5 ms·

Is this a normal disclosure? I just purchased a Mac but the list of potential kernel exploits seems much higher than I would expect in a point release.

iphone_elegance 6y ago
yeah, apples software has the same flaws as everybody elses ( especially safari )
barkingcat 6y ago
Apple has as many kernel exploits as any other, software is not perfect. macOS has a long history of many many security patches in point releases, sometimes the release notes run into the tens of pages. The point of view you should take is that the company that doesn't issue security fixes (or issues very few comparatively) is the one you should be worried about: They are not better, they just don't fix anything and leave you vulnerable instead.
- skrtskrt 6y ago
  I haven't used Windows since I needed it for obscure engineering software in college, but I did find that the frequency of security updates combined with Windows reputation made me feel more uneasy rather than positive. I felt less like "Oh good they're being proactive" and more like "Do they introduce 3 vulnerabilities for every one they fix?"
  - tpetry 6y ago
    Bit the bonus is microsoft is patching these vulnerabilites at best every two weeks. For macos you have to wait for the next minor release which may take a lot longer.
    - acdha 6y ago
      Apple has shipped out-of-band security updates quickly — they must have an internal process for weighing severity versus the user fatigue from shipping frequent updates.
  - barkingcat 6y ago
    At least you know about them. The worst are those vendors who require a serious consulation payment (5 figure+ contracts) just for them to show you the security advisory and then at the end they say "there is no patch yet"
cjbprime 6y ago
This is just my personal take, but what I think is happening is that recent advances in guided fuzzing have made C code (basically all C code) much more toxic and vulnerable than we thought. So, like, have Apple been introducing new vulnerabilities at an alarming rate recently? I doubt it. Is their entire kernel and userspace security ecosystem built on quicksand, just like everyone else's? Pretty much yup.

iphone_elegance 6y ago

yeah, apples software has the same flaws as everybody elses ( especially safari )

barkingcat 6y ago

Apple has as many kernel exploits as any other, software is not perfect. macOS has a long history of many many security patches in point releases, sometimes the release notes run into the tens of pages. The point of view you should take is that the company that doesn't issue security fixes (or issues very few comparatively) is the one you should be worried about: They are not better, they just don't fix anything and leave you vulnerable instead.

skrtskrt 6y ago
I haven't used Windows since I needed it for obscure engineering software in college, but I did find that the frequency of security updates combined with Windows reputation made me feel more uneasy rather than positive. I felt less like "Oh good they're being proactive" and more like "Do they introduce 3 vulnerabilities for every one they fix?"
- tpetry 6y ago
  Bit the bonus is microsoft is patching these vulnerabilites at best every two weeks. For macos you have to wait for the next minor release which may take a lot longer.
  - acdha 6y ago
    Apple has shipped out-of-band security updates quickly — they must have an internal process for weighing severity versus the user fatigue from shipping frequent updates.
- barkingcat 6y ago
  At least you know about them. The worst are those vendors who require a serious consulation payment (5 figure+ contracts) just for them to show you the security advisory and then at the end they say "there is no patch yet"

cjbprime 6y ago

This is just my personal take, but what I think is happening is that recent advances in guided fuzzing have made C code (basically all C code) much more toxic and vulnerable than we thought. So, like, have Apple been introducing new vulnerabilities at an alarming rate recently? I doubt it. Is their entire kernel and userspace security ecosystem built on quicksand, just like everyone else's? Pretty much yup.