Slashdot Mirror
Apple Snafu Means Updating To macOS 10.13.1 Could Reactivate Root Access Bug (betanews.com)
Mark Wilson writes: A few days ago, a serious security flaw with macOS High Sierra came to light. It was discovered that it was possible to log into the 'root' account without entering a password, and -- although the company seemed to have been alerted to the issue a couple of weeks back -- praise was heaped on Apple for pushing a fix out of the door quickly. But calm those celebrations. It now transpires that the bug fix has a bug of its own. Upgrade to macOS 10.13.1 and you could well find that the patch is undone. Slow hand clap.
Anyone tried this recipe?
"My slowclap processor made it into this thing." -GLaDOS
This is definitely huge blunder, but a SNAFU? Because it stands for "Situation Normal - All Fucked Up" and implies something happens all the time, which is not the case here. Sure, the FaceID debacle happened relatively recently, but these kinds of security fuck-ups are a regular thing even for Apple.
Oh and before someone starts compiling a list of security screw-ups going back to the 80s, one or two legitimate screw-ups every few years are hardly "situation normal" type scenario.
"Why should I want to make anything up? Life's bad enough as it is without wanting to invent any more of it."
...They released the patch but forgot to apply to last available version? I can see no problem there.
must have done the fixed in between emoji design meetings.
This for Apple is what the burning batteries was for Samsung.
You're pretty much guaranteed to make a major snafu every once in a while if you're a big tech company. The scary thing is when a snafu occurs when controlling a power plant, or a weapons system, or something that could be used as a weapon.
As long as it's just phones and laptops we're OK.
"That's the way to do it" - Punch
Of course if you upgrade to 10.13.1 it will remove the patch, the patch doesn't exist in that version and it is a full update, not a delta. Shortly after the upgrade it will download and apply the patch to 10.13.1.
And then within 24 hours Security Update 2017-001 is auto applied if not manually done so earlier.
Not sure who this "Root" guy is, but I always login with my iCloud username. Everyone knows iCloud is safe.
I can safely assume that Apple's programmers are either incompetent, lazy, or a combination of both. No excuse for this crap.
I would like Apple to stop nagging me to upgrade to High Sierra via notifications. I am deathly afraid of clicking by accident. It is seldom that a Mac operating system upgrade soon after its launch goes well for the hapless end user. I'm sure I will do it some time, after I feel really good about my backup system and have no critical business scheduled. But when I invested in this MacBook Pro I felt it would last me 5-10 years as-is. Something closer to ZFS is great but not worth the aggravation that the Apple user is GUARANTEED to get if they upgrade soon after it comes out. Let some other early adopters become roadkill and just sit back and let the fireworks die down for a year. Some of us can't afford to be experimented on.
standpoint, I don't a BSD box that very own 5hitter, fucking market need to join the Guys are usually writing is on the of OpenBSD. How 4, which by all
I had a customer with an older Macbook Pro, for whom updating to 10.13 overwrote her boot partition with the 10.13 recovery partition - then froze dead in its tracks leaving the laptop unbootable. All her files that weren't overwritten had to be recovered by signature through Photorec.
I put in a brand new hard drive (the drive was starting to fail), and installed Sierra. Updating to 10.13 (High Sierra) did the same thing again.
Only resetting the PRAM solved it. I can't really even make sense of why that was required or why that worked.
So, what you're saying is that when you rush out a patch, the development and QA processes suffer? The hell you say. No one could have predicted *that*.
Sometimes you have to say "Make it work for the most common case *now* and we'll pick up anything we missed later.
Chelloveck
I give up on debugging. From now on, SIGSEGV is a feature.
99 little bugs in the code
99 little bugs in the code
Take one down, pass it around
117 little bugs in the code
Wanna buy a shirt?
https://www.redbubble.com/people/stealthfinger/shop?asc=u
In fact MsMash is sucking dick for dope..
bEaUhd is this your only sexual outlet???
plug your dick in the wall, get more out of it and it';s safer fro,m an STD perspective
While this bug has not been patched in the 10.13.1 Update, it has been patched once-and-for-all in the upcoming 10.13.2 Update, now in Beta Testing.
Those who Install 10.13.1 simply need to re-run the current version of the "root access" Security Update, and all will be well.
Just some overlapping package-release timing stuff, exacerbated by Apple's desire to patch the original vulnerability as quickly as possible.
Thanks, Apple, for labelling my old Mac Mini as obsolete, so I do not have to deal with this crap.
This is about the prior release of macOS. Slashdot now sees stories weeks after mainstream media.
Weak.
You already had to be logged into the machine. The only times this is a security problem is when you lend your machine to someone else, allow someone a remote access or the computer belongs to your company and they do not trust you with admin rights.
Of cause it is bad, but it is not a fatal problem and it is not the first time an OS has has a local root exploit due to a "feature".
Turn off check for updates then.
In 10.12.6 , it's system preferences, app store icon. Un-check "Automatically check for updates"
You can still check manually - just open the app store, and click on the updates icon at the top. It's much less annoying than their "choose between going to look at this or doing it" moronic notification.
--fyngyrz
anon due to mod points and clueless slashdot policies
FEATURE!