7 ms·

I feel weird reading comments here ranging from excusing the developer to blaming him, for its lack of unit testing or anything. Let’s make this clear : managem

by bsaul 9y ago

I feel weird reading comments here ranging from excusing the developer to blaming him, for its lack of unit testing or anything. Let’s make this clear : management fcked up badly. Human process. Not code, not unit testing, not a single line of code is responsible. And you know why ? Because when you’ve had the greatest security failure in a decade publicly shaming your company and your team, you personaly make sure it doesn’t happen again in the next release. And it’s not just one manager. The whole management is screwed, it’s a disaster. I think now is really time to say : would you imagine this happening under steve jobs ?

revelation 9y ago
It probably was this great idea of merging the iOS and MacOS teams. That just screams management.
dsacco 9y ago
> Because when you’ve had the greatest security failure in a decade It's nowhere close to the greatest security failure in a decade. It's not even a contender in the far off distance. It's a well publicized vulnerability, and it's quite silly, but in the scheme of things it's just a Tuesday for CVE writers. We even had a vulnerability functionally identical to this, and similar in both severity and silliness, hit Linux within the past year. If you're talking about Apple specifically, it's still not that bad. The vulnerability couldn't be arbitrarily executed remotely with default OS settings, and it didn't grant kernel access. The Trident flaws were significantly worse than this, and that's just the first that comes to mind. Yes, yes, I know this wasn't the thrust of your point...but still. People get kind of hyperbolic when it comes to rating security vulnerabilities. It's more silly than it is severe. I expect at least one vulnerability of comparable impact on every major point release of every major operating system and web browser (not that this is a good thing, but it's logistically realistic). I don't think this is particularly bad for Apple's public image or reputation. Headlines about "the sky is falling!" vulnerabilities make the rounds every so often; for better or worse, it never really seems to stick in public consciousness.
- bsaul 9y ago
  because it doesn’t provide remote access, you’re right. But it’s been released publicly before there was a patch available, on an OS that’s only used as a personal computer, not as a server. And is immediately exploitable by just anyone, with 0 technical background. I think that makes it a very big deal, no matter what CVE usually use for a scale. I also don’t remember any macOS security breach getting that much publicity.
  - ben174 9y ago
    You'd still need physical access to a logged-in machine to exploit it. I'm not sure what the latest default is as to Guest accounts and whether or not those can exploit it, but it's a significantly different story if it requires you to exploit it on an unattended logged in machine. If guest accounts are enabled by default and a guest account can exploit it, yea.. that's pretty bad.
    - miles 9y ago
      > You'd still need physical access to a logged-in machine to exploit it Not necessarily; this aspect was unfortunately underreported: "macos 10.13 bug isn't limited to root in all circumstances; via ARD, you can log in as any existing user (e.g. _applepay) and share the screen of the logged-in user. also _uucp is allowed to log in" https://twitter.com/unsynchronized/status/935656609140711426 https://twitter.com/unsynchronized/status/935656609140711426
      - X-Istence 9y ago
        The defaults don't allow for remote management, screen sharing, or SSH or anything. Most of these devices are going to be sold without those options ever being touched. So that limits things in terms of who is affected.
        Someone1234 9y ago
        None of which makes this statement any less inaccurate: > You'd still need physical access to a logged-in machine to exploit it.
make3 9y ago
this doesn't even come close to being the greatest security failure in the decade. Equifax and intel ME are both much worse
