6 ms·

The author of this blog post is lobbing some pretty serious accusations at Apple of being "neglect[ful]" and "deliberate," when in fact it's much more likely th

The author of this blog post is lobbing some pretty serious accusations at Apple of being "neglect[ful]" and "deliberate," when in fact it's much more likely that the responsible teams are carefully trying to backport the security patches without causing regressions. Sometimes a little patience is in order. But, of course, hysterics get you clicks.

jimbob45 5y ago
Since when should zero-day vulns be treated with patience? Also >This isn’t the first time that we’ve observed Apple neglecting to patch serious vulnerabilities, or even actively exploited ones.
- rib3ye 5y ago
  When you're "trying to backport the security patches without causing regressions". There's no silver bullet for patching large codebases at huge organizations.
fartcannon 5y ago
What makes you sure your version is true, while there's isn't? They're not your friend, they're a giant, exploitative megacorp.
- naoqj 5y ago
  The author of this blog post is not my friend either and they sell an antivirus so they are trying to get me to give them money as well.
  - deleted 5y ago
    [deleted]
  - fartcannon 5y ago
    Fair point. It does appear to be an antivirus software blog. Interesting, thank you.
- unethical_ban 5y ago
  Not all theories deserve equal weighting.
- pjbeam 5y ago
  Yes, they are megacorp. In the general case I think that working to uphold brand standard is the parsimonious interpretation rather than hahaha won't fix.
- krnlpnc 5y ago
  * Taking extra time for a stable fix * Rushing out a patch that introduces possible instability Which action do you think is better for business?
  - rob74 5y ago
    That probably depends on the number of users whose Macs get pwned in this "extra time" they are taking - I guess these users would have preferred a potentially unstable fix to no fix.
    - bastawhiz 5y ago
      If Apple released an unstable fix that caused crashes, we'd be here arguing about how they should have taken more time to get it right. The odds that a buggy patch that's pushed to your computer crashes it is far higher than your computer being pwned by attackers because a fix is still in the works.
- jedberg 5y ago
  They are a megacorp which employs actual humans who generally aren't evil. The evilness is usually an emergent behavior. I doubt the security team is sitting there choosing not to patch this, given that they are passionate about security. And it's unlikely that management has told them "don't release the patch, we want the people on old OSs to suffer!!". Most likely is that they just don't have as many resources for writing and testing the patch on the old versions, so it's taking longer.
  - amelius 5y ago
    Or their security team is understaffed because of evil emergent greedy behavior of the company.
    - stjohnswarts 5y ago
      Yep this is the reason. Monterrey probably has 10X as many people on it.
      - sulam 5y ago
        This is probably off by a factor of 2 at least. Is if you told me that Monterrey has 5x as many users, I’d agree. Not 10X. That said, there are likely a sizable group (5%?) of customers that cannot upgrade to Monterey. Apple should be worried for these customers, too.
        stjohnswarts 5y ago
        I was talking about developers, not users.
chefandy 5y ago
I look askance at hair-on-fire security alarmism but unpatched, acknowledged, in-the-wild remote code execution vulnerabilities are a pretty huge problem. Indeed, their words are sharp, but judiciously applied pressure is warranted. For some, lagging updates for critical applications render a complete OS upgrade infeasible. Apple patching old versions was reliable enough to inform security praxis and they should warn users about delays, even if the policy hasn't changed.
- KarlKemp 5y ago
  There just isn’t much software that works on Big Sur but not Monterey, if any. It’s not like a windows 95 to XP update. With yearly OS releases, the ecosystem is somewhat more up-to-date and resilient to typical changes.
  - chefandy 5y ago
    Many custom or niche domain-specific or hardware specific applications get caught up in this. I can think of 3 expensive pieces of equipment I use that rely on Mac software which always lags OS upgrades by months. People don't choose to use applications like that— they usually don't have a choice. Their OSs not being up-to-date is a problem.
_-david-_ 5y ago
Apple is able to patch the newest version without regressions but not the older versions?
- ectospheno 5y ago
  Monterey came out late October. You only aren’t on it if you decided not to be.
  - pgwhalen 5y ago
    Just checked, I'm not on Monterey, and I can't say I've decided either way.
