4 ms·
People are missing the point-- it's not an htop problem since a simple console app running as a user should not be able to do this at all. This gives me the wi
by api 9y ago
People are missing the point-- it's not an htop problem since a simple console app running as a user should not be able to do this at all.
This gives me the willies. Methinks another OSX security bug is incoming.
- gargravarr 9y agoThis is exactly why I cringe at these seemingly minor issues - sure htop breaks, it can be worked around, but the root cause is more fundamental; an unprivileged user should not be able to crash the whole OS just by reading the process table, no matter how invasive. It makes me think what they have decided to change between Sierra and HS to cause this sort of failure. This is pretty fundamental and implies some tinkering deep in the kernel, potentially without fully understanding the repercussions. With the number of security holes that can be easily opened by naive tweaks to low-level code, I think we're right to be nervous about what they've done to cause this.
- djsumdog 9y agoYea, if I had a Mac box, I'd be looking at that call stack the author posted and fuzzing the hell out of those functions. There's a DoS bug bounty in there somewhere.
- Someone 9y agoOnly if Apple invited you to that competition (https://www.macworld.com/article/3104671/security/apple-announces-invitation-only-bug-bounty-program-at-black-hat-conference.html https://www.macworld.com/article/3104671/security/apple-anno...). Others only get credits.