. I walk over and delete their user files or send an embarrassing email to their entire distribution list of something. Having physical access to the machine with an account logged in is never a minor issue.

      --
      "When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
    15. Re:It tells Mac fanboys right by Bert64 · · Score: 1

      Yes, assuming those macs have been upgraded to high sierra... Although in mitigation, high sierra is quite new and schools don't generally upgrade systems right away so i imagine the actual number of systems affected by this to be pretty small.

      The biggest risk with any vulnerability is against default setups, as users are more likely to be unaware. If someone has gone to the effort of changing the defaults then they will be more aware of how things are set up. This vulnerability is also not exploitable if you've already set a root password, which many managed setups are likely to have done anyway.

      Besides, it's not the first and won't be the last local privesc vulnerability... There are many more in various systems, this one just happens to be easily exploited.

      --
      http://spamdecoy.net - free throwaway anonymous email - avoid spam!
    16. Re:It tells Mac fanboys right by Bert64 · · Score: 1

      Didn't work for me..
      By default i was shown a list of users and nowhere to type "root", upon changing that setting it still didn't work.
      Also this assumes the system is already booted, or not using disk encryption... If the disk is encrypted you can't login as root to the pre-boot auth screen and therefore can't boot the system. If disk encryption is not in use you can just boot from USB, mount the disk and insert your own password or backdoors anyway.

      --
      http://spamdecoy.net - free throwaway anonymous email - avoid spam!
  5. Re: I can't help but translate... by Anonymous Coward · · Score: 0

    Iâ(TM)d guess itâ(TM)s the other way around, some MBA holding cunt says âoethese processes arenâ(TM)t efficient, agile, synergy, buzzwords! Now letâ(TM)s institutionally chastise anyone who disagrees.â

    People then leave who used to hold it down because they know through experience this prickâ(TM)s suggestions are crap.

  6. I don't buy it by Anonymous Coward · · Score: 0

    I just can't believe them any more, they keep shipping crap software and crap hardware.

    over it.

  7. Re: I can't help but translate... by Anonymous Coward · · Score: 1

    I canâ(TM)t reâ(TM)d this crâ(TM)p.

  8. Holy shit by nightfire-unique · · Score: 3, Insightful

    Not a Mac fan, but this is the most honest, respectable response to a mistake I've seen from a corporation in a long time.

    Props, Apple.

    --
    A government is a body of people notably ungoverned - AC
    1. Re:Holy shit by Ichijo · · Score: 4, Insightful

      Talk is cheap. Let's see what the audit finds. And why did previous audits fail to find the flaw?

      --
      Any sufficiently unpopular but cohesive argument is indistinguishable from trolling.
    2. Re:Holy shit by Anonymous Coward · · Score: 0

      Not a Mac fan, but this is the most honest, respectable response to a mistake I've seen from a corporation in a long time.

      Props, Apple.

      As "the most honest, respectable response to a mistake I've seen from a corporation in a long time" you mean this "We greatly regret this error and we apologize to all Mac users, both for releasing with this vulnerability and for the concern it has caused. Our customers deserve better. We are auditing our development processes to help prevent this from happening again."?

      It takes a lot of "courage" to "regret this error"... ALLOWING UNAUTHORIZED ROOT ACCESS!!!

    3. Re:Holy shit by reanjr · · Score: 1

      Given the perceived ineptitude required to create the problem, it's kind of the only response they can offer. Looking at their track record, Apple is probably the worst of the big three (OS X/Windows/Linux) in addressing security issues. That said, that still puts them way ahead of most application developers.

    4. Re:Holy shit by froggyjojodaddy · · Score: 1

      Really? I felt it was regular corporate-speak..

      As with most things, there's not a lot of substance behind it - where's the offer of compensation etc?

    5. Re: Holy shit by Anonymous Coward · · Score: 1

      Has systemd ever been fully audited?

      Unless you're talking about OpenBSD, open source projects really aren't any better when it comes to being audited.

      The Heartbleed and Shellshock bugs actually show that the opposite is true - it's common for widely used open source projects to have serious security flaws that for undetected for years, despite their code being in plain sight.

    6. Re:Holy shit by Anonymous Coward · · Score: 0

      Calling out developers without mentioning QA's failure here doesn't seem very honest to me.

    7. Re:Holy shit by sconeu · · Score: 1

      They're not auditing the code. They're auditing the process, to find the root cause as to why the software flaw wasn't detected.

      --
      General Relativity: Space-time tells matter where to go; Matter tells space-time what shape to be.
    8. Re:Holy shit by TheFakeTimCook · · Score: 1

      Not a Mac fan, but this is the most honest, respectable response to a mistake I've seen from a corporation in a long time.

      Props, Apple.

      I agree.

    9. Re:Holy shit by TheFakeTimCook · · Score: 1

      Talk is cheap. Let's see what the audit finds. And why did previous audits fail to find the flaw?

      Because it requires a specific, multi-step process to trigger.

    10. Re:Holy shit by TheFakeTimCook · · Score: 1

      Really? I felt it was regular corporate-speak..

      As with most things, there's not a lot of substance behind it - where's the offer of compensation etc?

      Compensation for what, exactly?

    11. Re:Holy shit by Dutch+Gun · · Score: 1

      I'll save my judgement until we see an end to issues like this or "goto fail" after a few years. It was the correct response, but it's easy to say anything that you think people want to hear.

      Do you think Apple even does integration or regression testing? I can't imagine "goto fail" would have slipped past if they were, because that's about the most basic "is the functionality working" test you'd start with. That seems like a good place to start.

      --
      Irony: Agile development has too much intertia to be abandoned now.
    12. Re: Holy shit by Anonymous Coward · · Score: 1

      Citation needed.

    13. Re:Holy shit by Anonymous Coward · · Score: 0

      Yes, and testing is hard. Excuses are easier. Enjoy your patch. https://forums.macrumors.com/threads/security-update-2017-001-breaks-file-sharing.2091913/

    14. Re:Holy shit by angel'o'sphere · · Score: 1

      Sorry to disagree, if your system has a 'deactivated root sccount' and if you still can log on to it, is probably the least thing anyone is considering to test. Especially in a regression test.

      When and how and why did such a vulnarability got introduced? How often do you want your test(er) to click the unlock button?

      --
      Cost free eBook I read (by iBook/Kobo/Amazon/ObookO/Gutenberg etc.): "The Green Odyssey" by Philip Jose Farmer.
    15. Re: Holy shit by Anonymous Coward · · Score: 0

      When demoing automated testing software this is literally the first use case I wrote.

      Login with various users / passwords, including root / blank.

      Once automated it should fail every time or your build has a problem, no ?

    16. Re:Holy shit by Anonymous Coward · · Score: 0

      Fair enough QA should take the bullet as well. But the point is they made their public mea culpa and fixed it. Plenty of times other bad security flaws get patched years later and no company or developer manages to even cough an apology. Plenty of open source software fits that bill.

    17. Re:Holy shit by Anonymous Coward · · Score: 0

      When was the last time Microsoft apologized for a security vulnerability, or noted that its customers deserve better? Good on Apple for taking ownership of the problem.

      Most other companies go silent or offer excuses rather than taking ownership of their failures.

    18. Re: Holy shit by Brockmire · · Score: 1

      But did it try multiple failed logins? Everyone else has done fuzz testing for years, but Apple doesn't seem to have.

    19. Re:Holy shit by Dutch+Gun · · Score: 1

      That's why I specifically mentioned the "goto fail" issue. That tiny bug completely broke SSL/TLS. How could they not be testing basic functionality like that before it's released?

      I'll grant that this particular situation might not have been tested, although to me, testing with root and a blank password seems fairly obvious. But this seems like a more widespread problem for Apple and how they test (or don't test) basic functionality. And I'm not talking about using human testers. This should be 100% automated. And that means it happens for every official build for the rest of time.