    - brimble 5y ago
      I just checked and I'm on Big Sur. It's the reboot, for me. It's just inconvenient enough that I put off upgrades for a long time, usually. I usually apply iOS updates promptly, because it's much easier to say "yes" to those since it's not going to lose much useful state on re-boot. Plus they seem to complete a lot faster.
      - pgwhalen 5y ago
        Yeah I'm on Big Sur on my work computer, so I bet it's frozen by policy, but I bet it's the same on my personal, for the same reason.
        sulam 5y ago
        Python 2.7 being removed has probably made corporate upgrades very slow.
  - wayne 5y ago
    Or you have a Mac from 6+ years ago that doesn't support it. https://support.apple.com/en-us/HT212551 https://support.apple.com/en-us/HT212551 Apple doesn't support old hardware as long as Microsoft/Linux.
jmyeet 5y ago
This is my first reaction as well. Apple has a pretty good track record and a strong motivation to fix these vulnerabilities. It's a strong accusation to claim they're "neglecting" this deliberately and that needs some evidence. Here's some media literacy training for anyone seeing this: the title uses the word "neglecting". It's an odd word to choose but extremely deliberate. The author can't say "refusing" because that would require evidence as would "downplaying" or "dragging their feet". But "neglecting" allows you to use no action as "evidence" so you should be automatically suspicious of it. It's the same as "[Big Company] considering [controversial thing]". The word "considering" is deliberately chosen because it allows baseless speculation... which is the point.
TheKnack 5y ago
Apple invites this kind of reaction by not being transparent and not cooperating with the larger security community, for reasons that are difficult to understand. This week's episode of the the podcast run by the Intego Mac Antivirus company talked about a new malware affecting Macos that was severe enough that Apple released Xprotect signatures for it, but didn't provide details to the rest of the security community, so anti-virus vendors had to reverse engineer the Xprotect signatures to figure out what they were for. Apple usually only updates Xprotect for the highest severity malware that's circulating widely. https://podcast.intego.com/233 https://podcast.intego.com/233 Most of the tech industry participates in information sharing through groups like the Cyber Tech Accord, the Cyber Threat Alliance, and several others. Apple is conspicuously absent from these groups. https://cybertechaccord.org/signatories/ https://cybertechaccord.org/signatories/ https://www.cyberthreatalliance.org/ https://www.cyberthreatalliance.org/ What reason does Apple have to withhold information about vulnerabilities from the rest of the industry? It just puts their customers at risk. They have a trillion dollars. There's no reason they couldn't dedicate entire teams to disseminating information in a responsible way, just like every other tech company that you've heard of. In the case of these Big Sur / Catalina patches, what benefit is it for them to not share their plans if they are in fact planning to release patches once the "regressions" are accounted for?
- sulam 5y ago
  Not to take anything away from the other things you’re saying, but there’s a large difference between a company’s valuation and how much cash plus equivalents they have. Apple has roughly $20B, most of their valuation is from other things. :)
- otterley 5y ago
  > Apple invites this kind of reaction by not being transparent and not cooperating with the larger security community Eh, I disagree. While it's fair to wonder what's taking them so long, attributing malice or incompetence is unreasonable without more evidence than mere delay. > What reason does Apple have to withhold information about vulnerabilities from the rest of the industry? It just puts their customers at risk. I think the jury is out on the conclusion. While Apple is unquestionably peculiar with respect to their security community engagement, I think most would agree that they also have an outstanding overall security track record when you take into account the immense number of devices out there, all of which are connected to the Internet. It's difficult to identify a company that does better (again, relative to the overall risk exposure) than Apple in this aspect. > They have a trillion dollars. There's no reason they couldn't [insert anything here] Money can't buy you everything. Even Apple's war chest can't buy them the exact talent they need at the exact time. Talent is scarce and often happy and well-compensated at other engagements. Same goes for any of the FAANGs, one of whom I currently work for.

