Apple To Review Software Practices After Patching Serious Mac Bug (reuters.com)
Apple said on Wednesday it would review its software development process after scrambling to patch a serious bug it learned of on Tuesday in its macOS operating system for desktop and laptop computers. From a report: "We greatly regret this error and we apologize to all Mac users, both for releasing with this vulnerability and for the concern it has caused," Apple said in a statement. "Our customers deserve better. We are auditing our development processes to help prevent this from happening again."
I think this is a much broader problem. This isn't just about Apple. This is about almost all software today that has been developed by Millennial (some people use the term "Hipster") developers.
Millennials have been in the industry for about 10 years now, and these past 10 years have been some of the worst in terms of software quality.
Just look at the destruction they've left behind them. Windows 8, 8.1 and 10. GNOME 3. Firefox 4 and later. Systemd. Wayland. Slashdot Beta. NoSQL. The list goes on and on.
The Gedit text editor is an excellent example of how formerly-usable software has been destroyed. This is what Gedit used to look like. At that point it had a sane, easy-to-use, functional UI. This is what Gedit has become. It's like 50+ years of accumulated experience and knowledge has been discarded for no good reason, and the end result is a disaster.
What we have is a generation of software devs who are far too focused on aesthetics and trendiness, with little to no care put toward usability, security, and reliability. They go out of their way to ignore everything we've learned about doing things right. They do things their own way, and it's a disaster.
This isn't even a get-off-my-lawn situation. Many of us who are appalled by these developments are late Gen X'ers. We aren't even that much older than the Millennials who have caused so many problems! In fact, many of us spend our days trying to bring some sanity to otherwise disastrous workplaces. We remember how software used to be developed, yet we're so outnumbered by Millennials that we just can't keep up.
It was excusable when security flaws and usability problems were accidentally introduced by earlier generations because they were doing pioneering work, and the concepts behind these security flaws and usability problems hadn't even been discovered yet. But the industry should be far beyond that now. The knowledge is there, it's just that Millennials choose to totally ignore it.
The blank root password attack is only a local privesc in the default config too...
It works over screen sharing, but that's not enabled by default.
It doesn't seem to work on the local login screen, at least on the machine i've tried (plus by default the local login screen shows you a list of users and doesn't let you type a username).
To exploit on a default system you need to have local access to an unprivileged user account, and from there you can get root.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!