      Check out how in-depth SQLite's testing procedures are, for example: https://www.sqlite.org/testing... This sort of comprehensive testing doesn't eliminate all bugs, of course, but it's highly unlikely that any obvious bugs are going to slip by this test suite. And whenever a bug is found, it's not considered fixed until a regression test is added to the suite that will catch any future incidents of that sort of bug. This is how you build long-term stability into your software.

      --
      Irony: Agile development has too much intertia to be abandoned now.
    20. Re:Holy shit by Anonymous Coward · · Score: 0

      ummm actually MS have regularly apologied for security vulnerabilities and pledged to do better. what we saw here was bog standard boilerplate of a PR reponse that they all use.

    21. Re:Holy shit by angel'o'sphere · · Score: 1

      Not a good example.
      SQLlite, as any data base, can be tested 100% automatically.
      To log on with no passwd as root, you first have to come to the idea that this might even be possible.
      On the other hand you can easy automate that the passwd file (or shadow passwords) have a password for root.
      I actually never came to the idea to log on as root via the gui. But I never needed to.

      --
      Cost free eBook I read (by iBook/Kobo/Amazon/ObookO/Gutenberg etc.): "The Green Odyssey" by Philip Jose Farmer.
  9. Re:I can't help but translate... by jellomizer · · Score: 2

    I translated it as this was a known issue to the underlings, however it never was allowed to be addressed by the middle managers or this problem was a very to spot problem (probably some debug code that didn't get removed) that was allowed to get released.

    However compared to other companies, at least Apple is publicly admitting the problem. While some companies may patch the problem, but not state any details about it.

    --
    If something is so important that you feel the need to post it on the internet... It probably isn't that important.
  10. Hold That Software by cstacy · · Score: 3, Funny

    You're releasing it wrong.

  11. Allowing root access without a password? by sbrown7792 · · Score: 2, Funny

    That's what I call courage

  12. Wow by Anonymous Coward · · Score: 0

    And just yesterday I was reading posts by Mac fanboys claiming the latest bug was not that serious. Given Apple's announcement, the fanboys' heads must be exploding because either the bug was serious and they were wrong about that, or else the bug was not serious and Mac is overreacting (which means they don't know what they're doing anyway).

    1. Re:Wow by DontBeAMoran · · Score: 1

      It depends on the situation. Since AFAIK is requires physical access to the computer, it wasn't really a problem for people with home computers. For people traveling with laptops, or workplaces with Macs, it was a huge security problem.

      --
      #DeleteFacebook
    2. Re:Wow by jittles · · Score: 2

      It depends on the situation. Since AFAIK is requires physical access to the computer, it wasn't really a problem for people with home computers. For people traveling with laptops, or workplaces with Macs, it was a huge security problem.

      It was exploitable over remote desktop, but not over SSH. So, depending on how you have your computer configured, it may have been remotely exploitable (assuming VPN or local network connection, or an insecure router/firewall configuration)

    3. Re:Wow by BronsCon · · Score: 1

      I thought it required physical access, as well; then I read reports of people being able to access screen sharing and AFP shares using this method. I don't have a system running High Sierra to be able to verify those claims, but it seems plausible.

      This just isn't a bug you accidentally introduce into a properly designed auth system. That means either someone was acting maliciously, or the system was designed with extreme incompetence. Since we're talking about Apple, I don't think many fanbois will accept the incompetence explanation, so we'll go with malice to avoid triggering them. Since they allow Apple to maliciously empty their wallets, they seem to be okay with malice...

      ...

      ... I write as I check the shipping status of my new MabCook Pro.

      But, then, I'm a user, not a fanboi -- and I placed the order before this was made public.

      --
      APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
    4. Re:Wow by DontBeAMoran · · Score: 1

      Instead of writing "MabCook Pro" you might as well just go with "MacTim Pro" or "MathCook Pro".

      --
      #DeleteFacebook
    5. Re:Wow by TheFakeTimCook · · Score: 1

      I thought it required physical access, as well; then I read reports of people being able to access screen sharing and AFP shares using this method. I don't have a system running High Sierra to be able to verify those claims, but it seems plausible.

      This just isn't a bug you accidentally introduce into a properly designed auth system. That means either someone was acting maliciously, or the system was designed with extreme incompetence. Since we're talking about Apple, I don't think many fanbois will accept the incompetence explanation, so we'll go with malice to avoid triggering them. Since they allow Apple to maliciously empty their wallets, they seem to be okay with malice... ... ... I write as I check the shipping status of my new MabCook Pro.

      But, then, I'm a user, not a fanboi -- and I placed the order before this was made public.

      What's the big deal?

      Apple already published a simple workaround, which will completely fix the issue until a properly-tested update can be released. (Note: Yesterday's article had a link to an Apple Knowledge Base Article on how to fix the bug temporarily; but now that the Update has been released, MacRumors edited that out of their article, so here's what's left of the original workaround).

      https://www.macrumors.com/how-...

      And in fact, here is the REAL Update:

      https://www.macrumors.com/2017...

      Less than 24 hour turnaround? I'd say that's about as good as it gets!

    6. Re:Wow by Anonymous Coward · · Score: 0

      Did they fix the MacBook Pro machine already? Last time I checked no parts was user serviceable, this may sound not bad at all except when something fails (battery, ram, fan :) you will return this machine to the MOTHER-SHIP for annual inspection and then, your WHOLE DATA WILL BE well INSPECTED scaned and uploaded to a vault under your name for future reference and shared* with 3 letter agency if needed. Welcome to the new Cook da House.

      Apple user since 1998 but I got sober in 2016 and switched to whatever does the job* sorry apple we will not spend any more $$$ on your hardspyware*

    7. Re:Wow by BronsCon · · Score: 1

      Oh hahaha I assure you that was a typo. I would never purposely honor Tim Cook in that way.

      --
      APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
    8. Re:Wow by BronsCon · · Score: 1

      It's only as big of a deal as a similar bug in Windows would be. I don't think either of us think it's that huge of a deal since it's easy to mitigate and anyone following best practices wouldn't have been affected to begin with. That said, you and I both know that most Mac users don't follow best practices as far as security is concerned; they bought their Mac precisely so they didn't have to be a sysadmin, so this is actually a pretty big deal for a lot of users and will remain so until those users apply the patch -- which might be never for those who turned off automatic updates and don't want to be sysadmins. Admittedly, that's a small number, but we both know it's not 0.

      That bit about checking shipping status, by the way, 100% truthful. Brand new space gray MBP due in tomorrow.

      --
      APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
    9. Re:Wow by Gr8Apes · · Score: 1

      This just indicates that someone was very very sloppy. Sloppy like MS coders. ;)

      --
      The cesspool just got a check and balance.
    10. Re:Wow by BronsCon · · Score: 1

      Before you take it in, put 20v through the flash chips on the soldered-in SSD. You do have backups, right?

      --
      APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
  13. All Millennial-developed software has become shit. by Anonymous Coward · · Score: 2, Informative

    I think this is a much broader problem. This isn't just about Apple. This is about almost all software today that has been developed by Millennial (some people use the term "Hipster") developers.

    Millennials have been in the industry for about 10 years now, and these past 10 years have been some of the worst in terms of software quality.

    Just look at the destruction they've left behind them. Windows 8, 8.1 and 10. GNOME 3. Firefox 4 and later. Systemd. Wayland. Slashdot Beta. NoSQL. The list goes on and on.

    The Gedit text editor is an excellent example of how formerly-usable software has been destroyed. This is what Gedit used to look like. At that point it had a sane, easy-to-use, functional UI. This is what Gedit has become. It's like 50+ years of accumulated experience and knowledge has been discarded for no good reason, and the end result is a disaster.

