7 ms·

See Apple's comment on this, given to BuzzFeed I assume: https://twitter.com/JohnPaczkowski/status/935909264362586112 https://twitter.com/JohnPaczkowski/status/

See Apple's comment on this, given to BuzzFeed I assume: https://twitter.com/JohnPaczkowski/status/935909264362586112 https://twitter.com/JohnPaczkowski/status/935909264362586112 / https://www.buzzfeed.com/josephbernstein/apple-released-a-patch-for-that-massive-security-flaw-in https://www.buzzfeed.com/josephbernstein/apple-released-a-pa... "Security is a top priority for every Apple product, and regrettably we stumbled with this release of macOS. When our security engineers became aware of the issue Tuesday afternoon, we immediately began working on an update that closes the security hole. This morning, as of 8:00 a.m., the update is available for download, and starting later today it will be automatically installed on all systems running the latest version (10.13.1) of macOS High Sierra. We greatly regret this error and we apologize to all Mac users, both for releasing with this vulnerability and for the concern it has caused. Our customers deserve better. We are auditing our development processes to help prevent this from happening again." (posted to https://news.ycombinator.com/item?id=15808164 https://news.ycombinator.com/item?id=15808164 if separate discussion is preferred)

nailer 9y ago
Original source of Buzzfeed article, if you'd like to avoid giving them traffic: https://twitter.com/lemiorhan/status/935578694541770752 https://twitter.com/lemiorhan/status/935578694541770752 Demo: https://twitter.com/0xAmit/status/935607313368481793 https://twitter.com/0xAmit/status/935607313368481793
blinkingled 9y ago
> We are auditing our development processes to help prevent this from happening again. That's great to hear even if it took multiple stumbles for them to finally admit - but surely they should be also audit their QA/testing processes? Or does development in AppleSpeak mean everything?
- Klathmon 9y ago
  It sound to me like the "development process" points to the whole soup-to-nuts system. From "brainstorming" and new feature development, to development, to testing, to QA, to deployment.
  - blinkingled 9y ago
    If so, that's going to be a big undertaking :)
    - zokier 9y ago
      Or a big lip service.
- vinceguidry 9y ago
  I don't know how you could expect QA to be able to have a rigorous process to catch security problems of this type. It's one thing to audit the strength of crypto protocols, quite another to rigorously test every conceivable attack surface for privilege escalation. That space is vast.
  - blinkingled 9y ago
    Actually entering blank passwords and automated password entry should be Test Cases #0 and #1 for any thing that has a login. OS and other critical infrastructure vendors should go beyond that and explore the vast space to make sure nothing like this ever happens.
    - glhaynes 9y ago
      They may have even had a test case that entered "root" and no password and hit OK once, but that wouldn't have caught it. What if you'd had to hit "OK" forty-one times to trigger the bug? It's deeply unsatisfying to just say "the problem space is so vast that it's hard to even know what to try beyond the basics that every QA person knows" but I don't personally have a better answer than that. Maybe those that study the space do, though?
      - jacobush 9y ago
        Fuzzing inputs
      - anton_gogolev 9y ago
        Where are all the unit/integration tests for the APIs that this damned button is calling? Hindsight being 20/20, but I cannot imagine not asserting that a newly created/re-enabled root user has a non-empty password.
        ghostly_s 9y ago
