8 ms·

I still can't believe more people complain about this being publicly disclosed than this being possible in the first place. No one is obligated to know the proc

I still can't believe more people complain about this being publicly disclosed than this being possible in the first place. No one is obligated to know the procedures on InfoSec 0-days and follow those steps.

deleted 9y ago
[deleted]
zeveb 9y ago
> I still can't believe more people complain about this being publicly disclosed than this being possible in the first place. I think the problem is due to the fact that they are fans. In this case, it's Apple, but there's no reason it couldn't be Linux or Go or whatever. Regardless, any bad news about their hero is irresponsible to disseminate. We see this same phenomenon in politics, in sports and elsewhere — I daresay it's regrettable human nature.
- eric_h 9y ago
  I've not commented either way on the subject in this thread, but personally I would much rather have read this as a writeup 2 or 3 months from now after the discoverer had responsibly disclosed the vulnerability and Apple had a chance to patch it. On the other hand, I'm glad that I have this information so I know not to install High Sierra on my work iMac (sitting on a desk in a WeWork behind a door whose lock would be very easy to force open) until this is fixed. [Edit: I now see that there's a simple workaround (change the root password and keep root enabled), so I'm all for "irresponsible disclosure" in this case]
  - eric_h 9y ago
    As an addendum apple released a fix for this less than 48 hours after it was reported (I think I've got the timeframe right), so there's something to be said for irresponsibly disclosing to light a fire under the ass of whomever is responsible for fixing a vulnerability.
- saagarjha 9y ago
  > I think the problem is due to the fact that they are fans. I think this is an unfair characterization. Sure, it's hard to hear that their "hero is irresponsible", but the real reason is that this kind of behavior puts everyone at risk while Apple tries to fix it.
  - 5ilv3r 9y ago
    That may be true for cisco and juniper where upgrades must be carefully rolled out across globally distributed critical infrastructure, but this is APPLE. They need no such help. They can push to everyone, now, and it will be fine. Forcing their hand is safer than trying to hide a flaw a 3 year old could find on accident.
    - saagarjha 9y ago
      > They can push to everyone, now, and it will be fine. I'm pretty sure any fix has to go through Build and Integration before being rolled out. Then you need to have people actually install the update…
      - 5ilv3r 9y ago
        Oh my goodness I totally forgot they had to build it first! /s
  - recursive 9y ago
    They were already at risk. Now they can mitigate.
    - saagarjha 9y ago
      *Significantly more risk
zokier 9y ago
Most likely another from of bikeshedding; people don't have real input on the main matter, so they comment on circumstantial matters just so they can throw in their 2c
- hateduser2 9y ago
  Or they have real circumstantial comments to make.. it doesn’t have to be that they just want to talk
legohead 9y ago
I wouldn't bash the guy. Someone already let him know about his technical faux pas in a professional manner on his twitter. My guess is he found this vulnerability on accident, freaked out, and tweeted about it. Probably has limited infosec experience.
- 5ilv3r 9y ago
  Or he cares more about doing the right thing than about following best practices designed to protect the guilty under the guise of helping users.
  - hateduser2 9y ago
    Idk why u say “designed to protect the guilty under the guise of protecting the innocent”.. it clearly does both. It does protect the innocent. That is a fact! It also does protect the guilty! Both are true. It makes it harder to have a strong view when you must acknowledge both facts I suppose
- mcbridematt 9y ago
  Definitely. How many people outside the infosec industry know that responsible disclosure channels exist?
- mbesto 9y ago
  I don't know, he's tweeted more about the topic: https://twitter.com/lemiorhan/status/935619881143324673 https://twitter.com/lemiorhan/status/935619881143324673 So he's either not reading his replies or he's being deliberately irresponsible. My guess, based on his profile and online behavior, is that he's trying to ride the coattails of getting some exposure online.
mbesto 9y ago
Except when people politely explain to the original poster not to do what he did. His tweet and a follow-up tweet still exist on the topic. He could easily delete them. If you read through the comments, you'll see people are arguing that Apple is to blame here. It doesn't require much discourse to recognize that's the case and hence why you don't see more people complaining about this being possible in the first place.