jimbob45 5y ago

Since when should zero-day vulns be treated with patience? Also >This isn’t the first time that we’ve observed Apple neglecting to patch serious vulnerabilities, or even actively exploited ones.

rib3ye 5y ago
When you're "trying to backport the security patches without causing regressions". There's no silver bullet for patching large codebases at huge organizations.

fartcannon 5y ago

What makes you sure your version is true, while there's isn't? They're not your friend, they're a giant, exploitative megacorp.

naoqj 5y ago
The author of this blog post is not my friend either and they sell an antivirus so they are trying to get me to give them money as well.
- deleted 5y ago
  [deleted]
- fartcannon 5y ago
  Fair point. It does appear to be an antivirus software blog. Interesting, thank you.
unethical_ban 5y ago
Not all theories deserve equal weighting.
pjbeam 5y ago
Yes, they are megacorp. In the general case I think that working to uphold brand standard is the parsimonious interpretation rather than hahaha won't fix.
krnlpnc 5y ago
* Taking extra time for a stable fix * Rushing out a patch that introduces possible instability Which action do you think is better for business?
- rob74 5y ago
  That probably depends on the number of users whose Macs get pwned in this "extra time" they are taking - I guess these users would have preferred a potentially unstable fix to no fix.
  - bastawhiz 5y ago
    If Apple released an unstable fix that caused crashes, we'd be here arguing about how they should have taken more time to get it right. The odds that a buggy patch that's pushed to your computer crashes it is far higher than your computer being pwned by attackers because a fix is still in the works.
jedberg 5y ago
They are a megacorp which employs actual humans who generally aren't evil. The evilness is usually an emergent behavior. I doubt the security team is sitting there choosing not to patch this, given that they are passionate about security. And it's unlikely that management has told them "don't release the patch, we want the people on old OSs to suffer!!". Most likely is that they just don't have as many resources for writing and testing the patch on the old versions, so it's taking longer.
- amelius 5y ago
  Or their security team is understaffed because of evil emergent greedy behavior of the company.
  - stjohnswarts 5y ago
    Yep this is the reason. Monterrey probably has 10X as many people on it.
    - sulam 5y ago
      This is probably off by a factor of 2 at least. Is if you told me that Monterrey has 5x as many users, I’d agree. Not 10X. That said, there are likely a sizable group (5%?) of customers that cannot upgrade to Monterey. Apple should be worried for these customers, too.
      - stjohnswarts 5y ago
        I was talking about developers, not users.

chefandy 5y ago

I look askance at hair-on-fire security alarmism but unpatched, acknowledged, in-the-wild remote code execution vulnerabilities are a pretty huge problem. Indeed, their words are sharp, but judiciously applied pressure is warranted. For some, lagging updates for critical applications render a complete OS upgrade infeasible. Apple patching old versions was reliable enough to inform security praxis and they should warn users about delays, even if the policy hasn't changed.

KarlKemp 5y ago
There just isn’t much software that works on Big Sur but not Monterey, if any. It’s not like a windows 95 to XP update. With yearly OS releases, the ecosystem is somewhat more up-to-date and resilient to typical changes.
- chefandy 5y ago
  Many custom or niche domain-specific or hardware specific applications get caught up in this. I can think of 3 expensive pieces of equipment I use that rely on Mac software which always lags OS upgrades by months. People don't choose to use applications like that— they usually don't have a choice. Their OSs not being up-to-date is a problem.