    What we have is a generation of software devs who are far too focused on aesthetics and trendiness, with little to no care put toward usability, security, and reliability. They go out of their way to ignore everything we've learned about doing things right. They do things their own way, and it's a disaster.

    This isn't even a get-off-my-lawn situation. Many of us who are appalled by these developments are late Gen X'ers. We aren't even that much older than the Millennials who have caused so many problems! In fact, many of us spend our days trying to bring some sanity to otherwise disastrous workplaces. We remember how software used to be developed, yet we're so outnumbered by Millennials that we just can't keep up.

    It was excusable when security flaws and usability problems were accidentally introduced by earlier generations because they were doing pioneering work, and the concepts behind these security flaws and usability problems hadn't even been discovered yet. But the industry should be far beyond that now. The knowledge is there, it's just that Millennials choose to totally ignore it.

  14. This was a known "feature" by darth+dickinson · · Score: 2

    This was posted as recently as November 13, as a "solution" to an issue of not having an administrative account: https://forums.developer.apple...

  15. Re:All Millennial-developed software has become sh by DontBeAMoran · · Score: 1

    TL;DR

    The last generation of programmers are too focused on the shiny.

    --
    #DeleteFacebook
  16. All bugs are also features. by XXongo · · Score: 1

    All bugs are also features. Depends on what you want them for.

  17. Slashdot problem by Anonymous Coward · · Score: 0

    Seems like something Slashdot needs to fix in their rendering. No other website I use on iOS has this problem.

    1. Re:Slashdot problem by Anonymous Coward · · Score: 0, Troll

      Groan.... The typical "it 'is never apples fault"

    2. Re: Slashdot problem by Anonymous Coward · · Score: 0

      It is /.'s fault that this site still doesn't have proper Unicode support. Even the amateurs over at SoylentNews were able to modify their fork of Slash to support it! If they could do it, then there's no excuse for /. not supporting Unicode, too.

    3. Re: Slashdot problem by OrangeTide · · Score: 2

      It's embarrassing for ./ really. The Content-Type header says "charset=utf-8". And they could have easily fixed the form with a slight tweak to ./'s HTML. Example: <form action="//apple.slashdot.org/comments.pl" method="post" accept-charset="ISO-8859-1">

      --
      “Common sense is not so common.” — Voltaire
  18. Open source by Anonymous Coward · · Score: 0

    Open v closed source is a trade-off.

    That open source is always more secure is a fallacy. Open source on small projects can be a terrible idea: it gives attackers the source code.

    HOWEVER, for big projects, and especially one of the biggest in the world (Apple operating systems), open source tends to strongly outweigh closed source. Tim Cook, it is time to open the source code.

    1. Re:Open source by michelcolman · · Score: 2

      I don't think they can do that. If anyone can download and compile the MacOS source code, and tweak it to run on different computers, Apple's hardware sales will go down the drain.

      Yes, it would get rid of a lot of bugs. But it would also get rid of Apple itself. I'm not saying that would be a bad thing, just that it would be monumentally stupid.

    2. Re:Open source by jellomizer · · Score: 1

      I could argue the other way around.
      For a smaller company, having your code open source allows for more eyes on the software then what a small company can afford. While the biggest company can hire a lot of people to check and review the code.

      If your program such as OS X is very popular and had a lot of features that competitors would love to see how they approached a problem, having it Open source could lead to a lot of excessive copying if not the code directly, duplicating the idea and specifications. Having an OS X compatibility layer in Linux or in Windows. Knowing which checks is needed to make a good Hackintosh system.

      --
      If something is so important that you feel the need to post it on the internet... It probably isn't that important.
    3. Re: Open source by Anonymous Coward · · Score: 0

      If open source software is supposedly so much better than why do I get probably 20+ emails a week from the Ubuntu security alert mailing list? Open source software is just as flawed as closed source software is.

    4. Re: Open source by Anonymous Coward · · Score: 0

      Question: does Microsoft send you emails to alert you of bugs that are active?

    5. Re:Open source by Hal_Porter · · Score: 2

      Also the Darwin kernel, i.e. BSD on Mach, is already open source. Even though BSD is BSD not GPL licensed and they'd be legally allowed to keep their very extensive changes secret, Apple still release their changes

      https://opensource.apple.com/s...

      The don't release all the kernel mode code though - e.g. they don't release the source code to "Dont Steal Mac OS X.kext"

      http://www.osxbook.com/book/bo...

      They also don't release the source code for the user mode stuff, but then they don't have to.

      And it seems like they already get the benefit of any 'many eyes make all bugs shallow' effect from opening up the kernel.

      'Many eyes make all bugs shallow' is bogus anyway. It's not like many people are going to sit, read the source to something and find a vulnerability. And even if they did there's nothing to stop them selling it to someone other than the vendor - e.g. Russian/Chinese mafia, NSA, GCHQ etc probably all pay better.

      --
      echo -e 'global _start\n _start:\n mov eax, 2\n int 80h\n jmp _start' > a.asm; nasm a.asm -f elf; ld a.o -o a;
    6. Re: Open source by sheph · · Score: 1

      You've disproven your own point. You get 20+ emails. And if you'll notice the stuff that's serious gets fixed pretty quickly. Conversely with some other companies you never hear about the bug until it's been exploited or patched. So you don't know about the 2000+ vulnerabilities that you're exposed to that have been hanging out for years because closed source company has decided they're too expensive to fix. But don't worry. The CIA knows about them. Of course so do the bad guys. Ignorance is bliss right?

      --
      I don't believe in karma, I just call it like I see it.
    7. Re: Open source by Anonymous Coward · · Score: 0

      If you are an IT department that buys Microsoft products, yes they do that.

    8. Re: Open source by Anonymous Coward · · Score: 0

      Show me one. All I get is spammed by Windows Insider emails and new product release statements.

    9. Re: Open source by Anonymous Coward · · Score: 0

      Here is the funny thing. I hear about Linux bugs all the time. When it comes to Windows, I hear about 0-days and bugs -being exploited-.

      I'd rather take talk about potential vulnerabilities and more of them, than less mention, while someone already has been using the exploits to gain footholds in a company.

    10. Re:Open source by Anonymous Coward · · Score: 0

      For a smaller company, having your code open source allows for more eyes on the software then what a small company can afford.

      But that isn't the reality, it is the theory that isn't backed up by any real evidence. Go and take a look at the top 1000 active projects on github or sourceforge or even google code back when it was running and you find the average number of contributors is from 1 to 4 people.

      That's the reality. This idea that you should just open source your code and people will come from far and wide to look at it and contribute to it and fix & find bugs is just rubbish. Open source is a great thing with many many advantages but I think it's time to stop evangelizing the imagined scenarios as fact when they clearly are not.

    11. Re:Open source by ShanghaiBill · · Score: 1

      Do you really think there's that much demand for MacOS these days?

      Apple has about 7.5% of the PC (desktop+laptop) market. That is about half of their peak around 1989 by market share, but way more units sold because the market today is so much bigger. Nearly all of these are laptops, since Apple has mostly abandoned the desktop.

      people buy Mac's mostly because they're Apple people, or perceive it as some kind of status thing.

      I use a Macbook because MacOS is Unix that "just works".

    12. Re:Open source by Anonymous Coward · · Score: 0

      Apple software has been on the decline since at least Yosemite with El Capitan causing major USB problems on my hardware until near its final update. I use Windows and Linux at work and have used Macs at home since 1986. My next home computer will be a Windows box. Apple has fallen so far behind Windows in features and usability I curse it constantly.

      However, while we don't have current Linux versions on our work systems, Linux is still way behind Apple OS X in usability.