deleted 9y ago

[deleted]

zeveb 9y ago

> I still can't believe more people complain about this being publicly disclosed than this being possible in the first place. I think the problem is due to the fact that they are fans. In this case, it's Apple, but there's no reason it couldn't be Linux or Go or whatever. Regardless, any bad news about their hero is irresponsible to disseminate. We see this same phenomenon in politics, in sports and elsewhere — I daresay it's regrettable human nature.

eric_h 9y ago
I've not commented either way on the subject in this thread, but personally I would much rather have read this as a writeup 2 or 3 months from now after the discoverer had responsibly disclosed the vulnerability and Apple had a chance to patch it. On the other hand, I'm glad that I have this information so I know not to install High Sierra on my work iMac (sitting on a desk in a WeWork behind a door whose lock would be very easy to force open) until this is fixed. [Edit: I now see that there's a simple workaround (change the root password and keep root enabled), so I'm all for "irresponsible disclosure" in this case]
- eric_h 9y ago
  As an addendum apple released a fix for this less than 48 hours after it was reported (I think I've got the timeframe right), so there's something to be said for irresponsibly disclosing to light a fire under the ass of whomever is responsible for fixing a vulnerability.
saagarjha 9y ago
> I think the problem is due to the fact that they are fans. I think this is an unfair characterization. Sure, it's hard to hear that their "hero is irresponsible", but the real reason is that this kind of behavior puts everyone at risk while Apple tries to fix it.
- 5ilv3r 9y ago
  That may be true for cisco and juniper where upgrades must be carefully rolled out across globally distributed critical infrastructure, but this is APPLE. They need no such help. They can push to everyone, now, and it will be fine. Forcing their hand is safer than trying to hide a flaw a 3 year old could find on accident.
  - saagarjha 9y ago
    > They can push to everyone, now, and it will be fine. I'm pretty sure any fix has to go through Build and Integration before being rolled out. Then you need to have people actually install the update…
    - 5ilv3r 9y ago
      Oh my goodness I totally forgot they had to build it first! /s
- recursive 9y ago
  They were already at risk. Now they can mitigate.
  - saagarjha 9y ago
    *Significantly more risk

zokier 9y ago

Most likely another from of bikeshedding; people don't have real input on the main matter, so they comment on circumstantial matters just so they can throw in their 2c

hateduser2 9y ago
Or they have real circumstantial comments to make.. it doesn’t have to be that they just want to talk

legohead 9y ago

I wouldn't bash the guy. Someone already let him know about his technical faux pas in a professional manner on his twitter. My guess is he found this vulnerability on accident, freaked out, and tweeted about it. Probably has limited infosec experience.

5ilv3r 9y ago
Or he cares more about doing the right thing than about following best practices designed to protect the guilty under the guise of helping users.
- hateduser2 9y ago
  Idk why u say “designed to protect the guilty under the guise of protecting the innocent”.. it clearly does both. It does protect the innocent. That is a fact! It also does protect the guilty! Both are true. It makes it harder to have a strong view when you must acknowledge both facts I suppose
mcbridematt 9y ago
Definitely. How many people outside the infosec industry know that responsible disclosure channels exist?
mbesto 9y ago
I don't know, he's tweeted more about the topic: https://twitter.com/lemiorhan/status/935619881143324673 https://twitter.com/lemiorhan/status/935619881143324673 So he's either not reading his replies or he's being deliberately irresponsible. My guess, based on his profile and online behavior, is that he's trying to ride the coattails of getting some exposure online.

mbesto 9y ago

Except when people politely explain to the original poster not to do what he did. His tweet and a follow-up tweet still exist on the topic. He could easily delete them. If you read through the comments, you'll see people are arguing that Apple is to blame here. It doesn't require much discourse to recognize that's the case and hence why you don't see more people complaining about this being possible in the first place.