6 ms·

What exactly happened to macOS development at Apple? There's always bad luck but Apple has had multiple very visible and very serious vulnerabilities over the l

by MertsA 9y ago

What exactly happened to macOS development at Apple? There's always bad luck but Apple has had multiple very visible and very serious vulnerabilities over the last few quarters. They've made multiple grave errors with encrypted volumes. I don't think Microsoft with Bitlocker or Linux with dm-crypt has ever made mistakes as bad as Apple has made here and multiple other times. Forget the stability issues, a lot of the vulnerabilities are very alarming. I'm by no means a cryptographer, I should not be allowed anywhere near any security sensitive code and yet of course I know that command line options are accessible by all. All it takes is a glance at ps to realize that this exposes the password so how exactly was this functionality added to both the UI and CLI without anyone realizing what a blunder this was? This reminds me of the bug where the System Preferences app would perform privileged operations by basically calling an undocumented API that would create an arbitrary file with arbitrary data and arbitrary permissions (including SUID) as root. What's worse is that Apple already "fixed" a vulnerability in that API when in reality all they did was modify the API client to not run if the user wasn't root. Why does it seem like there's no real oversight on macOS development anymore? An implementation bug or a complex design that leads to a vulnerability is one thing but so many of these vulnerabilities should have stuck out as a terrible design from the start. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1775 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1775

walrus01 9y ago
My theory: the NeXT developers who were around for osx v10.0 and around then have all retired.
- AHTERIX5000 9y ago
  I understand what you're trying to say but still, 10.0 was quite unusable at the time due to performance and stability issues ;-)
  - chrisfinazzo 9y ago
    That's fair, but I think simply the fact that a badly behaving application couldn't bring down the entire OS was so revolutionary that people overlooked the performance issues. Most of worst issues were sorted out by 10.1.
glandium 9y ago
You don't even need to look at security vulnerabilities to wonder what happened to macOS development at Apple. My wife recently bought a mighty mouse. It worked for a few days, but then macOS would fail to associate with it via Bluetooth unless it's plugged in via the lightning cable, in which case it's unusable, the connector being on the side that normally sits on the table. Anyways, after a quick Google, I found a workaround that I couldn't believe would work, but I tried it anyways: open preferences, and check off "Allow Handoff between this Mac and your iCloud devices". ... and it worked instantly. My wife doesn't even have an iCloud account... The problem (and workaround) has been known for at least 4 years.
- ksec 9y ago
  There are other problem known for years and no fix in sight. ( Last time I checked ) Having Whatsapp Backup using iCloud Drive ( By Default ) and using iCloud on Mac would means you download (cache) these iCloud content on your Mac, and you would be downloading 10s GB of Whatsapp backup to your Mac, every single day if you have Whatsapp set to auto. It is not a problem if you have an fast internet connection and you wouldn't feel the difference. If you have a slow connection your Internet will literally come to a halt. Even worst if your internet connection is dependent on 4G. Imagine 10M Whatsapp user are also a Mac user. Even at 1GB per backup, that is 10PB /Day wasted.
- orclev 9y ago