- Larrikin 9y ago
  Those have nothing to do with Apple. They are massive failures from other companies.
- bsaul 9y ago
  In case that wasn’t clear, i’m talking about Apple.
  - make3 9y ago
    he didn't say Apple though. I thought he meant in general. I was apparently wrong. in which case this is probably right.
nikanj 9y ago
It didn't happen again in the /next release/, it happened when upgrading from an older release to the current one.
- givinguflac 9y ago
  Seriously. It’s shitty, but rebooting isn’t the end of the world. The problem is they don’t force a reboot with the fix. Now they just need to roll a new 10.13.1 with the fix and force a reboot with the standalone patch, problem solved.
mephitix 9y ago
I agree that management fucked up to allow this to happen again. But saying it's purely management's fault is another extreme. In big companies there are layers of 'management', including down to dev leads and tech/virtual leads who are devs by title. Knowledge of codebase/systems/deployment increases as you get down to the leaves. There are architects, release managers, product managers, etc. that should have provided multiple checks/balances. It's easy to point at "management" in big companies just as it is easy to point at "developers". But there's a whole bunch of nuances in the middle.
- fmihaila 9y ago
  > There are architects, release managers, product managers, etc. that should have provided multiple checks/balances. So to say it's purely "management" isn't quite correct to me. The fact that all the architects, release managers, and product managers that you mentioned do not function as a coherent structure capable of eliminating the occurrence of critical defects is the definition of management failure. NASA also had plenty of architects and directors when Challenger exploded. Such catastrophic failures, especially on repeat, are indicative of systemic disfunction. That is always the fault of top management.
giobox 9y ago
> would you imagine this happening under steve jobs? Of course it could have. Making software is hard, and mistakes get made. The idea that the magical presence of Steve would prevent this is absurd. There were plenty of terrible MacOS bugs under Steve's reign too. I can't help but feel there is perhaps a new generation of Mac users who don't remember or didn't experience how painful OS X was at times, even many years after the OS 9 to X transition had started.
- brians 9y ago
  Not magical. Fucking terrifying, and uninterested in the management layers designed to insulate any level staff from the consequences of this mistake. Compare Rickover.
- mattkevan 9y ago
  It’s true. OS X versions 1-3 were pretty bad. 10.3 was the first to be useable. 10.4 was actually good. Then 10.5 Leopard (or Leper as we knew it) was awful on release. From Snow Leopard onwards it’s been much better, with the occasional howler of course. It seems to be a constant refrain that Apple’s software quality is declining in the same way civilisation is always falling or HN is becoming more like reddit. In High Sierra they painlessly replaced the filesystem. Quite an achievement. Although everyone involved in this latest problem should be highly embarrassed.
  - protomyth 9y ago
    In High Sierra they painlessly replaced the filesystem. No, they did not. They still cannot upgrade any Mac mini server running RAID 1. They sold that configuration and crippled there software to put in the new file system. That is only painless for flash drive owners.
    - acdha 9y ago
      So what pain did it cause you? Your computer is running the new OS, and they’re doing a staged rollout which seems to have caused no problems – that sounds exactly as described.
likelynew 9y ago
What do you mean when you say management fucked up: they don't think it's worth to invest in quality of apple software? This is a decision, not a fuck up.
- asveikau 9y ago
  > This is a decision, not a fuck up. Can't it be both? I feel like when people talk like this, it abstracts away from the concept of a bad decision. Everything's a tradeoff! Sounds great until you hit actual consequences.
deleted 9y ago
[deleted]