        I don't think empty password on root is the issue here; enabling root when the user did not intend to and did not have permission to is. Isn't empty password for root a default state for systems where direct root login is not enabled? And isn't enabling root with no password the intended behavior when booting into Single User Mode?
- teamhappy 9y ago
  > Or does development in AppleSpeak mean everything? It's a press release. It doesn't mean anything.
- DougBTX 9y ago
  Top google search result for "software development processes" says: What are the steps in software development? 1. Requirement gathering and analysis. 2. Design. 3. Implementation or coding. 4. Testing. 5. Deployment. 6. Maintenance. So, yes, it is step 4, QA & testing.
bsimpson 9y ago
Off-topic, but it blows my mind how poorly proofread many articles are nowadays. In this example, there's a 3-word sentence fragment - "That login gave" - hanging out in between two other sentences. If the author even read what he'd written once before posting, he ought to have caught that.
- sandworm101 9y ago
  The ability to write is largely ignored at tech firms these days. Grammar is viewed as a bunch of stodgy rules to be ignored at will. Some are indeed silly throwbacks, but the basic structures are what allow us to communicate effectively. Drop them and errors in understanding creep into nearly every email. Yesterday I had a back-and-forth with a boss over "login", "log in", "log in to" and "log into". That might seem silly but little things really do matter. (fyi, login = noun. Log in = verb. We never settled on 'into' or 'in to'.)
  - pdpi 9y ago
    Surely: log into -> write to a specific log log in to -> access a certain host no?
    - hirsin 9y ago
      Fwiw, I've always used "log to" for writing out logs. "Log to stderr". So, you know, extra fun deciding what's "correct".
      - pdpi 9y ago
        Sure, but that wasn't one of the options, and doesn't (to me) make the "into" case ambiguous :)
      - exabrial 9y ago
        In my tech writing class for the sciences, my teacher said, "Never use a noun when you could use a verb". Meaning, she would suggest saying: "Write a log to" and "User logs in to"; which are far more clear in their intent. :) I think it's amazing we can even understand each other sometimes; English is quite a terrible language.
0x0 9y ago
Why is all communication from Apple on this case, both yesterday and today, being channeled via screenshots of text appended to random twitter users posts or blogs? It's weird that there's no official page on apple.com for these statements. (Beyond the actual "security update 2017-001" announcement webpage, which wasn't published until the patch was available)
- tty7 9y ago
  it's all part of the fun
- ringaroundthetx 9y ago
  > which wasn't published until the patch was available answered your own question? They knew the patch would be quick and was in progress, why bring extra attention to it. A few tech blogs and devs on twitter is good enough.
  - dsfyu404ed 9y ago
    Exactly. They don't want this in the MSM and the MSM is usually a few days or even weeks behind the internet when it comes to things that aren't relocatable to the vast majority of people.
- robotresearcher 9y ago
  Apple's answer is on that page: "For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available."
  - 0x0 9y ago
    I'd say that works against the purpose of protecting customers. Every blackhat in the world had probably heard about it last night, but if Apple had announced details earlier, even without a patch, informed customers could take preventive action (such as not connecting to public wifi, disabling screen sharing, etc).
- 9y ago

