9 ms·

I've been struggling for a long time to convince some of my less technical friends that keeping all of the software on their devices up to date is an important

I've been struggling for a long time to convince some of my less technical friends that keeping all of the software on their devices up to date is an important best practice from a security perspective. I'm afraid that the recent muck ups in High Sierra and iOS 11 are going to make sure that some of them never listen to me ever again.

IBM 9y ago
I have a hard time believing that your less technical friends are even following Apple news. The average person that walks into an Apple store and buys a Mac probably has no idea about the original vulnerability, let alone the multiple patches for it.
- tedivm 9y ago
  You don't need to be following "Apple news" to hear about this. It has been all over the news.
  - digi_owl 9y ago
    Indeed. You never need to follow Apple news to get Apple news, Apple is perhaps the one company that all MSM loves to talk about. And i attribute that to themselves being largely Apple users by force of habit.
- platinumrad 9y ago
  Maybe they won't be aware of this particular vulnerability but issues like the the iOS autocorrect bugs[1][2] get memed to death on all sorts of mainstream social media platforms. Even the original "root" tweet got 10k+ retweets. [1] https://www.theverge.com/2017/11/6/16611756/ios-11-bug-letter-i-a-unicode-symbol https://www.theverge.com/2017/11/6/16611756/ios-11-bug-lette... [2] http://bgr.com/2017/11/27/ios-11-problems-keyboard-autocorrect-it/ http://bgr.com/2017/11/27/ios-11-problems-keyboard-autocorre...
  - IBM 9y ago
    Sure but that's still a far cry from saying that even a significant percentage of the Mac user base is aware of it. Social media moves so fast that there's almost no chance it penetrated the zeitgeist. A big well known flaw was the iOS 8.0.1 update that bricked iPhones. That was pulled within a few hours of it being released but the scale of the iPhone meant that it impacted a large number of people. This is too invisible for anyone to notice.
- et-al 9y ago
  The average person that updated their iOS to 11 during the first two weeks has definitely noticed how bug-ridden it is with power issues, 3D touch issues, and the autocorrect bug. We've trained people to update ASAP for security reasons, but when Apple drops the ball and seriously fucks up iOS 11 for a month until 11.1.1 was released, this will keep users update-shy. I hope 2018 emphasises rock-solid releases for both macOS & iOS. Or Apple should move to a two-year release cycle (wishful thinking).
  - hrez 9y ago
    There is still unfixed IOS 11 introduced bug [1] that kills notification screen which requires powercycle to fix. Some users hit it multiple times a day. [1] https://discussions.apple.com/message/32638979?ac_cid=tw123456#32638979 https://discussions.apple.com/message/32638979?ac_cid=tw1234...
j45 9y ago
I generally stay 1 release behind (kept patched) for this reason, plus ensuring my workflow is not broken for a few months of the year. The latest version isn't always the most stable or secure, either. Someone had mentioned in a different post that Apple may not apply all security patches to Sierra. If I can find some support to this I think it will be picking the lesser of two evils.
- platinumrad 9y ago
  Judging by Apple's security updates page[1], they're still releasing standalone security updates for older versions of macOS. Unfortunately, the same is not true for iOS where security updates are rolled into OS updates. [1] https://support.apple.com/en-us/HT201222 https://support.apple.com/en-us/HT201222
  - vanilla_nut 9y ago
    Do you have any clue how to subscribe to security updates only on OS X? Looking for OS updates simply suggests downloading High Sierra, but my work laptop has to stay on El Capitan for dependency reasons.
    - gurkendoktor 9y ago
      It suggests downloading High Sierra because you've presumably already installed this update a month ago: https://support.apple.com/de-de/HT208221 https://support.apple.com/de-de/HT208221 The App Store "Updates" list is the right place to look (and refresh).
  - j45 9y ago
    Apparently not all patches are back-ported to older versions of MacOS. Haven't had a chance to look into this further on how Sierra may be impacted. https://news.ycombinator.com/item?id=15386319 https://news.ycombinator.com/item?id=15386319
  - gurkendoktor 9y ago
    Apple used to release a security update for revision N-1 and N-2 every time the current release got a point upgrade. However, 10.12.0 and 10.13.0 were both released on their own. Only when 10.12.1 and 10.13.1 were released did older systems get patched. So every time a new macOS release comes out, everyone has the choice between running a .0 release, or running an insecure OS for about a month.
veidr 9y ago
I hear you, and I have the same problem (hi, Dad) but it is worth noting that this latest re-occurrence of the bug happens only to machines that were not up-to-date when they downloaded (or rather, when Apple remotely installed) the security patch. If a machine had 10.13.1 (the latest version of macOS) installed when that happened, it is OK. If the machine had 10.13.0 installed when Apple installed the patch, however, then the update to 10.13.1 will bring the bug back, and necessitate both re-installation of the security patch and a reboot before the machine is again safe from the "root access for anybody who can spell 'root'" bug.
- saghm 9y ago
  Unfortunately, this is probably not going to convince non-stop technical people who already are hesitant to listen to sound advice about updating; at least the people like this who I know will just hear "the update broke things" and take that as confirmation of what they already believed.
ouid 9y ago
Updates do two things. They repair old bugs, and they introduce new bugs, often called features. It would be great if you could subscribe to just the former, but the idea that it is uniformly better to update seems absurd to me. From a user perspective, I never want my experience to change without my express consent. Sometimes I don't have the power to prevent it, but for my OS, I definitely have that power, and exercise it regularly.
