7 ms·

I must say I am pleasantly surprised by the straightforward, no BS language

by drdrey 9y ago

Waterluvian 9y ago
It was better. I'm confused how the title says Intel and ARM but the first paragraph says all processors.
- alsetmusic 9y ago
  > It was better. I'm confused how the title says Intel and ARM but the first paragraph says all processors. These are the processors found in Apple products. Yesterday, there were comments [edit: on HN] about the Intel PR announcement that were critical of the fact that Intel name-dropped AMD in what was thought to be an attempt to deflect the issue from the Intel brand.
Aloha 9y ago
I am as well - this is something I can link to people who do not understand microarchitectures, so they can understand what these bugs are.
tischler 9y ago
Except they forgot to tell us about older versions of macOS which probably 75%[1] of Apple users still use. [1] http://gs.statcounter.com/macos-version-market-share/desktop/worldwide http://gs.statcounter.com/macos-version-market-share/desktop...
- thelibrarian 9y ago
  Security Updates were released for 10.6 and 10.5 (2017-002 and 2017-005 respectively).
  - 0x0 9y ago
    Where do you see updates for 10.6 and 10.5? According to https://support.apple.com/en-us/HT208331 https://support.apple.com/en-us/HT208331 - there was a 2017-002 for 10.12 and a 2017-005 for 10.11.
    - thelibrarian 9y ago
      Yes, I did mean 10.12.6 and 10.11.6.
- notadoc 9y ago
  Hopefully Sierra and El Capitan will get patched soon.
  - om2 9y ago
    This statement doesn’t make it clear, but they have been patched (same fixes as High Sierra)
    - EasyTiger_ 9y ago
      How were we meant to figure this out, through necromancy or something. There is no information indicating Sierra has been patched or is due to be patched.
      - 0x0 9y ago
        On https://support.apple.com/en-us/HT208331 https://support.apple.com/en-us/HT208331 there is a reference to CVE-2017-5754 with a footnote saying "Entry added January 4, 2018" (interesting to see this "changelog" being revised as the embargo has been lifted). It says the fix is "Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X El Capitan 10.11.6"
        notadoc 9y ago
        They edited the same page to remove those references. Best to assume Sierra and El Capitan are not patched until proven otherwise. Clear as mud.
- tischler 9y ago
  The patch for Meltdown (CVE-2017-5754) for High Sierra, Sierra and El Capitan was contained in these security updates from December 6: https://support.apple.com/en-us/HT208331 https://support.apple.com/en-us/HT208331
- deleted 9y ago
  [deleted]
wyldfire 9y ago
> In the coming days we plan to release mitigations in Safari to help defend against Spectre. If Apple was able to patch macOS in the ~6 month window since the issue was discovered why were they unable to patch Safari? Same question for Chrome and Firefox. Surely Google knew about it and hopefully they contacted Mozilla. It seems like the scope of the fixes for Chrome and Firefox are the same. Does it really take six months to do dev & QA for a fix like this? Wasn't the plan to disclose this to the public in January anyways?

I must say I am pleasantly surprised by the straightforward, no BS language

by drdrey 9y ago

I must say I am pleasantly surprised by the straightforward, no BS language

Waterluvian 9y ago

It was better. I'm confused how the title says Intel and ARM but the first paragraph says all processors.

alsetmusic 9y ago
> It was better. I'm confused how the title says Intel and ARM but the first paragraph says all processors. These are the processors found in Apple products. Yesterday, there were comments [edit: on HN] about the Intel PR announcement that were critical of the fact that Intel name-dropped AMD in what was thought to be an attempt to deflect the issue from the Intel brand.

Aloha 9y ago

I am as well - this is something I can link to people who do not understand microarchitectures, so they can understand what these bugs are.

tischler 9y ago

Except they forgot to tell us about older versions of macOS which probably 75%[1] of Apple users still use. [1] http://gs.statcounter.com/macos-version-market-share/desktop/worldwide http://gs.statcounter.com/macos-version-market-share/desktop...

thelibrarian 9y ago
Security Updates were released for 10.6 and 10.5 (2017-002 and 2017-005 respectively).
- 0x0 9y ago
  Where do you see updates for 10.6 and 10.5? According to https://support.apple.com/en-us/HT208331 https://support.apple.com/en-us/HT208331 - there was a 2017-002 for 10.12 and a 2017-005 for 10.11.
  - thelibrarian 9y ago
    Yes, I did mean 10.12.6 and 10.11.6.
notadoc 9y ago
Hopefully Sierra and El Capitan will get patched soon.
- om2 9y ago
  This statement doesn’t make it clear, but they have been patched (same fixes as High Sierra)
  - EasyTiger_ 9y ago
    How were we meant to figure this out, through necromancy or something. There is no information indicating Sierra has been patched or is due to be patched.
    - 0x0 9y ago
      On https://support.apple.com/en-us/HT208331 https://support.apple.com/en-us/HT208331 there is a reference to CVE-2017-5754 with a footnote saying "Entry added January 4, 2018" (interesting to see this "changelog" being revised as the embargo has been lifted). It says the fix is "Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X El Capitan 10.11.6"
      - notadoc 9y ago
        They edited the same page to remove those references. Best to assume Sierra and El Capitan are not patched until proven otherwise. Clear as mud.
tischler 9y ago
The patch for Meltdown (CVE-2017-5754) for High Sierra, Sierra and El Capitan was contained in these security updates from December 6: https://support.apple.com/en-us/HT208331 https://support.apple.com/en-us/HT208331
deleted 9y ago
[deleted]

wyldfire 9y ago

> In the coming days we plan to release mitigations in Safari to help defend against Spectre. If Apple was able to patch macOS in the ~6 month window since the issue was discovered why were they unable to patch Safari? Same question for Chrome and Firefox. Surely Google knew about it and hopefully they contacted Mozilla. It seems like the scope of the fixes for Chrome and Firefox are the same. Does it really take six months to do dev & QA for a fix like this? Wasn't the plan to disclose this to the public in January anyways?