      Is there still demand for OS X? Maybe but I can't see any reason for it other than it is not Windows and still runs MS-Office.

    13. Re:Open source by Anonymous Coward · · Score: 0

      Oh bullshit,

      Open source isn't inherently more secure, we see projects like openSSL with Heartbleed where the code was plenty open source but that doesn't actually mean anyone's going to bother digging into it to find the vulnerabilities. The fact is that someone has to give a shit if it be closed source our open source. I can open source my project right now that doesn't mean anyone's going to bother reading the code to do QA for me

      The only thing close sourced projects have over open source is that they by their very nature obfuscate things which does very little in terms of pratical security. IE's Trident wasn't riddled with holes because it was closed source, it was riddled with holes because the objectives of the Windows API's which ti so heavily relied upon were incongruent to the nature of security. On the same end Chome's Webkit isn't inherently more secure because it's (mostly) open source, it's because Google threw literally millions of dollars at the project to have people properly QA the stuff

      Open source is basically "Do I want to give up some degree of creative control in exchange for free QA"

    14. Re: Open source by Anonymous Coward · · Score: 0

      Eh, Mac hardware sales pale in comparison to iPhone sales. The Mac used to be Apple's bread-and-butterâ"itâ(TM)s not anymore. If people can install an open-sourced Mac OS on other hardware, so what? Maybe people will stop complaining about the Mac Pro that Apple doesnâ(TM)t really want to build anyway.

    15. Re:Open source by Anonymous Coward · · Score: 0

      But these days, people buy Mac's mostly because they're Apple people, or perceive it as some kind of status thing.

      That was the case a couple of years ago. Though the people who bought Apple back then probably still do.

      But after Steve Jobs died, Apple started losing their status, and everyone was predicting that they would crumble. They didn't, because just about the same time, they got a huge helping hand. Microsoft released Windows 10 and did everything in their power to kill off Windows 7 (including restricting hardware vendors from making Windows 7 drivers).

      Nowadays, Apple sales is driven mostly by people wanting to avoid Windows 10.

    16. Re: Open source by Anonymous Coward · · Score: 0

      Heartbleed

    17. Re:Open source by exomondo · · Score: 1

      I use a Macbook because MacOS is Unix that "just works".

      As much as the various hardware limitations, software limitations (max of OpenGL 4.1 in 2017? Come on) and closed, proprietary technology over open standards (Metal over Vulkan, Airplay, Airdrop, Facetime, etc) is annoying I do like that the kernel can be updated without it breaking the display driver and having to go into a terminal to recompile the kernel module just to get the GUI working again. It's all those niche little annoyances that still persist all across Linux that add up to it being a poor user experience. Macs aren't perfect but on a day-to-day basis I often prefer to deal with their flaws than Linux's.

    18. Re: Open source by Anonymous Coward · · Score: 0

      We've had many clear examples of critical bugs in the Linux kernel that have existed for years, even over a decade that weren't discovered because the 'many eyes' theory that so many open source advocates trot out is not as true in reality as they would have you believe. And this is in the most popular and most visible open source project in the world. Even security-focussed projects that are used incredibly widely like OpenSSL and OpenSSH have been broadly distributed with serious security flaws in them.

      Arguing the security of closed source over open source either way is obviously stupid because what really matters is who is actually looking at the code. Maybe a million monkeys sitting at a million computers with the Linux source code might find and fix a bug, but probably not. The only reasonably clear cut case is closed source abandonware but then again the case of one person coming along and picking up an abandoned open source project doesn't really happen either, in fact the NIH syndrome is rife in the community even with projects that are reasonably active so that case even starts to fall apart in terms of being a valid comparison.

    19. Re:Open source by david_thornley · · Score: 1

      Is there still demand for OS X? Maybe but I can't see any reason for it other than it is not Windows and still runs MS-Office.

      Not only is it not Windows, it's Unix. Mac OSX is a user-friendly Unix that runs Office. Try finding anything else like that in the market today.

      --
      "When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
    20. Re: Open source by Anonymous Coward · · Score: 0

      Eh, Mac hardware sales pale in comparison to iPhone sales.

      Sales of pretty much everything pale compared to iPhones.

  19. Re:All Millennial-developed software has become sh by mlw4428 · · Score: 1

    Yes, yes, DOS and Windows 95 were the glorious days of security. The Blackberry was unhackable and IE 6 was teh gratest web browber ever!! Napster still lives on in my heart.

  20. It isn't even just security bugs like this... by ZorinLynx · · Score: 4, Interesting

    There's all kinds of cosmetic and usability bugs floating around, and Apple doesn't seem to be in a hurry to fix them. They're the kind of bugs that aren't showstoppers but are still very annoying or can result in bad data.

    The Calculator bug in iOS is one example of a recent bug that can produce bad data and wasn't fixed. Until iOS 11.2 (which isn't out yet!) even though it was reported way back in 11.0 beta, before the OS was released to the public.

    Another recent issue, though less important, is that the Weather widget will randomly stop updating, so you'll be seeing last night's weather instead of right now. This bug was also reported several versions ago and is as of yet unfixed in the latest 11.2 beta.

    I know bugs happen; nobody is perfect. But these are obvious, reproducible bugs that are not being fixed after being reported months prior. What the hell, Apple?

    1. Re:It isn't even just security bugs like this... by TheFakeTimCook · · Score: 1

      There's all kinds of cosmetic and usability bugs floating around, and Apple doesn't seem to be in a hurry to fix them. They're the kind of bugs that aren't showstoppers but are still very annoying or can result in bad data.

      The Calculator bug in iOS is one example of a recent bug that can produce bad data and wasn't fixed. Until iOS 11.2 (which isn't out yet!) even though it was reported way back in 11.0 beta, before the OS was released to the public.

      Another recent issue, though less important, is that the Weather widget will randomly stop updating, so you'll be seeing last night's weather instead of right now. This bug was also reported several versions ago and is as of yet unfixed in the latest 11.2 beta.

      I know bugs happen; nobody is perfect. But these are obvious, reproducible bugs that are not being fixed after being reported months prior. What the hell, Apple?

      Oooh, how horrible!

      A UI bug in the free Calculator App, and an Update bug in the Weather Widget?

      Seriously?

      Now, let's compare that against Windows and Linux, shall we?

    2. Re:It isn't even just security bugs like this... by aaarrrgggh · · Score: 1

      My big gripe is that they fail to acknowledge bugs as such: their miserable implementation of SMB, and eliminating FTP and Telnet clients are my two biggest gripes. They are really burning bridges with this crap.

    3. Re:It isn't even just security bugs like this... by nine-times · · Score: 1

      Yeah, I agree. I don't think it's really an Apple problem, which is why I think they can get a away with it, but a more general "developer" problem. A lot of developers seem to spend endless amounts of time trying to develop new cool features, or else shuffling the UI around, but they don't actually fix some of the very real and fundamental problems that people have.

      Working in IT, it's just endless. There are tons and tons of problems with every product that I deal with where it's needlessly complicated to deploy, and then features don't work right. In the case of Microsoft, there's also the problem of them constantly trying to force things down your throat (e.g. you can't turn off Cortana, you can't control Windows Update anymore, you can't stop Windows from pushing Windows Store advertising into your start menu).

      And then there are really simple things that there still isn't a good solution for. Secure transmissions online is still a complete mess. There's no viable standard for something as simple as IM. Email archiving and management is still handled in moronic ways. Identity management and authentication is in the dark ages. Bulk management of servers and workstations is a hodge podge of different ridiculous and complicated systems. Imaging workstations is still harder than it needs to be, and a lot of developers won't distribute their applications in standard package formats.

      Sorry, I'm off on a tangential rant, but most software development just seems so stupid. Apple's failure to create a fast and stable implementation of SMB is an example, but far from the worst things developers are doing. Hell, if I could, I'd take on a "passwordless root by default" bug if it meant Microsoft would again let me control when Windows Updates run.

