5 ms·

1. Ensure you always have FileVault enabled (you should regardless) and shutdown after work until the bug is fixed. 2. Add a complex root passphrase and clean

1. Ensure you always have FileVault enabled (you should regardless) and shutdown after work until the bug is fixed. 2. Add a complex root passphrase and clean this up after the fix is released. 3. Reflect on how irresponsibly this serious security bug was ‘reported’, he didn’t just potentially miss out on $200,000, he put an enormous number of people at risk of local intrusions when instead if it was properly reported there’s a good chance Apple would have released a bug fix for this quicker thus reducing the potential impact and spread of misinformation. https://en.m.wikipedia.org/wiki/Responsible_disclosure https://en.m.wikipedia.org/wiki/Responsible_disclosure https://support.apple.com/en-au/HT201220 https://support.apple.com/en-au/HT201220 (See ‘Security and privacy researchers’)

thomastjeffery 9y ago
It's not irresponsible to make a bug public. He did not put people at risk, he showed people they are already at risk, so they would know to set a root password, and thereby not be at risk. Security by obscurity does not work!
- mrmondo 9y ago
  It’s not an example of security by obscurity, it’s a straight out security flaw and bug. If it’s not publicly known and is a security risk it is far more effective to directly contact the developers / companies security team so they can immediately work on actually protecting people by developing a patch. If they don’t respond quickly (subjective, I’d call it within 12 hours) or fail to issue a fix in a timely manor (subjective, I’d say 24 hours) then yes - go public, start by logging a bug report and link to that bug report or if you can’t - the bug number / reference.
  - thomastjeffery 9y ago
    The fact is that the devs certainly do know about it by now, yet users do not have a fix yet. Users do, however, have a workaround, and knowledge that the security flaw exists in the first place. Waiting for a fix before disclosing a security flaw is security by obscurity, even if it is to be replaced soon. It is best for users to know that their system is vulnerable, and how to fix that without waiting for a system update.
    - mrmondo 9y ago
      > "The fact is that the devs certainly do know about it by now, yet users do not have a fix yet." Citation needed. > "It is best for users to know that their system is vulnerable, and how to fix that without waiting for a system update." Stepping outside the 'tech' social bubble, most general users likely won't create a root account and password from something they see on TV or their local news site or at least not before a patch would have been released. -- Further to previously provided examples: https://www.cloudflare.com/disclosure/ https://www.cloudflare.com/disclosure/ https://access.redhat.com/security/team/contact https://access.redhat.com/security/team/contact https://www.xenproject.org/security-policy.html https://www.xenproject.org/security-policy.html https://about.gitlab.com/disclosure/ https://about.gitlab.com/disclosure/ https://help.github.com/articles/responsible-disclosure-of-security-vulnerabilities/ https://help.github.com/articles/responsible-disclosure-of-s... https://www.kernel.org/doc/html/v4.10/admin-guide/security-bugs.html#contact https://www.kernel.org/doc/html/v4.10/admin-guide/security-b... https://www.drupal.org/drupal-security-team/general-information https://www.drupal.org/drupal-security-team/general-informat... https://www.cisco.com/c/en/us/about/security-center/security-vulnerability-policy.html https://www.cisco.com/c/en/us/about/security-center/security... https://www.juniper.net/us/en/security/report-vulnerability/ https://www.juniper.net/us/en/security/report-vulnerability/
      - thomastjeffery 9y ago
        > Citation needed. Has there been an update released yet? I wouldn't know, I don't use OS X. Is this the best way to report a security flaw? Of course not! Is it a bad way? No! The only bad way to report a security flaw is to not report it at all.
        mrmondo 9y ago
        >> Citation needed. > Has there been an update released yet? I wouldn't know, I don't use OS X. I think you might have misunderstood what I meant when when asking for citation, it's based on the statement you made in relation to citing sources for what something that could be opinion stated as fact. https://libguides.mit.edu/citing https://libguides.mit.edu/citing > Is it a bad way? No! OK this is where I stop feeding the troll.
  - trumpownsyou420 9y ago
    kys loser.
- sdmadf2834 9y ago
  This is the most idiotic thing I've heard in a long time. Yes, they were already at risk, but with the way he disclosed the information, the risk increased exponentially. This guy's actions were either stupid or malicious.
  - thomastjeffery 9y ago
    Obviously this isn't the best way to disclose a security flaw. That does not make it malicious. Sure, there are more malicious people aware of this security flaw, but there are also more users aware of this security flaw, and the simple steps they can take to mitigate it.
    - sdmadf2834 9y ago
      Yep, just saying that if he's not malicious (intending to maximize harm to users), then he's an idiot for disclosing it this way.
      - thomastjeffery 9y ago
        Or just didn't know what the best practice was. Since this is a flaw any user can run into, I wouldn't get so mad about someone who doesn't know best practice running into it. I am much more concerned that such an obvious tractable flaw exists in the first place.

