5 ms·

People are already fixing their machines because he tweeted. this is too much of a huge blunder to wait for the official channels.

jrochkind1 9y ago
they are? Where's the fix?
- Veen 9y ago
  Create a root password.
  - saagarjha 9y ago
    This isn't a fix, it's a hack. A computer with a root password is inherently more insecure than one without a root account at all.
    - will4274 9y ago
      Actually, no. For all computers, running macOS High Sierra, a computer with a root password is a whole heck of a lot more secure than one without a root account at all :) But seriously, a fix is whatever fixes the problem.
      - saagarjha 9y ago
        It is now. There's going to be a whole lot of people who are going to set a root password because they read an article online recommending it, then install the update that fixes this issue. Now they're stuck with a root password when they could have not had one at all.
        reitanqild 9y ago
        Shouldn't matter as long as the password is strong?
        saagarjha 9y ago
        Making it difficult to access something is always worse than not having anything to access. Plus, the average person will set their root password to something like 123456 or qwerty, which is clearly insecure.
        reitanqild 9y ago
        > Making it difficult to access something is always worse than not having anything to access. Not a choice now. If people have physical access to Macs at the moment then it seems to me there are two options right now: either 1) you have changed the root password, hopefully to a strong password or 2) they'll be able to login as root. Right now you can expect the participants in this thread to be a little smarter than the average computer user.
        forapurpose 9y ago
        > Now they're stuck with a root password when they could have not had one at all. And many users will create insecure passwords, leaving them with a serious vulnerability after the patch. A password of "root" or "qwerty" is only marginally more secure than a blank one.
        wuliwong 9y ago
        Could the patch also handle this case? Can you create a root account in OS X? If it was previously possible to create a root account then I guess there's no way to tell the difference between those who created the password as a response to the vulnerability and those that knowingly created a root account.
        saagarjha 9y ago
        > Can you create a root account in OS X? Yes, you can. macOS ships with the account disabled by default, but you can re-enable it if you wish. Most of the time there is no reason to do so. > If it was previously possible to create a root account then I guess there's no way to tell the difference between those who created the password as a response to the vulnerability and those that knowingly created a root account. Yes, but this difference doesn't matter. By creating a root account you have made your computer less secure anyways, assuming that we didn't have the current issue at hand.
        roblabla 9y ago
        And as a result, they've been safer sooner than other people.
    - 5ilv3r 9y ago
      If setting a root password is a hack, I'm Donald Duck.
      - saagarjha 9y ago
        I really can't respond to you unless you explain your reasoning…
      - snowpalmer 9y ago
        I assume he means that you should always set a password for "root". Though most users don't even knows it exists.. hence it should have been taken care of by apple.
        5ilv3r 9y ago
        No, not always. I just mean that sudo is a (very very popular) hack.
      - 5ilv3r 9y ago
        Uhg, ok I forgot some people don't know the code. The old adage is "On your first day as the new sysadmin, change all the root passwords". The idea is that a SECURE root is good, possibly better than no root (which is sort of a hack in itself). There are best practices for root passwords. Things like length, composition (no dict words), disabled for remote access, and care in who is allowed to have it. Simply pretending root does not exist is a rather new idea and is not best practice. It's only for convenience.
        saagarjha 9y ago
        > Simply pretending root does not exist is a rather new idea and is not best practice. It's only for convenience. Says who? Sure, it's convenient not to have to worry about choosing a secure password for your root account, but why is it "sort of a hack in itself"?
        Forbo 9y ago
        > composition (no dict words), This is an outmoded guideline for password security. String enough dictionary words together and you achieve a high level of entropy. See for example https://en.wikipedia.org/wiki/Diceware https://en.wikipedia.org/wiki/Diceware
    - wuliwong 9y ago
      Seems like you are splitting hairs here. Clearly, the point the commenter was making is that people that have now set the root password as a result of the tweet are more secure than they were before the tweet.
      - saagarjha 9y ago
        In a week they will be less secure, because they will forget to remove their root account and Apple will have push out a fix.
        reitanqild 9y ago
        That's a whole week where they can get owned by any kid with physical access to the machine. In some settings (schools, libraries) this might be a huge issue.
        saagarjha 9y ago
        Which comes back to another point I made in this thread: there should have been responsible disclosure of the issue.
    - jgowdy 9y ago
      Someone tell the Linux and UNIX users of the world that having a root account with a password is a "hack."
      - saagarjha 9y ago
        Having a root account is a password isn't a hack, it's making one as a workaround for this bug that is.
      - Dylan16807 9y ago
        If they're setting passwords just to prevent a bug, then yes it's a hack. The same actions can be a hack or not, depending on what they're accomplishing.
azernik 9y ago
A very small percentage of particularly tech-savvy users. The benefits to this subset do not justify the harm to everyone else.

jrochkind1 9y ago

they are? Where's the fix?