    4. Re:It isn't even just security bugs like this... by Anonymous Coward · · Score: 0

      My pet one is the terminal in High Sierra setting locale environment variables incorrectly to "UTF8" (hint: should be C.UTF8, or most likely en_US.UTF-8), breaking perl and just about everything else in the server farm if you SSH, unless you arrange on the server to drop all attempts by the client to set env. vars.

    5. Re:It isn't even just security bugs like this... by Anonymous Coward · · Score: 0

      Oooh, how horrible!

      A UI bug in the free Calculator App, and an Update bug in the Weather Widget?

      Seriously?

      Now, let's compare that against Windows and Linux, shall we?

      Yes lets: Windows - Crashes: Linux - fails to boot consistently: Apple: Can't do basic math causing you to kill someone because your formula is wrong.

      See, I can write irrelevant hyperbole. too.

    6. Re:It isn't even just security bugs like this... by ZorinLynx · · Score: 1

      The thing is I agree with you; the bugs aren't show stoppers. I even mentioned that in my original comment.

      But this is evidence that Apple's attention to detail is not what it used to be. These sort of bugs didn't exist prior to iOS 7. I've been using iOS since version 3, and right around the time of iOS 7 there was a noticeable drop in QC which persists to this day.

    7. Re:It isn't even just security bugs like this... by cyn1c77 · · Score: 1

      What the hell, Apple?

      Dear Peon,

      We're sorry for your inconvenience. We are aware of these "features" and will address them as we feel like it.

      In the meanwhile, please feel free to purchase 3rd party apps to solve your needs.

      We will appreciate the profit that we make off of your purchases.

      Sincerely,
      Apple Customer Service

    8. Re:It isn't even just security bugs like this... by Lord+Flipper · · Score: 1

      There's all kinds of cosmetic and usability bugs floating around...

      Final Cut Pro X can't be launched on a MacBook Pro in "clamshell" mode. Five iterations of 10.13.2 beta have failed to fix, despite Apple's escalated support knowing about this since the betas of 10.13.0. Obviously not going to affect many, but for me, and quite a few others, a serious fuckup.

      Mail.app links launch Safari, despite any other browser being chosen as "default." Annoying. Fixed, temporarily, by deleting safari.app. Then, on second test, Evernote gets launched. Moved evernote to external drive, and firefox.exe, inside Windows 7, inside Parallels, launches. Moved Parallels to an external drive, now, finally, firefox.app launches. Success, but... Pathetic.

      Ongoing USB issues; Devices often needing to be hot unplugged/re-plugged in order to register and kick in. Lame.

      "Ignore Trackpad when other device present" staying "active" (i.e., disabled) even when external device is disconnected... the beat goes on...

      Analysis? They're spending way too much time on the phone.

  21. The bar is pretty low. by Anonymous Coward · · Score: 0

    The bar is pretty low.

    You bet they are "taking it seriously", in different words.

    Words sound nice.

  22. Re:All Millennial-developed software has become sh by Anonymous Coward · · Score: 2

    That's a really bad summary. Yes, part of the problem is that Hipsters care too much about looks. But you ignored the other serious problems that the GP mentioned:

    1) Hipsters go out of their way to be ignorant. They don't want to learn about security, so we get atrocious security flaws in the software they write. They don't want to learn SQL, so we get atrocious NoSQL databases to deal with. They don't want to learn about how their users use software, so we get awful UIs. They don't want to learn C++, so we get a terrible language like Rust.

    2) There are too many Hipsters. No matter how much effort responsible programmers put in trying to fix the many problems created by Hipsters, these responsible programmers will always fall behind just because the Hipsters crank out so much crap at such a fast pace. It's like riots and looting, where a relatively small number of police officers and store owners are absolutely overwhelmed by a much larger crowd of thugs.

    I'd like to add another problem:

    3) Too few people are willing to identify the real problem: Hipsters. The blame is placed on companies or entire open source projects, for example, rather than the Hipsters who are responsible for the problems. It really doesn't help that the Hipsters have adopted Codes of Conduct into their projects that they then use against anyone who dares point out the problems they've caused. That's why Rust has turned into the mess that it is, for example. Criticism and pointing out of flaws is strictly forbidden within Hipster-dominated software projects.

  23. the gruesome painful death of XXongo is a feature by Anonymous Coward · · Score: 0

    hey it's your logic at work

  24. Yep, they screwed up... by Anonymous Coward · · Score: 0

    ...but this is hardly news. Developers know how much the app dev and review process is has become degraded over the past few years.

  25. True enterprise level bugs by fubarrr · · Score: 0

    True enterprise level bugs, only from Apple

    1. Re:True enterprise level bugs by TheFakeTimCook · · Score: 1

      True enterprise level bugs, only from Apple

      Oh, really?

      Wanna check out some Windows and Linux bug-lists?

    2. Re: True enterprise level bugs by Brockmire · · Score: 1

      Please stop replying to every fucking Apple complaint. You look pretty pathetic.

    3. Re: True enterprise level bugs by TheFakeTimCook · · Score: 1

      Please stop replying to every fucking Apple complaint. You look pretty pathetic.

      Please go fuck yourself.

    4. Re: True enterprise level bugs by sysrammer · · Score: 1

      With an Apple?

      --
      His ignorance covered the whole earth like a blanket, and there was hardly a hole in it anywhere. - Mark Twain
  26. Think Differently about it by Progman3K · · Score: 1

    Give 'em a break, they've only been developing software for 40 years

    --
    I don't know the meaning of the word 'don't' - J
    1. Re:Think Differently about it by Anonymous Coward · · Score: 0

      Nope! They have billions of years of collective experience!

    2. Re:Think Differently about it by Anonymous Coward · · Score: 0

      Give 'em a break, they've only been developing software for 40 years

      Nope. Since around late-2011. They're participating in a dragnet.

  27. Re:All Millennial-developed software has become sh by Anonymous Coward · · Score: 1

    Did you even read the GP comment? It covers that very clearly:

    It was excusable when security flaws and usability problems were accidentally introduced by earlier generations because they were doing pioneering work, and the concepts behind these security flaws and usability problems hadn't even been discovered yet. But the industry should be far beyond that now. The knowledge is there, it's just that Millennials choose to totally ignore it.

    When you're doing cutting edge work, you'll make cutting edge mistakes.

    DOS was the first OS that saw huge mainstream adoption. Of course this situation would bring up unanticipated problems.

    Windows 95 was the first OS that saw huge mainstream adoption during the era of mainstream Internet usage. Of course this situation would bring up unanticipated problems.

    BB devices were the first to see huge mainstream adoption at the earliest stages of the modern smartphone era. Of course this situation would bring up unanticipated problems.

    IE 6 was the most advanced browser of its day, pushing the boundary far beyond what Navigator did. For example, IE 5 and IE 6 were the first browsers to give us AJAX, which is still used today. Of course this situation would bring up unanticipated problems.

    The issue here is that Millennials/Hipsters aren't doing cutting edge work. They're doing very basic work most of the time, but they're making mistakes that we knew about, and how to avoid them, decades ago!

  28. They have had variations of this for 10-15 years. by Anonymous Coward · · Score: 0

    OSX has *ALWAYS* had a method to bypass password verification and login as a root user. Almost always designed in a way which the end-user can't disable.

    I had a friend who worked tier 1 tech support for Apple a few years back. He found out like a half dozen tricks for bypassing various security features once logged in and at least two ways to bypass the login screen, one was a three keyed salute during boot, and another was at the login screen (one or both were disable-able, but were included by default so Mac Gurus could seem 'mystical' and recover systems for idiots who had forgotten their password.)