- userbinator 9y ago
  As the memorable quote goes, "Updates are like vaccinations that have a large chance of making you grow an extra 3 ears, lose one eye, and turn your skin bright green." Updates to fix specific and very important bugs are good. Updates that do more are not. Unfortunately, I have often pondered how to solve this problem, and come to the conclusion that it's not easy --- but perhaps if almost all the users take a stand and just do not update whenever it's not for the specific and sole purpose of fixing some important bug, even if it means leaving security behind, maybe companies will finally listen and stop making security an excuse to bundle in other unwanted changes; because then they'll know that any attempts to do so will be met with high resistance, and if their goal was to secure, they would only fix these security issues and leave everything else alone. Although it's not Apple, the sentiment around Windows Vista and 8.x show that companies do care about their customers to some extent; but they're not going to care if the majority of users just slavishly accept whatever they get.
- jacquesm 9y ago
  And they typically replace working systems that you're used to with broken systems with a lot of new eye candy thrown in for no other reason than to be more modern looking totally throwing off any kind of muscle memory and familiarity.
calvinbhai 9y ago
I hear you! I have resorted to "wait for a month or two, and then update". Usually a few point updates are available by then. Explaining security to my family and friends doesn't work (most think passowrd managers and autofill are a bigger security hole than using same password everywhere).
- platinumrad 9y ago
  >most think passowrd managers and autofill are a bigger security hole than using same password everywhere Argh. My thanksgiving dinner in a nutshell.
rorykoehler 9y ago
I never upgrade immediately. Still on Sierra. I need my machine for work. I can't justify being an Apple beta testing guinea-pig. Once i know it's stable and /or all the major problems that could affect me are at least known if not fixed then i will upgrade. Anything else is reckless. Nothing wrong with applying security patches on the old os as needed.
- gurkendoktor 9y ago
  One problem is that Apple did NOT release a security update for older systems along with 10.12.0 and 10.13.0. Only when 10.12.1 and 10.13.1 came out did they publish patches for earlier revisions. That gives everyone a choice between using a .0 release (ouch) and running an unpatched OS for about a month.
  - nicky0 9y ago
    So you would recommend staying no more than one annual release behind?
    - gurkendoktor 9y ago
      See my answer to the sibling post. I'm not sure what to recommend. When 10.14 comes out, we'll probably have to read the KB article to evaluate whether the security fixes are so important that we should install 10.14.0 immediately (no matter how buggy it may be).
  - deleted 9y ago
    [deleted]
  - rorykoehler 9y ago
    I'm never that far behind with my strategy. After a while you get diminishing returns by not upgrading.
    - gurkendoktor 9y ago
      Sorry, I think my post was not very clear. macOS High Sierra 10.13.0 was released on 2017-09-25. Sierra (10.12 and El Capitan (10.11) were not patched on that day. So if you didn't upgrade to 10.13.0 _on the first day of its availability_, you were missing out on these security fixes: https://support.apple.com/de-de/HT208144 https://support.apple.com/de-de/HT208144 Apple only released patches for 10.12 and 10.11 along with 10.13.1, more than a month later (2017-10-31): https://support.apple.com/de-de/HT208221 https://support.apple.com/de-de/HT208221 The same pattern happened when 10.12.0 was released - older systems only started receiving security fixes on the day 10.12.1 was released. So it is generally true that Apple keeps the three most recent versions of macOS secure, but there's always this awkward gap around September where they don't.
sumitgt 9y ago
Best advice you can give to less technical friends is to just use a ChromeBook / Windows 10S device / or iPad. General purpose computers are no longer necessary for a significant chunk of consumers.
- exikyut 9y ago
  iPad ⇆ iOS :(
  - sumitgt 9y ago
    I meant more as a replacement to laptops and desktop computers.
- deleted 9y ago
  [deleted]
- crx087 9y ago
  > ChromeBook / Windows 10S device "Hey sumitgt, how do I get $software to work? I bought it for $79 on sale but it won't open." > iPad "Hey sumitgt, can you help me get $university's site to work? I need to turn in my homework before midnight, but the page says something about Internet Explorer and Adobe Flash."
  - Jonnax 9y ago
    I guess that is the case in a lot of places. But things are changing and quickly as well. These devices are fashionable so adoption of them comes from edicts up top to IT. Microsoft has been pushing the office online suite a lot in universities and businesses. Also went to university a number of years ago and they used simple HTML file upload stuff for turnins of coursework.
saosebastiao 9y ago
And this is the real long lasting problem with Apple’s shoddy software quality of late. Nobody I know updates their software anymore because they don’t trust that the update won’t ruin something. I personally have always updated my software religiously but even I won’t do that on my iPhone anymore. And now the only option they have to close security vulnerabilities is to force updates...and when you force it, brand loyalty is gonna take a hit.
nicolas_t 9y ago
I always install security updates as soon as they are released but I do not and I advise my friends not to upgrade to the latest major release right when it's been released. I still remember the update to el capitan destroying my filevault with all my files (luckily I had backup). Recent major releases from OS X introduce regressions and are bug ridden for the first 6 months.