Veen 9y ago
Create a root password.
- saagarjha 9y ago
  This isn't a fix, it's a hack. A computer with a root password is inherently more insecure than one without a root account at all.
  - will4274 9y ago
    Actually, no. For all computers, running macOS High Sierra, a computer with a root password is a whole heck of a lot more secure than one without a root account at all :) But seriously, a fix is whatever fixes the problem.
    - saagarjha 9y ago
      It is now. There's going to be a whole lot of people who are going to set a root password because they read an article online recommending it, then install the update that fixes this issue. Now they're stuck with a root password when they could have not had one at all.
      - reitanqild 9y ago
        Shouldn't matter as long as the password is strong?
        saagarjha 9y ago
        Making it difficult to access something is always worse than not having anything to access. Plus, the average person will set their root password to something like 123456 or qwerty, which is clearly insecure.
        reitanqild 9y ago
        > Making it difficult to access something is always worse than not having anything to access. Not a choice now. If people have physical access to Macs at the moment then it seems to me there are two options right now: either 1) you have changed the root password, hopefully to a strong password or 2) they'll be able to login as root. Right now you can expect the participants in this thread to be a little smarter than the average computer user.
      - forapurpose 9y ago
        > Now they're stuck with a root password when they could have not had one at all. And many users will create insecure passwords, leaving them with a serious vulnerability after the patch. A password of "root" or "qwerty" is only marginally more secure than a blank one.
      - wuliwong 9y ago
        Could the patch also handle this case? Can you create a root account in OS X? If it was previously possible to create a root account then I guess there's no way to tell the difference between those who created the password as a response to the vulnerability and those that knowingly created a root account.
        saagarjha 9y ago
        > Can you create a root account in OS X? Yes, you can. macOS ships with the account disabled by default, but you can re-enable it if you wish. Most of the time there is no reason to do so. > If it was previously possible to create a root account then I guess there's no way to tell the difference between those who created the password as a response to the vulnerability and those that knowingly created a root account. Yes, but this difference doesn't matter. By creating a root account you have made your computer less secure anyways, assuming that we didn't have the current issue at hand.
      - roblabla 9y ago
        And as a result, they've been safer sooner than other people.
  - 5ilv3r 9y ago
    If setting a root password is a hack, I'm Donald Duck.
    - saagarjha 9y ago
      I really can't respond to you unless you explain your reasoning…
    - snowpalmer 9y ago
      I assume he means that you should always set a password for "root". Though most users don't even knows it exists.. hence it should have been taken care of by apple.
      - 5ilv3r 9y ago
        No, not always. I just mean that sudo is a (very very popular) hack.
    - 5ilv3r 9y ago
      Uhg, ok I forgot some people don't know the code. The old adage is "On your first day as the new sysadmin, change all the root passwords". The idea is that a SECURE root is good, possibly better than no root (which is sort of a hack in itself). There are best practices for root passwords. Things like length, composition (no dict words), disabled for remote access, and care in who is allowed to have it. Simply pretending root does not exist is a rather new idea and is not best practice. It's only for convenience.
      - saagarjha 9y ago
        > Simply pretending root does not exist is a rather new idea and is not best practice. It's only for convenience. Says who? Sure, it's convenient not to have to worry about choosing a secure password for your root account, but why is it "sort of a hack in itself"?
      - Forbo 9y ago
        > composition (no dict words), This is an outmoded guideline for password security. String enough dictionary words together and you achieve a high level of entropy. See for example https://en.wikipedia.org/wiki/Diceware https://en.wikipedia.org/wiki/Diceware
  - wuliwong 9y ago
    Seems like you are splitting hairs here. Clearly, the point the commenter was making is that people that have now set the root password as a result of the tweet are more secure than they were before the tweet.
    - saagarjha 9y ago
      In a week they will be less secure, because they will forget to remove their root account and Apple will have push out a fix.
      - reitanqild 9y ago
        That's a whole week where they can get owned by any kid with physical access to the machine. In some settings (schools, libraries) this might be a huge issue.
        saagarjha 9y ago
        Which comes back to another point I made in this thread: there should have been responsible disclosure of the issue.
  - jgowdy 9y ago
    Someone tell the Linux and UNIX users of the world that having a root account with a password is a "hack."
    - saagarjha 9y ago
      Having a root account is a password isn't a hack, it's making one as a workaround for this bug that is.
    - Dylan16807 9y ago
      If they're setting passwords just to prevent a bug, then yes it's a hack. The same actions can be a hack or not, depending on what they're accomplishing.

azernik 9y ago

A very small percentage of particularly tech-savvy users. The benefits to this subset do not justify the harm to everyone else.