    Expect to see customer satisfaction with the Mac store guys to go down after this has been 'fixed'.

  29. But Apple will NOT let you talk about such things by shanen · · Score: 3, Insightful

    Apple's response is just PR-driven BS, and your comment does NOT deserve the "insightful" moderation the shills and sakura gave it. The only insight from your comment is that you have minimal contact with Apple.

    Try and honestly criticize Apple in an Apple-controlled venue and you will find out what total lack of respect means in a profit-dominated context. For example, if you had tried to describe this rather horrendous security problem and gotten too negative, I predict you would have found your comment blocked. Based on my years of experiences involving a MacBook Pro (which I still use on a daily basis for certain tasks), I actually think Apple has automated the censorship using sentiment analysis of the draft comment. Or perhaps it's profile-driven by the secret dossiers they have on each of us?

    I could write a more substantive response on the topic, but here on Slashdot such a comment would merely be shouted down by pro-Apple fanbois with mod points to burn. Not worth the time, though I will donate a few seconds for a rerun of the capsule version:

    Capitalism and communism are dead. Our new religion is corporate cancerism. There is no gawd but profit, and Apple is gawd's chief prophet.

    --
    Freedom = (Meaningful - Coerced) Choice != (Speech | Beer^2), and sad sock puppets' bad mods avail them naught.
  30. Apple already uses a widely popular practice by Anonymous Coward · · Score: 0

    "Just get it done by tomorrow, and if there's an issue we can fix it later."

  31. Re:I can't help but translate... by Anonymous Coward · · Score: 0

    LOL apple admitting the problem. And it didnt even take the threat of a class action lawsuit this time. If apple could have they would definitely have covered it up. That is in their DNA.

  32. Comment removed by account_deleted · · Score: 1

    Comment removed based on user account deletion

  33. Re:It's not the development process by shanen · · Score: 1

    Your negative assessment is only accurate as far as it goes. If the Slashdot moderation were not so borken (sic), that could explain your lack of an "insightful" mod, though I'd prefer to think it was your omission of the positive side (in the fantasy context of good moderation). I think your missing keyword is "priority", as in security is not a high (or high enough) priority at Apple because something else is. That something else is profit, as summarized in my earlier reply.

    --
    Freedom = (Meaningful - Coerced) Choice != (Speech | Beer^2), and sad sock puppets' bad mods avail them naught.
  34. Now dump the thin is king hardware devs! by Joe_Dragon · · Score: 2

    Now dump the thin is king hardware devs! and get some real workstations. IMAC pro no ram door come on it's not that hard!

    1. Re:Now dump the thin is king hardware devs! by Anonymous Coward · · Score: 0

      iMac Pro No RAM!!!
          That's it, that's the idea! Make every device a thin-client that connects wirelessly to the cloud.
      Down with local storage, Yay for going back to the good 'ol days of mainframes & their terminals.
      *Sigh, yuck

    2. Re:Now dump the thin is king hardware devs! by Joe_Dragon · · Score: 1

      and pay comcrap $10 per 50G in overages. if you have cell then $10/GIG and upto $15-$20/meg roaming.

  35. Re:I can't help but translate... by TheFakeTimCook · · Score: 0

    I translated it as this was a known issue to the underlings, however it never was allowed to be addressed by the middle managers or this problem was a very to spot problem (probably some debug code that didn't get removed) that was allowed to get released.

    However compared to other companies, at least Apple is publicly admitting the problem. While some companies may patch the problem, but not state any details about it.

    Exactly!

  36. Blame Game by Anonymous Coward · · Score: 0

    Blah, blah, blah. Just fix this shite.

  37. Re:I can't help but translate... by rwven · · Score: 1

    I'm curious what companies patch the problem and not state any details about it? I've always seem MS and linux distros provide very concise details about exploits and the fixes for them.

  38. Maybe this will take hold elsewhere? by ErichTheRed · · Score: 1

    I totally agree that waterfall planning for software doesn't make sense, but IMO neither does Features Features Features, 10 deploys a day, release now/patch later, and all the other things we've gotten as the pendulum shifted all the way to the other side. I'm on the Windows side of the fence and it's been an interesting couple of years watching them run through release release release and gradually slow it down a bit as they see quality dropping.

    Operating system or application code, running on machines people own and potentially controlling sensitive processes/data, need to be developed a little alower and safer than the average phone app. Phone apps only have a couple of client devices and a known back-end...operating systems are still within the user's control to some extent. OS bugs are very public, potentially very dangerous, and can't be changed by some Red Bull-fueled developer pushing a quick hack change to production. Even if you automate patching, a patch still needs to be released and regression-tested.

    I'm hoping every software company will take some of these lessons into account, because I like the faster pace of development and don't want projects to turn into bug-ridden messes because someone read one too many Agile books and isn't focusing on the actual work.

  39. Re:Auditing is the first step by Anonymous Coward · · Score: 0

    I think Rule 3 of Agile is to fire the QA team. Not sure if that's the McKinsey or Accenture version of Agile though... :-)

  40. Re: I can't help but translate... by Anonymous Coward · · Score: 0

    Microsofts stripped all useful information from their updates. So now you don't know wtf is getting installed. Nice transparency.

  41. Re:I can't help but translate... by Anonymous Coward · · Score: 0

    They probably all do. But for some bizarre reason apple deserves to be praised for it.

  42. Re:But Apple will NOT let you talk about such thin by Freischutz · · Score: 2

    Apple's response is just PR-driven BS, and your comment does NOT deserve the "insightful" moderation the shills and sakura gave it. The only insight from your comment is that you have minimal contact with Apple.

    Try and honestly criticize Apple in an Apple-controlled venue and you will find out what total lack of respect means in a profit-dominated context. For example, if you had tried to describe this rather horrendous security problem and gotten too negative, I predict you would have found your comment blocked. Based on my years of experiences involving a MacBook Pro (which I still use on a daily basis for certain tasks), I actually think Apple has automated the censorship using sentiment analysis of the draft comment. Or perhaps it's profile-driven by the secret dossiers they have on each of us?

    I could write a more substantive response on the topic, but here on Slashdot such a comment would merely be shouted down by pro-Apple fanbois with mod points to burn. Not worth the time, though I will donate a few seconds for a rerun of the capsule version:

    Capitalism and communism are dead. Our new religion is corporate cancerism. There is no gawd but profit, and Apple is gawd's chief prophet.

    Why use so many words? You could have packaged all that into a single sentence:

    Blasphemy!! Summon the Holy Inquisition !! BUUUUUUURN THE HERETIC!!!

  43. Re:All Millennial-developed software has become sh by Narcocide · · Score: 1

    While you're on the money about the fact there's a specific subculture that is regressive and counter-productive to software quality that is apparently belligerently persisting to fight against industry best practices, should we really be using the word "Hipster" as a label for them? Don't get me wrong, I've got no special love for "Hipsters", and all their tight-pants flannel-wearing beard-sporting shenanigans, I'm not sure they actually have anything to do with this. As far as I can tell it seems to be actually a flood of current, former, and aspiring Microsoft programmers causing this, with some inside help from RedHat (who we never really should have trusted anyway) and while some of them may incidentally be Hipsters, I don't think most Hipsters are actually even coders. You may be wrongfully lambasting the wrong subculture here.

  44. Ok, review completed. by axettone · · Score: 0

    Apple developers can't write good code anymore because of their butterfly keyboards. Writing code became too painful, so they're skipping the test part.

  45. Re:They have had variations of this for 10-15 year by Anonymous Coward · · Score: 0

    You mean the mystically well-documented single-user boot feature?
    https://support.apple.com/en-us/HT201573

  46. Re: I can't help but translate... by rwven · · Score: 1

    And provides a link to a KB article with all the details... Of course they don't give you all the gory details right in the windows update window.

