3 ms·

"With no disrespect to the developers at Apple, et. al., each one of these problems that goes viral before reaching "proper" channels..." s/that goes viral bef

"With no disrespect to the developers at Apple, et. al., each one of these problems that goes viral before reaching "proper" channels..." s/that goes viral before reaching \"proper\" channels// The fact that the problems existed to begin with is more troubling than whether they became known outside the company or not. IMO. With an open source UNIX-like OS (like the ones Apple sourced from for parts of macOS), both the developers and the users can watch the commits as they happen. Developers and users anywhere can choose to watch the commits and may be able to detect a series of poor quality ones. At least they can make informed decisions on the relative merits of changes from one version to the next. (Edit: They might choose not to compile or install certain components. I do not use X11. Nor do I use systemd.) The fact that development of macOS is hidden from those outside Apple and that problems are protected from "going viral" does not make the problems any less of an issue for macOS users. The issue is not how fast and secretively they fix problems, it is how many problems their developers are introducing into the existing version to begin with. If there are problems routinely being introduced then no amount of fixing after the fact and behind the scenes is going to make the OS higher quality. Only due care taken before introducing changes will guard against further deterioration of quality level. (Edit: The mention of open source is not intended to be interpreted as an argument that open source inherently results in better software. Perhaps skill and attention to detail are at cause. This is a debate worth avoiding. The relevance of the mention of open source is intended to suggest that detecting and avoiding problematic software may be easier for some users, e.g. yours truly, if they can access the source code. As opposed to hoping that Acme Hardware and Software Corporation will quickly and secretly fix all software problems that slipped through their QC procedures. Too late for the user who has already paid for the software and updated to the new version. That argument should not be too controversial.)

rrdharan 9y ago
Ironically Linux has had so many long standing versions of this exact vulnerability (screensaver issues leading to various forms of terrible disclosure) that it's not even really interesting to talk about them. I'd send you to the relevant jwz rants but I'd rather spare everyone the goatse-ing...
pfranz 9y ago
In addition to the many xscreensaver bugs over the years that the sibling post mentioned, last year there was a systemd root escalation exploit that was the same class of programming error as Apple's bug that enabled the root account with an empty password. From my understanding, in both cases they misinterpreted the return code's magic number (-1) as something it wasn't. Also, Linus' Law has some doubters. Things like Heartbleed show that Open Source isn't immune to long-standing, very impactful bugs.
- thomastjeffery 9y ago
  > isn't immune Why all-or-nothing? The fact is that free software has transparency as one of its advantages. When software is closed-source, its users must rely on the developers to maintain that software.
  - pfranz 9y ago
    I completely agree it is an advantage and I'm very happy there are options that are mostly Open Source (I say mostly because I'm not a fan of binary drivers, which are often a necessity for decent performance or features). > Why all-or-nothin? The parent was citing the existence of a few specific bugs in macOS and Open Source as an alternative (implying it wasn't vulnerable). I really think the "given enough eyeballs, all bugs are shallow" is something Open Source advocates take too much comfort in. The idea does have merit, but there needs to be more study/context to how it plays out in real life. Another example where this idea fails; there are credible suspicions that the NSA has influenced encryption standards introducing backdoors or known flaws even though the algorithms themselves are publicly known and freely available as well as the implementations.
    - thomastjeffery 9y ago
      > too much comfort That may be true, but the alternative is certainly worse.
      - pfranz 9y ago

rrdharan 9y ago

Ironically Linux has had so many long standing versions of this exact vulnerability (screensaver issues leading to various forms of terrible disclosure) that it's not even really interesting to talk about them. I'd send you to the relevant jwz rants but I'd rather spare everyone the goatse-ing...

pfranz 9y ago

In addition to the many xscreensaver bugs over the years that the sibling post mentioned, last year there was a systemd root escalation exploit that was the same class of programming error as Apple's bug that enabled the root account with an empty password. From my understanding, in both cases they misinterpreted the return code's magic number (-1) as something it wasn't. Also, Linus' Law has some doubters. Things like Heartbleed show that Open Source isn't immune to long-standing, very impactful bugs.

thomastjeffery 9y ago
> isn't immune Why all-or-nothing? The fact is that free software has transparency as one of its advantages. When software is closed-source, its users must rely on the developers to maintain that software.
- pfranz 9y ago
  I completely agree it is an advantage and I'm very happy there are options that are mostly Open Source (I say mostly because I'm not a fan of binary drivers, which are often a necessity for decent performance or features). > Why all-or-nothin? The parent was citing the existence of a few specific bugs in macOS and Open Source as an alternative (implying it wasn't vulnerable). I really think the "given enough eyeballs, all bugs are shallow" is something Open Source advocates take too much comfort in. The idea does have merit, but there needs to be more study/context to how it plays out in real life. Another example where this idea fails; there are credible suspicions that the NSA has influenced encryption standards introducing backdoors or known flaws even though the algorithms themselves are publicly known and freely available as well as the implementations.
  - thomastjeffery 9y ago
    > too much comfort That may be true, but the alternative is certainly worse.
    - pfranz 9y ago