by bsaul 9y ago

revelation 9y ago

It probably was this great idea of merging the iOS and MacOS teams. That just screams management.

dsacco 9y ago

> Because when you’ve had the greatest security failure in a decade It's nowhere close to the greatest security failure in a decade. It's not even a contender in the far off distance. It's a well publicized vulnerability, and it's quite silly, but in the scheme of things it's just a Tuesday for CVE writers. We even had a vulnerability functionally identical to this, and similar in both severity and silliness, hit Linux within the past year. If you're talking about Apple specifically, it's still not that bad. The vulnerability couldn't be arbitrarily executed remotely with default OS settings, and it didn't grant kernel access. The Trident flaws were significantly worse than this, and that's just the first that comes to mind. Yes, yes, I know this wasn't the thrust of your point...but still. People get kind of hyperbolic when it comes to rating security vulnerabilities. It's more silly than it is severe. I expect at least one vulnerability of comparable impact on every major point release of every major operating system and web browser (not that this is a good thing, but it's logistically realistic). I don't think this is particularly bad for Apple's public image or reputation. Headlines about "the sky is falling!" vulnerabilities make the rounds every so often; for better or worse, it never really seems to stick in public consciousness.

bsaul 9y ago
because it doesn’t provide remote access, you’re right. But it’s been released publicly before there was a patch available, on an OS that’s only used as a personal computer, not as a server. And is immediately exploitable by just anyone, with 0 technical background. I think that makes it a very big deal, no matter what CVE usually use for a scale. I also don’t remember any macOS security breach getting that much publicity.
- ben174 9y ago
  You'd still need physical access to a logged-in machine to exploit it. I'm not sure what the latest default is as to Guest accounts and whether or not those can exploit it, but it's a significantly different story if it requires you to exploit it on an unattended logged in machine. If guest accounts are enabled by default and a guest account can exploit it, yea.. that's pretty bad.
  - miles 9y ago
    > You'd still need physical access to a logged-in machine to exploit it Not necessarily; this aspect was unfortunately underreported: "macos 10.13 bug isn't limited to root in all circumstances; via ARD, you can log in as any existing user (e.g. _applepay) and share the screen of the logged-in user. also _uucp is allowed to log in" https://twitter.com/unsynchronized/status/935656609140711426 https://twitter.com/unsynchronized/status/935656609140711426
    - X-Istence 9y ago
      The defaults don't allow for remote management, screen sharing, or SSH or anything. Most of these devices are going to be sold without those options ever being touched. So that limits things in terms of who is affected.
      - Someone1234 9y ago
        None of which makes this statement any less inaccurate: > You'd still need physical access to a logged-in machine to exploit it.

make3 9y ago

this doesn't even come close to being the greatest security failure in the decade. Equifax and intel ME are both much worse

Larrikin 9y ago
Those have nothing to do with Apple. They are massive failures from other companies.
bsaul 9y ago
In case that wasn’t clear, i’m talking about Apple.
- make3 9y ago
  he didn't say Apple though. I thought he meant in general. I was apparently wrong. in which case this is probably right.

nikanj 9y ago

It didn't happen again in the /next release/, it happened when upgrading from an older release to the current one.

givinguflac 9y ago
Seriously. It’s shitty, but rebooting isn’t the end of the world. The problem is they don’t force a reboot with the fix. Now they just need to roll a new 10.13.1 with the fix and force a reboot with the standalone patch, problem solved.

mephitix 9y ago

I agree that management fucked up to allow this to happen again. But saying it's purely management's fault is another extreme. In big companies there are layers of 'management', including down to dev leads and tech/virtual leads who are devs by title. Knowledge of codebase/systems/deployment increases as you get down to the leaves. There are architects, release managers, product managers, etc. that should have provided multiple checks/balances. It's easy to point at "management" in big companies just as it is easy to point at "developers". But there's a whole bunch of nuances in the middle.

fmihaila 9y ago
> There are architects, release managers, product managers, etc. that should have provided multiple checks/balances. So to say it's purely "management" isn't quite correct to me. The fact that all the architects, release managers, and product managers that you mentioned do not function as a coherent structure capable of eliminating the occurrence of critical defects is the definition of management failure. NASA also had plenty of architects and directors when Challenger exploded. Such catastrophic failures, especially on repeat, are indicative of systemic disfunction. That is always the fault of top management.

giobox 9y ago

> would you imagine this happening under steve jobs? Of course it could have. Making software is hard, and mistakes get made. The idea that the magical presence of Steve would prevent this is absurd. There were plenty of terrible MacOS bugs under Steve's reign too. I can't help but feel there is perhaps a new generation of Mac users who don't remember or didn't experience how painful OS X was at times, even many years after the OS 9 to X transition had started.

brians 9y ago
Not magical. Fucking terrifying, and uninterested in the management layers designed to insulate any level staff from the consequences of this mistake. Compare Rickover.
mattkevan 9y ago
It’s true. OS X versions 1-3 were pretty bad. 10.3 was the first to be useable. 10.4 was actually good. Then 10.5 Leopard (or Leper as we knew it) was awful on release. From Snow Leopard onwards it’s been much better, with the occasional howler of course. It seems to be a constant refrain that Apple’s software quality is declining in the same way civilisation is always falling or HN is becoming more like reddit. In High Sierra they painlessly replaced the filesystem. Quite an achievement. Although everyone involved in this latest problem should be highly embarrassed.
- protomyth 9y ago
  In High Sierra they painlessly replaced the filesystem. No, they did not. They still cannot upgrade any Mac mini server running RAID 1. They sold that configuration and crippled there software to put in the new file system. That is only painless for flash drive owners.
  - acdha 9y ago
    So what pain did it cause you? Your computer is running the new OS, and they’re doing a staged rollout which seems to have caused no problems – that sounds exactly as described.

likelynew 9y ago

What do you mean when you say management fucked up: they don't think it's worth to invest in quality of apple software? This is a decision, not a fuck up.

asveikau 9y ago
> This is a decision, not a fuck up. Can't it be both? I feel like when people talk like this, it abstracts away from the concept of a bad decision. Everything's a tradeoff! Sounds great until you hit actual consequences.

deleted 9y ago

[deleted]