IBM 9y ago

I have a hard time believing that your less technical friends are even following Apple news. The average person that walks into an Apple store and buys a Mac probably has no idea about the original vulnerability, let alone the multiple patches for it.

tedivm 9y ago
You don't need to be following "Apple news" to hear about this. It has been all over the news.
- digi_owl 9y ago
  Indeed. You never need to follow Apple news to get Apple news, Apple is perhaps the one company that all MSM loves to talk about. And i attribute that to themselves being largely Apple users by force of habit.
platinumrad 9y ago
Maybe they won't be aware of this particular vulnerability but issues like the the iOS autocorrect bugs[1][2] get memed to death on all sorts of mainstream social media platforms. Even the original "root" tweet got 10k+ retweets. [1] https://www.theverge.com/2017/11/6/16611756/ios-11-bug-letter-i-a-unicode-symbol https://www.theverge.com/2017/11/6/16611756/ios-11-bug-lette... [2] http://bgr.com/2017/11/27/ios-11-problems-keyboard-autocorrect-it/ http://bgr.com/2017/11/27/ios-11-problems-keyboard-autocorre...
- IBM 9y ago
  Sure but that's still a far cry from saying that even a significant percentage of the Mac user base is aware of it. Social media moves so fast that there's almost no chance it penetrated the zeitgeist. A big well known flaw was the iOS 8.0.1 update that bricked iPhones. That was pulled within a few hours of it being released but the scale of the iPhone meant that it impacted a large number of people. This is too invisible for anyone to notice.
et-al 9y ago
The average person that updated their iOS to 11 during the first two weeks has definitely noticed how bug-ridden it is with power issues, 3D touch issues, and the autocorrect bug. We've trained people to update ASAP for security reasons, but when Apple drops the ball and seriously fucks up iOS 11 for a month until 11.1.1 was released, this will keep users update-shy. I hope 2018 emphasises rock-solid releases for both macOS & iOS. Or Apple should move to a two-year release cycle (wishful thinking).
- hrez 9y ago
  There is still unfixed IOS 11 introduced bug [1] that kills notification screen which requires powercycle to fix. Some users hit it multiple times a day. [1] https://discussions.apple.com/message/32638979?ac_cid=tw123456#32638979 https://discussions.apple.com/message/32638979?ac_cid=tw1234...