  47. Maybe they'll fix IOS Appleid popup as well... by jmichaelg · · Score: 4, Interesting

    IOS has a "feature" that the OS pops up a request for your Apple ID credentials at random times. Open Pandora and you'll get a popup. Open pretty much anything and the popup appears. There's no provenance to the pop up so you don't know what part of OS is asking for the credentials or why. Backup works without answering the request as you can be signed into iCloud and still get the pop up.

    My response is to dismiss the pop up and continue with what I'm doing but it's a PITA. A naive user will enter their credentials in the hope the "feature" is mollified which it sometimes isn't.

    The correct way for IOS to ask for the credential is for the popup to say "Open Settings/icloud ( or whatever) and enter your AppleID." Settings would second the request by posting a little icon indicating there's a response pending ala a text message. An animation within settings would guide the forgetful user if the path is more than one level deep in settings so they'd navigate to the proper IOS setting to satisfy the pop up.The point of all that is you know you're talking to Settings when you provide credentials.

    The current scheme is ripe for an app to steal your Apple ID. Write an app that does something kind of useful, wait for the 10th, 20th, run and pop an identical pop up that looks just like the OS popup. The user can't tell if it's the app or IOS asking and enters their credentials. Voila, you have access to the user's Apple ID. A little more elided hacking will circumvent 2 factor if it's enabled.

    Too much water has gone under the bridge that I guess an obvious attack is new again.

    1. Re:Maybe they'll fix IOS Appleid popup as well... by Anonymous Coward · · Score: 0

      Maybe apple will look into that if you post it on Twitter. Otherwise probably not.

    2. Re:Maybe they'll fix IOS Appleid popup as well... by Anonymous Coward · · Score: 0

      You've got the thing hounding you for credentials too, eh? What OS are you on? My 5s running 8 or 9 is outdated granted, but it has started doing this and I have to say it is highly suspicious...

    3. Re:Maybe they'll fix IOS Appleid popup as well... by Anonymous Coward · · Score: 0

      It sounds like you have a sync issue somewhere. I get those when I change a password, eventually I figure out where and fix it and it stops.

  48. Re:It's not the development process by phantomfive · · Score: 1

    If the Slashdot moderation were not so borken (sic), that could explain your lack of an "insightful" mod

    Moderation doesn't matter: karma is just a number on a server somewhere.

    I think your missing keyword is "priority", as in security is not a high (or high enough) priority at Apple because something else is.

    If Apple puts more priority on security, there are a lot of things they can do (for example, do managers include time in their sprints for the programmers to think about security?)

    The reality is though, even if you have really nice processes, if the people writing the code don't care about security, then you'll end up with bugs like this. You can make process requirements that every line of code has a unit test, but then you will get people writing tests that check for nothing.

    Of course you can make a process of "anyone who doesn't care about security will be fired," extreme but true.

    --
    "First they came for the slanderers and i said nothing."
  49. Paging Scott Forstall by Anonymous Coward · · Score: 0

    Paging Scott Forstall....

  50. Maybe they'll fire some XCode devs by Anonymous Coward · · Score: 0

    At least the devs who keep bringing us Objective C, Swift, and whatever is next that requires completely rewriting our apps.

    And maybe they'll hire some devs who can figure out how to avoid sending out multi-GB updates to XCode.

  51. Kindergarten? by ChristopherBreitbach · · Score: 1

    This seems like they need to.. revamp their processes completely. Don't you think any new PRODUCTION software being released, during the increased hack threats ever being reported... during the busiest shopping of the year.. would have been verified across 3 different points at least?? Development -> Testing of changes across at least 3 environments Quality Assurance -> Verifying only what's changed works as expected? Maybe lets spend a bit more time on that one. Security Review -> Verifying security points through automated & manual review pertinent to the change? Something with accounts, passwords, users was changed. Additional security review of files, users... lsof and strace work on a basic level when you don't work at Apple. Apple.. this is Kindergarten stuff.. it should be embarrassing with a follow-up assurance package for a year verifying security on offline, local levels..for all of your AppleCare customers. Experian, Red Code.. Every Apple across the world? Common guys.. Kindergarten. -B2

  52. Re:All Millennial-developed software has become sh by sheph · · Score: 2

    I'm not sure millennials are to blame. Driving this breakneck pace of software development is corporations looking to make a quick buck with little thought or care given to security or quality. It's crank it out or we'll get someone who can. So they inspire this sort of crapfest.

    --
    I don't believe in karma, I just call it like I see it.
  53. Apple Security issu*cough*backdoor*cough* by saccade.com · · Score: 1

    Something's fishy about the "auditing our development processes" response. Maybe somebody was deliberately trying to slip in a back door?

  54. Re:They have had variations of this for 10-15 year by Anonymous Coward · · Score: 0

    All of the back ways in CAN be disabled, but nobody does. Apple even provides a howto.With the modern full-disk encryption they are less useful as long as that is enabled.

  55. Re:All Millennial-developed software has become sh by Anonymous Coward · · Score: 0

    As someone who works in DevOps, I would pin the blame squarely on the Scrum master, the PMs, and the PHBs. If a co-worker stops doing their demanded 5-10k lines of code a day to work on security, he or she will be crucified come tomorrow's stand-up meeting because they didn't get their stuff done during a sprint... and dev environments are -always- in a sprint state, just like the IT department I was in was always in a "oh shit, FIRE!" state. One guy who was looking to re-engineer some code so it actually had some security was fired, because the PM considered security to be a waste of time, where if the company got sued due to a breach, it wouldn't be the PM or the devs who would feel the heat.

    The millennials are doing their damndest to keep employed. They have zero say. Blame the MBAs who don't give a flying fuck about anything but how sleazy they can be to profit from things. Blame the managers whose management style is to fire people as their first recourse, and then blame others why their department has such a high turnover rate, or the manager who is using contractors with B-1 visas (where the fines for visa fraud are tiny and part of doing business.) Blame the C-level staff who intones "security has no ROI" like it is a mantra to the next plane of enlightenment. Blame the government for not stepping in and putting the hammer down on the disinterest to protect people's data.

  56. Process improvements by Anonymous Coward · · Score: 0

    "Uh oh, better add a user story for not allowing the world to login as root and put that in the scrum backlog"

    Modern software development is just completely fucked.

  57. Re:darth_dickinson is a child molester by Anonymous Coward · · Score: 0

    Nice try, Apple fanboi. Go polish Tim Cook's cock some more.

  58. Feature by Anonymous Coward · · Score: 0

    It's not a bug, it's Apples's latest innovative feature.

  59. Security breach boilerplate by manu0601 · · Score: 1

    We greatly regret this error and we apologize

    Of course they do. What company would not copy/paste the security breach boilerplate in such a situation? It could even be automated: if +"security flow" +apple yields something in the news, send the press release.

  60. Two key people responsible for this fail at Apple: by Anonymous Coward · · Score: 0

    Management who failed to protect the public from an obvious flaw:

    1.Ivan Krsti @radian on twitter

    2. Viresh Ramdatmisier https://www.linkedin.com/in/vireshramdatmisier/

    They obviously didn't smoke test this release sufficiently and should be held accountable.

    Apple rakes in billions and should be held to a higher standard of software assurance.

  61. Re:But Apple will NOT let you talk about such thin by shanen · · Score: 1

    If you can't understand what I wrote and actually want to, please feel free to ask for clarification.

    If you can't understand what I wrote and don't want to, that's certainly your prerogative.

    If you have nothing to say, why don't you just say nothing?

    Let me check again. Yes, rereading your so-called reply and making suitable allowances for your poor writing, I can confirm that there is nothing there that has any relevance to anything I wrote. FYI.