  Or this awesome issue on any of the newer MacBook Pro laptops, if you plug or unplug any USB devices while the system is either going into or recovering from sleep mode (I.E. after you've closed the lid, but before you see the login screen again after opening it), it will randomly kernel panic. I spent almost a month trying to figure out why I would randomly get a kernel panic in the morning since my evening routine was to close the lid, disconnect my keyboard/mouse/monitor, and then in the morning do the exact opposite (plugin keyboard/mouse/monitor, open lid). Once I read about the issues with USB devices and sleep mode I changed my routine to first open the lid, wait for the login screen to show up then plugin all the USB devices. Since I made that change I haven't seen a single kernel panic.
  - 9y ago
srigi 9y ago
In my honest opinion senior developers quit from Apple long time ago (or was fired). Then missing labor force was quickly reinforced by rushed hires of unskilled juniors.
fitzroy 9y ago
> Why does it seem like there's no real oversight on macOS development anymore? It may seem like that, but don't forget 15 years ago Mac OS X 10.3 erased external FireWire drives. http://kottke.org/03/10/important-glitch-in-apples-panther-erases-connected-firewire-drives http://kottke.org/03/10/important-glitch-in-apples-panther-e... https://web.archive.org/web/20031202034911/http://www.apple.com/macosx/firewire800specialmessage.html https://web.archive.org/web/20031202034911/http://www.apple....
- lloeki 9y ago
  > external An upgrade to the beloved 10.6 could potentially outright rm -rf your home dir. I was unaffected but it did make me retrospectively shiver when I learned about that bug post-upgrade. Still, the frequency of those goofups seems to be getting worse, possibly amplified by the growing expectations in what looks like to be an increasingly hostile digital environment.
FridgeSeal 9y ago
Didn't Apple essentially get rid of their MacOS team by taking them off it full time and putting them into the iOS team? (So they essentially had to apply their time between the 2).
- chrisfinazzo 9y ago
  So much this. Teams are probably smaller than we realize, and the really great people get shuffled around. Got to pay off that debt one of these days, but 'not today' I guess...
  - deleted 9y ago
    [deleted]
    - braderhart 9y ago
      But they care about "equality"
- larkost 9y ago
  Actually it was almost the opposite. In this case I think you are remembering the events of one release where Apple had to delay an iOS release and pull more resources to get it thought. A couple minutes of searching has not found it for me. But in general the motion has been in the opposite direction. In the beginning iOS was its own project, and had a dedicated staff that took from MacOS (both staff and code) and did their own things with them. Once iOS was successful they decided to merge the parts that made sense to merge, and did so back into the MacOS teams. So there are a lot of teams that are shared between MacOS and iOS projects, and a long-term goal of merging as much of the codebase into one as makes sense (to Apple). An example of this is APFS, which was partially written to resolve the differences that had grown between the MacOS and iOS versions of HFS+.
vbezhenar 9y ago
I think that they want more features to differentiate their OS. And with focus on features quality will be inevitably lost, because sometimes you must stop, review stuff, refactor, fix all bugs, but it takes time and it's hard to justify that time to management which wants more features, not "useless" work. Current situation with Apple seems like a classic example of technical debt striking back.
jonathanstrange 9y ago
This is not really new. Apple's file vault passwords could be greped from the page file for many, many years, for example. There is just more reporting of security incidents and more customer awareness.
chrisfinazzo 9y ago
I still like to imagine that there is some bright eyed and eager Cal or MIT grad who goes to work at Apple because they are first and foremost a Mac user - and haven't done iOS development. Working full time on macOS might not be all that exciting, but it's the foundation that holds the rest of the house up.
JustSomeNobody 9y ago
It seems there's nobody with the clout at Apple to be able to say, "No, it's not good enough."