j45 9y ago

I generally stay 1 release behind (kept patched) for this reason, plus ensuring my workflow is not broken for a few months of the year. The latest version isn't always the most stable or secure, either. Someone had mentioned in a different post that Apple may not apply all security patches to Sierra. If I can find some support to this I think it will be picking the lesser of two evils.

platinumrad 9y ago
Judging by Apple's security updates page[1], they're still releasing standalone security updates for older versions of macOS. Unfortunately, the same is not true for iOS where security updates are rolled into OS updates. [1] https://support.apple.com/en-us/HT201222 https://support.apple.com/en-us/HT201222
- vanilla_nut 9y ago
  Do you have any clue how to subscribe to security updates only on OS X? Looking for OS updates simply suggests downloading High Sierra, but my work laptop has to stay on El Capitan for dependency reasons.
  - gurkendoktor 9y ago
    It suggests downloading High Sierra because you've presumably already installed this update a month ago: https://support.apple.com/de-de/HT208221 https://support.apple.com/de-de/HT208221 The App Store "Updates" list is the right place to look (and refresh).
- j45 9y ago
  Apparently not all patches are back-ported to older versions of MacOS. Haven't had a chance to look into this further on how Sierra may be impacted. https://news.ycombinator.com/item?id=15386319 https://news.ycombinator.com/item?id=15386319
- gurkendoktor 9y ago
  Apple used to release a security update for revision N-1 and N-2 every time the current release got a point upgrade. However, 10.12.0 and 10.13.0 were both released on their own. Only when 10.12.1 and 10.13.1 were released did older systems get patched. So every time a new macOS release comes out, everyone has the choice between running a .0 release, or running an insecure OS for about a month.

veidr 9y ago

I hear you, and I have the same problem (hi, Dad) but it is worth noting that this latest re-occurrence of the bug happens only to machines that were not up-to-date when they downloaded (or rather, when Apple remotely installed) the security patch. If a machine had 10.13.1 (the latest version of macOS) installed when that happened, it is OK. If the machine had 10.13.0 installed when Apple installed the patch, however, then the update to 10.13.1 will bring the bug back, and necessitate both re-installation of the security patch and a reboot before the machine is again safe from the "root access for anybody who can spell 'root'" bug.

saghm 9y ago
Unfortunately, this is probably not going to convince non-stop technical people who already are hesitant to listen to sound advice about updating; at least the people like this who I know will just hear "the update broke things" and take that as confirmation of what they already believed.

ouid 9y ago

Updates do two things. They repair old bugs, and they introduce new bugs, often called features. It would be great if you could subscribe to just the former, but the idea that it is uniformly better to update seems absurd to me. From a user perspective, I never want my experience to change without my express consent. Sometimes I don't have the power to prevent it, but for my OS, I definitely have that power, and exercise it regularly.

userbinator 9y ago
As the memorable quote goes, "Updates are like vaccinations that have a large chance of making you grow an extra 3 ears, lose one eye, and turn your skin bright green." Updates to fix specific and very important bugs are good. Updates that do more are not. Unfortunately, I have often pondered how to solve this problem, and come to the conclusion that it's not easy --- but perhaps if almost all the users take a stand and just do not update whenever it's not for the specific and sole purpose of fixing some important bug, even if it means leaving security behind, maybe companies will finally listen and stop making security an excuse to bundle in other unwanted changes; because then they'll know that any attempts to do so will be met with high resistance, and if their goal was to secure, they would only fix these security issues and leave everything else alone. Although it's not Apple, the sentiment around Windows Vista and 8.x show that companies do care about their customers to some extent; but they're not going to care if the majority of users just slavishly accept whatever they get.
jacquesm 9y ago
And they typically replace working systems that you're used to with broken systems with a lot of new eye candy thrown in for no other reason than to be more modern looking totally throwing off any kind of muscle memory and familiarity.