_-david-_ 5y ago

Apple is able to patch the newest version without regressions but not the older versions?

ectospheno 5y ago
Monterey came out late October. You only aren’t on it if you decided not to be.
- pgwhalen 5y ago
  Just checked, I'm not on Monterey, and I can't say I've decided either way.
  - brimble 5y ago
    I just checked and I'm on Big Sur. It's the reboot, for me. It's just inconvenient enough that I put off upgrades for a long time, usually. I usually apply iOS updates promptly, because it's much easier to say "yes" to those since it's not going to lose much useful state on re-boot. Plus they seem to complete a lot faster.
    - pgwhalen 5y ago
      Yeah I'm on Big Sur on my work computer, so I bet it's frozen by policy, but I bet it's the same on my personal, for the same reason.
      - sulam 5y ago
        Python 2.7 being removed has probably made corporate upgrades very slow.
- wayne 5y ago
  Or you have a Mac from 6+ years ago that doesn't support it. https://support.apple.com/en-us/HT212551 https://support.apple.com/en-us/HT212551 Apple doesn't support old hardware as long as Microsoft/Linux.

jmyeet 5y ago

This is my first reaction as well. Apple has a pretty good track record and a strong motivation to fix these vulnerabilities. It's a strong accusation to claim they're "neglecting" this deliberately and that needs some evidence. Here's some media literacy training for anyone seeing this: the title uses the word "neglecting". It's an odd word to choose but extremely deliberate. The author can't say "refusing" because that would require evidence as would "downplaying" or "dragging their feet". But "neglecting" allows you to use no action as "evidence" so you should be automatically suspicious of it. It's the same as "[Big Company] considering [controversial thing]". The word "considering" is deliberately chosen because it allows baseless speculation... which is the point.

TheKnack 5y ago

Apple invites this kind of reaction by not being transparent and not cooperating with the larger security community, for reasons that are difficult to understand. This week's episode of the the podcast run by the Intego Mac Antivirus company talked about a new malware affecting Macos that was severe enough that Apple released Xprotect signatures for it, but didn't provide details to the rest of the security community, so anti-virus vendors had to reverse engineer the Xprotect signatures to figure out what they were for. Apple usually only updates Xprotect for the highest severity malware that's circulating widely. https://podcast.intego.com/233 https://podcast.intego.com/233 Most of the tech industry participates in information sharing through groups like the Cyber Tech Accord, the Cyber Threat Alliance, and several others. Apple is conspicuously absent from these groups. https://cybertechaccord.org/signatories/ https://cybertechaccord.org/signatories/ https://www.cyberthreatalliance.org/ https://www.cyberthreatalliance.org/ What reason does Apple have to withhold information about vulnerabilities from the rest of the industry? It just puts their customers at risk. They have a trillion dollars. There's no reason they couldn't dedicate entire teams to disseminating information in a responsible way, just like every other tech company that you've heard of. In the case of these Big Sur / Catalina patches, what benefit is it for them to not share their plans if they are in fact planning to release patches once the "regressions" are accounted for?

sulam 5y ago
Not to take anything away from the other things you’re saying, but there’s a large difference between a company’s valuation and how much cash plus equivalents they have. Apple has roughly $20B, most of their valuation is from other things. :)
otterley 5y ago
> Apple invites this kind of reaction by not being transparent and not cooperating with the larger security community Eh, I disagree. While it's fair to wonder what's taking them so long, attributing malice or incompetence is unreasonable without more evidence than mere delay. > What reason does Apple have to withhold information about vulnerabilities from the rest of the industry? It just puts their customers at risk. I think the jury is out on the conclusion. While Apple is unquestionably peculiar with respect to their security community engagement, I think most would agree that they also have an outstanding overall security track record when you take into account the immense number of devices out there, all of which are connected to the Internet. It's difficult to identify a company that does better (again, relative to the overall risk exposure) than Apple in this aspect. > They have a trillion dollars. There's no reason they couldn't [insert anything here] Money can't buy you everything. Even Apple's war chest can't buy them the exact talent they need at the exact time. Talent is scarce and often happy and well-compensated at other engagements. Same goes for any of the FAANGs, one of whom I currently work for.