nailer 9y ago

Original source of Buzzfeed article, if you'd like to avoid giving them traffic: https://twitter.com/lemiorhan/status/935578694541770752 https://twitter.com/lemiorhan/status/935578694541770752 Demo: https://twitter.com/0xAmit/status/935607313368481793 https://twitter.com/0xAmit/status/935607313368481793

blinkingled 9y ago

> We are auditing our development processes to help prevent this from happening again. That's great to hear even if it took multiple stumbles for them to finally admit - but surely they should be also audit their QA/testing processes? Or does development in AppleSpeak mean everything?

Klathmon 9y ago
It sound to me like the "development process" points to the whole soup-to-nuts system. From "brainstorming" and new feature development, to development, to testing, to QA, to deployment.
- blinkingled 9y ago
  If so, that's going to be a big undertaking :)
  - zokier 9y ago
    Or a big lip service.
vinceguidry 9y ago
I don't know how you could expect QA to be able to have a rigorous process to catch security problems of this type. It's one thing to audit the strength of crypto protocols, quite another to rigorously test every conceivable attack surface for privilege escalation. That space is vast.
- blinkingled 9y ago
  Actually entering blank passwords and automated password entry should be Test Cases #0 and #1 for any thing that has a login. OS and other critical infrastructure vendors should go beyond that and explore the vast space to make sure nothing like this ever happens.
  - glhaynes 9y ago
    They may have even had a test case that entered "root" and no password and hit OK once, but that wouldn't have caught it. What if you'd had to hit "OK" forty-one times to trigger the bug? It's deeply unsatisfying to just say "the problem space is so vast that it's hard to even know what to try beyond the basics that every QA person knows" but I don't personally have a better answer than that. Maybe those that study the space do, though?
    - jacobush 9y ago
      Fuzzing inputs
    - anton_gogolev 9y ago
      Where are all the unit/integration tests for the APIs that this damned button is calling? Hindsight being 20/20, but I cannot imagine not asserting that a newly created/re-enabled root user has a non-empty password.
      - ghostly_s 9y ago
        I don't think empty password on root is the issue here; enabling root when the user did not intend to and did not have permission to is. Isn't empty password for root a default state for systems where direct root login is not enabled? And isn't enabling root with no password the intended behavior when booting into Single User Mode?
teamhappy 9y ago
> Or does development in AppleSpeak mean everything? It's a press release. It doesn't mean anything.
DougBTX 9y ago
Top google search result for "software development processes" says: What are the steps in software development? 1. Requirement gathering and analysis. 2. Design. 3. Implementation or coding. 4. Testing. 5. Deployment. 6. Maintenance. So, yes, it is step 4, QA & testing.

bsimpson 9y ago

Off-topic, but it blows my mind how poorly proofread many articles are nowadays. In this example, there's a 3-word sentence fragment - "That login gave" - hanging out in between two other sentences. If the author even read what he'd written once before posting, he ought to have caught that.

sandworm101 9y ago
The ability to write is largely ignored at tech firms these days. Grammar is viewed as a bunch of stodgy rules to be ignored at will. Some are indeed silly throwbacks, but the basic structures are what allow us to communicate effectively. Drop them and errors in understanding creep into nearly every email. Yesterday I had a back-and-forth with a boss over "login", "log in", "log in to" and "log into". That might seem silly but little things really do matter. (fyi, login = noun. Log in = verb. We never settled on 'into' or 'in to'.)
- pdpi 9y ago
  Surely: log into -> write to a specific log log in to -> access a certain host no?
  - hirsin 9y ago
    Fwiw, I've always used "log to" for writing out logs. "Log to stderr". So, you know, extra fun deciding what's "correct".
    - pdpi 9y ago
      Sure, but that wasn't one of the options, and doesn't (to me) make the "into" case ambiguous :)
    - exabrial 9y ago
      In my tech writing class for the sciences, my teacher said, "Never use a noun when you could use a verb". Meaning, she would suggest saying: "Write a log to" and "User logs in to"; which are far more clear in their intent. :) I think it's amazing we can even understand each other sometimes; English is quite a terrible language.

0x0 9y ago

Why is all communication from Apple on this case, both yesterday and today, being channeled via screenshots of text appended to random twitter users posts or blogs? It's weird that there's no official page on apple.com for these statements. (Beyond the actual "security update 2017-001" announcement webpage, which wasn't published until the patch was available)

tty7 9y ago
it's all part of the fun
ringaroundthetx 9y ago
> which wasn't published until the patch was available answered your own question? They knew the patch would be quick and was in progress, why bring extra attention to it. A few tech blogs and devs on twitter is good enough.
- dsfyu404ed 9y ago
  Exactly. They don't want this in the MSM and the MSM is usually a few days or even weeks behind the internet when it comes to things that aren't relocatable to the vast majority of people.
robotresearcher 9y ago
Apple's answer is on that page: "For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available."
- 0x0 9y ago
  I'd say that works against the purpose of protecting customers. Every blackhat in the world had probably heard about it last night, but if Apple had announced details earlier, even without a patch, informed customers could take preventive action (such as not connecting to public wifi, disabling screen sharing, etc).
9y ago