calvinbhai 9y ago

I hear you! I have resorted to "wait for a month or two, and then update". Usually a few point updates are available by then. Explaining security to my family and friends doesn't work (most think passowrd managers and autofill are a bigger security hole than using same password everywhere).

platinumrad 9y ago
>most think passowrd managers and autofill are a bigger security hole than using same password everywhere Argh. My thanksgiving dinner in a nutshell.

rorykoehler 9y ago

I never upgrade immediately. Still on Sierra. I need my machine for work. I can't justify being an Apple beta testing guinea-pig. Once i know it's stable and /or all the major problems that could affect me are at least known if not fixed then i will upgrade. Anything else is reckless. Nothing wrong with applying security patches on the old os as needed.

gurkendoktor 9y ago
One problem is that Apple did NOT release a security update for older systems along with 10.12.0 and 10.13.0. Only when 10.12.1 and 10.13.1 came out did they publish patches for earlier revisions. That gives everyone a choice between using a .0 release (ouch) and running an unpatched OS for about a month.
- nicky0 9y ago
  So you would recommend staying no more than one annual release behind?
  - gurkendoktor 9y ago
    See my answer to the sibling post. I'm not sure what to recommend. When 10.14 comes out, we'll probably have to read the KB article to evaluate whether the security fixes are so important that we should install 10.14.0 immediately (no matter how buggy it may be).
- deleted 9y ago
  [deleted]
- rorykoehler 9y ago
  I'm never that far behind with my strategy. After a while you get diminishing returns by not upgrading.
  - gurkendoktor 9y ago
    Sorry, I think my post was not very clear. macOS High Sierra 10.13.0 was released on 2017-09-25. Sierra (10.12 and El Capitan (10.11) were not patched on that day. So if you didn't upgrade to 10.13.0 _on the first day of its availability_, you were missing out on these security fixes: https://support.apple.com/de-de/HT208144 https://support.apple.com/de-de/HT208144 Apple only released patches for 10.12 and 10.11 along with 10.13.1, more than a month later (2017-10-31): https://support.apple.com/de-de/HT208221 https://support.apple.com/de-de/HT208221 The same pattern happened when 10.12.0 was released - older systems only started receiving security fixes on the day 10.12.1 was released. So it is generally true that Apple keeps the three most recent versions of macOS secure, but there's always this awkward gap around September where they don't.

sumitgt 9y ago

Best advice you can give to less technical friends is to just use a ChromeBook / Windows 10S device / or iPad. General purpose computers are no longer necessary for a significant chunk of consumers.

exikyut 9y ago
iPad ⇆ iOS :(
- sumitgt 9y ago
  I meant more as a replacement to laptops and desktop computers.
deleted 9y ago
[deleted]
crx087 9y ago
> ChromeBook / Windows 10S device "Hey sumitgt, how do I get $software to work? I bought it for $79 on sale but it won't open." > iPad "Hey sumitgt, can you help me get $university's site to work? I need to turn in my homework before midnight, but the page says something about Internet Explorer and Adobe Flash."
- Jonnax 9y ago
  I guess that is the case in a lot of places. But things are changing and quickly as well. These devices are fashionable so adoption of them comes from edicts up top to IT. Microsoft has been pushing the office online suite a lot in universities and businesses. Also went to university a number of years ago and they used simple HTML file upload stuff for turnins of coursework.

saosebastiao 9y ago

And this is the real long lasting problem with Apple’s shoddy software quality of late. Nobody I know updates their software anymore because they don’t trust that the update won’t ruin something. I personally have always updated my software religiously but even I won’t do that on my iPhone anymore. And now the only option they have to close security vulnerabilities is to force updates...and when you force it, brand loyalty is gonna take a hit.

nicolas_t 9y ago

I always install security updates as soon as they are released but I do not and I advise my friends not to upgrade to the latest major release right when it's been released. I still remember the update to el capitan destroying my filevault with all my files (luckily I had backup). Recent major releases from OS X introduce regressions and are bug ridden for the first 6 months.