    --
    Freedom = (Meaningful - Coerced) Choice != (Speech | Beer^2), and sad sock puppets' bad mods avail them naught.
  62. Re:Two key people responsible for this fail at App by skaag · · Score: 1

    It's not even just that - High Sierra is a mess. I have software crashing on me that never crashed before. For example Preview crashes when I try to open certain PDF files. Or it will crash if I try to rotate an image. I have a brand new Macbook Pro with the touch bar, and it honestly feels like a lemon! That's how bad it is. The display will glitch a lot (display driver bugs?), copying files from an external drive to the internal SSD will cause the machine to freeze and prevent you from doing any work (APFS bugs?), and this is just off the top of my head. It makes me feel like something is terrible wrong with Apple lately.

    I just bought two Macbook Air laptops the last two weeks. They still come with MagSafe adapters, and no USB-C. iPhones are still using Lightning adapters instead of USB-C. I mean c'mon Apple! What the hell is going on? How can a multi-billion dollar company screw up this bad?

    --

    All those moments will be lost in time, like tears in rain... time... to... die...

  63. Re:It's not the development process by shanen · · Score: 1

    Went back to check your original comment. Rather than receive the positive moderation you might deserve, I see that you have received undeserved and meaningless negative moderation. I am certainly not defending either the quality of the moderation or the way it is implemented. However, I think it could be improved. VAST room for improvement. You mentioned karma, which should be part of such improvements. There's a natural symmetry there that is lost in the current approach.

    Not sure about the longer second part of your reply. I could interpret it as agreement with examples, or that you are going in a different direction. I think that I definitely agree with you about the trade-offs, so perhaps I can address it with a pie-in-the-sky solution implemented via tax policy.

    Let's start with the premise that Apple is doing a good job of serving the customers and deserves the profits. My more controversial premise is that Apple's customers would still benefit from more freedom in the form of additional choices. Perhaps it would sound less controversial if I reworded it in terms of the lack of a perfect solution for every person? Apple's best offering might be perfect for some people, but never for everyone--even if that assumption would maximize their profits.

    So imagine that dominance in their market increased their tax rate. At some point it would make good sense to consider reproduction of the good ideas. Not a penalty for success, but rather an incentive to create more copies of the good ideas and let them evolve into the future. Divide Apple (or MS or Google) into competing companies with equal shares of the resources. Actually starting with the same profits, but divided among the daughter companies. If they want to maintain a standard platform, they could keep doing that, but the platform standards would have to be shared in public.

    You might want to buy your next machine from a division that decided to put a higher priority on security. Based on my experience to date, I would be looking for the company that remembered physical security with a Kensington lock anchor on their machines. We might even get a hotkey screen lock on both options because of the competition.

    --
    Freedom = (Meaningful - Coerced) Choice != (Speech | Beer^2), and sad sock puppets' bad mods avail them naught.
  64. But do the customers deserve freedom? No. by jbn-o · · Score: 1

    We greatly regret this error and we apologize to all Mac users, both for releasing with this vulnerability and for the concern it has caused. Our customers deserve better...

    But don't be fooled: one thing Apple remains firm on—Apple's customers don't deserve software freedom. Apple will continue to pursue its walled garden, ever restrictive practices built around DRM, proprietary software, app store censorship, and so on (see more about how Apple's malware adversely affects its users). The latest insecurity should not be taken as a sign that Apple's users deserve to fully own their computers. Apple will remain firmly in control over their users no matter how capable or willing they may be to want to run, inspect, modify the software, or share improvements to help make things better for their fellow Apple users. I'd like to be able to say to users: pay more for Apple because they sell you software freedom and that deserves extra money to help keep them in business treating you, the prospective computer owner, right. But I can't say that about Apple, so I recommend that you take your business elsewhere and do business with other distributors.

  65. Fragile software development process by Anonymous Coward · · Score: 0

    That's what happens when you use Waterfall software development process!

  66. Re:All Millennial-developed software has become sh by xystren · · Score: 1

    The Gedit text editor is an excellent example of how formerly-usable software has been destroyed. This is what Gedit used to look like. [wikimedia.org] At that point it had a sane, easy-to-use, functional UI. This is what Gedit has become. [wikimedia.org] It's like 50+ years of accumulated experience and knowledge has been discarded for no good reason, and the end result is a disaster.

    ...

    What we have is a generation of software devs who are far too focused on aesthetics and trendiness, with little to no care put toward usability, security, and reliability. They go out of their way to ignore everything we've learned about doing things right. They do things their own way, and it's a disaster.

    MY god! You just hit the nail on the head. I have been really hating this new interface style that has been spreading like a bad rash but couldn't really put my finger on what it it was specifically. As of recent (and by recent, I mean over the last 12 years), I found that overall software has become far less efficient to use. I'm thinking about the same time that Microsoft introduced "the ribbon" in their office suite software was the start of the real decline. Enter Windows 8, metro interface, no desktop, etc.

    I was just writing it off as me getting old, and "You young whippersnappers...." and "Get off my lawn", resistance to change... But now I'm going back to thinking it is just p1$$-p00r design/implementation of technology. Something that really irked me in the late '80s and throughout the '90s - the only difference then was good established worked processes trumped trendy and aesthetics, while now it is the exact opposite.

    Who would have thought that 'everyone gets a trophy' would have such a disaster on software development and user-interfaces.

  67. Re:All Millennial-developed software has become sh by david_thornley · · Score: 1

    You're blaming the wrong people. Millennials didn't give the go-ahead for Windows 8; that decision was made by considerably older people. Millennials implemented a lot of it, but they were working to somebody else's stupid ideas and inane specs. If they'd have tried to give it a decent UI, they'd have been fired.

    Systemd? Lennart Poettering was born in 1980, and that's generally considered to be the previous generation.

    They're focused on aesthetics and trendiness? Do you know one consistent thing about developers from a long time ago? They're pretty good on providing what they're asked to provide. If they're rewarded for great aesthetics but not for good security or human interfaces, what do you think you're going to get?

    There really aren't that many problems attributable to the developers. Most of the problems are management. The developers were told to do A, even when sound software development principles are to do B. Guess what they do? They're told to crank out the code and not care about security. Guess what they do? The manager wants to put NoSQL supervision on his or her resume. Guess what the developers use? Management wants to cheap out on developers and pay the least possible amount. Guess what happens to the code quality?

    It's amazing the amount of self-contradictory crap the Millennials get. Earlier generations raised them. Earlier generations manage them. If there's something you don't like about what they produce, Boomers and Xers, it's your generation's fault.

    --
    "When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
  68. Re:All Millennial-developed software has become sh by david_thornley · · Score: 1

    The issue here is that Millennials/Hipsters aren't doing cutting edge work. They're doing very basic work most of the time, but they're making mistakes that we knew about, and how to avoid them, decades ago!

    First, you're wrong. Windows 95 was very simple compared to modern versions of Windows. There's always cutting-edge work going on. Modern versions of Windows would scoff at the attacks available in the late 90s, and a 90s OS would be totally pwned today.

    Second, the educators, who are usually not millennials, are failing, or the managers, who are usually not millennials, aren't paying for expertise or requiring their developers to learn or giving them enough time to do a good job, or the previous generation, which are not millennials, is crap at passing along knowledge and wisdom.

    --
    "When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
  69. Re:All Millennial-developed software has become sh by david_thornley · · Score: 1

    The Wikipedia page on Gedit lists Paoli Maggi as the top person involved. Maggi got his Ph.D. in 2002, and is hence not a millennial. If you dislike modern interfaces, blame Generation X.

    There's a lot of crap out there by millennials. There's a lot of crap out there by Gen Xers. There's a lot of crap out there by Boomers.

    You know? I'm going to blame this crap on Generation X, since it's usually Gen X that makes the bad decisions.

    --
    "When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes