4 ms·

This is one of the sillier things I've read today. The only way something like this slips through is a culture of complacency, or incompetence. And the only wa

by na85 9y ago

This is one of the sillier things I've read today. The only way something like this slips through is a culture of complacency, or incompetence. And the only way Apple gets motivated to fix either of those two things is massive Pr damage.

azernik 9y ago
How long have you been working in software? Bugs like this get past competent developers in reasonable organizations all the time. Human fallibility, yo.
- ridgeguy 9y ago
  Yeah, but... It seems to me (somebody who has no chops in this domain) that this is such a basic bug. Like something a child would have found just messing around. And it came from a corporation that has around $200B of cash and cash equivalents. Apple has the resources to test and find bugs like this. That Apple didn't find it is down to leadership and priorities more than some inherent limits of producing reliable code. One spends on what one thinks important. But who knows, I've got no domain expertise here. Maybe a fifth of a trillion dollars C&CE really isn't enough to fund production of more robust code. But really?
  - azernik 9y ago
    This is kind of a weird corner case; OSX tries really hard to hide the UNIXiness of its system, including the special nature of the username "root". So I can easily someone not thinking to test it out super thoroughly A lot of security vulnerabilities are of this type: "let's do crazy shit X that the system was not built for and see what breaks." I'm sure this will be in their test suite now though.
    - ridgeguy 9y ago
      Thanks, appreciate your reply. Maybe Apple should spin up a group of 7 - 14 year-olds to add to their test suite input. They might be better at coming up with crazy shit X that might break things.
- flukus 9y ago
  After the developers there is a line of QA as well, but part of the problem is having the organisational structures for developers to discover issues like this. Regular audits, security as a priority and non-recrimination policies would be a good start. In many companies if you bring up problems like this then your "not a team player", in others you could point out issues like this all day long but they will never be acted upon because the budget isn't there for various reasons.

by na85 9y ago

azernik 9y ago

How long have you been working in software? Bugs like this get past competent developers in reasonable organizations all the time. Human fallibility, yo.

ridgeguy 9y ago
Yeah, but... It seems to me (somebody who has no chops in this domain) that this is such a basic bug. Like something a child would have found just messing around. And it came from a corporation that has around $200B of cash and cash equivalents. Apple has the resources to test and find bugs like this. That Apple didn't find it is down to leadership and priorities more than some inherent limits of producing reliable code. One spends on what one thinks important. But who knows, I've got no domain expertise here. Maybe a fifth of a trillion dollars C&CE really isn't enough to fund production of more robust code. But really?
- azernik 9y ago
  This is kind of a weird corner case; OSX tries really hard to hide the UNIXiness of its system, including the special nature of the username "root". So I can easily someone not thinking to test it out super thoroughly A lot of security vulnerabilities are of this type: "let's do crazy shit X that the system was not built for and see what breaks." I'm sure this will be in their test suite now though.
  - ridgeguy 9y ago
    Thanks, appreciate your reply. Maybe Apple should spin up a group of 7 - 14 year-olds to add to their test suite input. They might be better at coming up with crazy shit X that might break things.
flukus 9y ago
After the developers there is a line of QA as well, but part of the problem is having the organisational structures for developers to discover issues like this. Regular audits, security as a priority and non-recrimination policies would be a good start. In many companies if you bring up problems like this then your "not a team player", in others you could point out issues like this all day long but they will never be acted upon because the budget isn't there for various reasons.