by MertsA 9y ago

walrus01 9y ago

My theory: the NeXT developers who were around for osx v10.0 and around then have all retired.

AHTERIX5000 9y ago
I understand what you're trying to say but still, 10.0 was quite unusable at the time due to performance and stability issues ;-)
- chrisfinazzo 9y ago
  That's fair, but I think simply the fact that a badly behaving application couldn't bring down the entire OS was so revolutionary that people overlooked the performance issues. Most of worst issues were sorted out by 10.1.

glandium 9y ago

You don't even need to look at security vulnerabilities to wonder what happened to macOS development at Apple. My wife recently bought a mighty mouse. It worked for a few days, but then macOS would fail to associate with it via Bluetooth unless it's plugged in via the lightning cable, in which case it's unusable, the connector being on the side that normally sits on the table. Anyways, after a quick Google, I found a workaround that I couldn't believe would work, but I tried it anyways: open preferences, and check off "Allow Handoff between this Mac and your iCloud devices". ... and it worked instantly. My wife doesn't even have an iCloud account... The problem (and workaround) has been known for at least 4 years.

ksec 9y ago
There are other problem known for years and no fix in sight. ( Last time I checked ) Having Whatsapp Backup using iCloud Drive ( By Default ) and using iCloud on Mac would means you download (cache) these iCloud content on your Mac, and you would be downloading 10s GB of Whatsapp backup to your Mac, every single day if you have Whatsapp set to auto. It is not a problem if you have an fast internet connection and you wouldn't feel the difference. If you have a slow connection your Internet will literally come to a halt. Even worst if your internet connection is dependent on 4G. Imagine 10M Whatsapp user are also a Mac user. Even at 1GB per backup, that is 10PB /Day wasted.
orclev 9y ago
Or this awesome issue on any of the newer MacBook Pro laptops, if you plug or unplug any USB devices while the system is either going into or recovering from sleep mode (I.E. after you've closed the lid, but before you see the login screen again after opening it), it will randomly kernel panic. I spent almost a month trying to figure out why I would randomly get a kernel panic in the morning since my evening routine was to close the lid, disconnect my keyboard/mouse/monitor, and then in the morning do the exact opposite (plugin keyboard/mouse/monitor, open lid). Once I read about the issues with USB devices and sleep mode I changed my routine to first open the lid, wait for the login screen to show up then plugin all the USB devices. Since I made that change I haven't seen a single kernel panic.
- 9y ago

srigi 9y ago

In my honest opinion senior developers quit from Apple long time ago (or was fired). Then missing labor force was quickly reinforced by rushed hires of unskilled juniors.

fitzroy 9y ago

> Why does it seem like there's no real oversight on macOS development anymore? It may seem like that, but don't forget 15 years ago Mac OS X 10.3 erased external FireWire drives. http://kottke.org/03/10/important-glitch-in-apples-panther-erases-connected-firewire-drives http://kottke.org/03/10/important-glitch-in-apples-panther-e... https://web.archive.org/web/20031202034911/http://www.apple.com/macosx/firewire800specialmessage.html https://web.archive.org/web/20031202034911/http://www.apple....

lloeki 9y ago
> external An upgrade to the beloved 10.6 could potentially outright rm -rf your home dir. I was unaffected but it did make me retrospectively shiver when I learned about that bug post-upgrade. Still, the frequency of those goofups seems to be getting worse, possibly amplified by the growing expectations in what looks like to be an increasingly hostile digital environment.

FridgeSeal 9y ago

Didn't Apple essentially get rid of their MacOS team by taking them off it full time and putting them into the iOS team? (So they essentially had to apply their time between the 2).

chrisfinazzo 9y ago
So much this. Teams are probably smaller than we realize, and the really great people get shuffled around. Got to pay off that debt one of these days, but 'not today' I guess...
- deleted 9y ago
  [deleted]
  - braderhart 9y ago
    But they care about "equality"
larkost 9y ago
Actually it was almost the opposite. In this case I think you are remembering the events of one release where Apple had to delay an iOS release and pull more resources to get it thought. A couple minutes of searching has not found it for me. But in general the motion has been in the opposite direction. In the beginning iOS was its own project, and had a dedicated staff that took from MacOS (both staff and code) and did their own things with them. Once iOS was successful they decided to merge the parts that made sense to merge, and did so back into the MacOS teams. So there are a lot of teams that are shared between MacOS and iOS projects, and a long-term goal of merging as much of the codebase into one as makes sense (to Apple). An example of this is APFS, which was partially written to resolve the differences that had grown between the MacOS and iOS versions of HFS+.

vbezhenar 9y ago

I think that they want more features to differentiate their OS. And with focus on features quality will be inevitably lost, because sometimes you must stop, review stuff, refactor, fix all bugs, but it takes time and it's hard to justify that time to management which wants more features, not "useless" work. Current situation with Apple seems like a classic example of technical debt striking back.

jonathanstrange 9y ago

This is not really new. Apple's file vault passwords could be greped from the page file for many, many years, for example. There is just more reporting of security incidents and more customer awareness.

chrisfinazzo 9y ago

I still like to imagine that there is some bright eyed and eager Cal or MIT grad who goes to work at Apple because they are first and foremost a Mac user - and haven't done iOS development. Working full time on macOS might not be all that exciting, but it's the foundation that holds the rest of the house up.

JustSomeNobody 9y ago

It seems there's nobody with the clout at Apple to be able to say, "No, it's not good enough."