thomastjeffery 9y ago

It's not irresponsible to make a bug public. He did not put people at risk, he showed people they are already at risk, so they would know to set a root password, and thereby not be at risk. Security by obscurity does not work!

mrmondo 9y ago
It’s not an example of security by obscurity, it’s a straight out security flaw and bug. If it’s not publicly known and is a security risk it is far more effective to directly contact the developers / companies security team so they can immediately work on actually protecting people by developing a patch. If they don’t respond quickly (subjective, I’d call it within 12 hours) or fail to issue a fix in a timely manor (subjective, I’d say 24 hours) then yes - go public, start by logging a bug report and link to that bug report or if you can’t - the bug number / reference.
- thomastjeffery 9y ago
  The fact is that the devs certainly do know about it by now, yet users do not have a fix yet. Users do, however, have a workaround, and knowledge that the security flaw exists in the first place. Waiting for a fix before disclosing a security flaw is security by obscurity, even if it is to be replaced soon. It is best for users to know that their system is vulnerable, and how to fix that without waiting for a system update.
  - mrmondo 9y ago
    > "The fact is that the devs certainly do know about it by now, yet users do not have a fix yet." Citation needed. > "It is best for users to know that their system is vulnerable, and how to fix that without waiting for a system update." Stepping outside the 'tech' social bubble, most general users likely won't create a root account and password from something they see on TV or their local news site or at least not before a patch would have been released. -- Further to previously provided examples: https://www.cloudflare.com/disclosure/ https://www.cloudflare.com/disclosure/ https://access.redhat.com/security/team/contact https://access.redhat.com/security/team/contact https://www.xenproject.org/security-policy.html https://www.xenproject.org/security-policy.html https://about.gitlab.com/disclosure/ https://about.gitlab.com/disclosure/ https://help.github.com/articles/responsible-disclosure-of-security-vulnerabilities/ https://help.github.com/articles/responsible-disclosure-of-s... https://www.kernel.org/doc/html/v4.10/admin-guide/security-bugs.html#contact https://www.kernel.org/doc/html/v4.10/admin-guide/security-b... https://www.drupal.org/drupal-security-team/general-information https://www.drupal.org/drupal-security-team/general-informat... https://www.cisco.com/c/en/us/about/security-center/security-vulnerability-policy.html https://www.cisco.com/c/en/us/about/security-center/security... https://www.juniper.net/us/en/security/report-vulnerability/ https://www.juniper.net/us/en/security/report-vulnerability/
    - thomastjeffery 9y ago
      > Citation needed. Has there been an update released yet? I wouldn't know, I don't use OS X. Is this the best way to report a security flaw? Of course not! Is it a bad way? No! The only bad way to report a security flaw is to not report it at all.
      - mrmondo 9y ago
        >> Citation needed. > Has there been an update released yet? I wouldn't know, I don't use OS X. I think you might have misunderstood what I meant when when asking for citation, it's based on the statement you made in relation to citing sources for what something that could be opinion stated as fact. https://libguides.mit.edu/citing https://libguides.mit.edu/citing > Is it a bad way? No! OK this is where I stop feeding the troll.
- trumpownsyou420 9y ago
  kys loser.
sdmadf2834 9y ago
This is the most idiotic thing I've heard in a long time. Yes, they were already at risk, but with the way he disclosed the information, the risk increased exponentially. This guy's actions were either stupid or malicious.
- thomastjeffery 9y ago
  Obviously this isn't the best way to disclose a security flaw. That does not make it malicious. Sure, there are more malicious people aware of this security flaw, but there are also more users aware of this security flaw, and the simple steps they can take to mitigate it.
  - sdmadf2834 9y ago
    Yep, just saying that if he's not malicious (intending to maximize harm to users), then he's an idiot for disclosing it this way.
    - thomastjeffery 9y ago
      Or just didn't know what the best practice was. Since this is a flaw any user can run into, I wouldn't get so mad about someone who doesn't know best practice running into it. I am much more concerned that such an obvious tractable flaw exists in the first place.