6 ms·

Apple's failure to update GNU software was actively impacting the security of OS X. Charlie Miller made mincemeat of OS X because of the sorry state of security

by sc68cal 15y ago

Apple's failure to update GNU software was actively impacting the security of OS X. Charlie Miller made mincemeat of OS X because of the sorry state of security of 3rd party utilities (http://rixstep.com/1/20080422,00.shtml http://rixstep.com/1/20080422,00.shtml). As Charlie Miller noted in his '07 BH presentation: (https://www.blackhat.com/presentations/bh-usa-07/Miller/Presentation/bh-usa-07-miller.pdf https://www.blackhat.com/presentations/bh-usa-07/Miller/Pres...) How to Find a Mac OS X 0-Day: 1) Find some open source package they use that is out of date 2) Read the change log for that software 3) Find a good bug 4) Profit! "The Samba on Mac OS X (on Monday) had an exploitable remote root vulnerability in it...it hadn’t been updated since February 2005!" If anything, Apple removing GPL software creates a better situation, because fink/macports/homebrew will be available to pick up the slack and provide more timely updates. Plus, it seems like FreeBSD is trying to get rid of as much GNU stuff as they can, so that more of what they release is covered under a BSD license (see BSD grep, for example). It may be that Apple is just picking up some of these changes from FreeBSD and doing a little bit of housekeeping on their end.

fluidcruft 15y ago
> It's not like Apple were keeping this stuff updated Well, obviously as the major point of the article is that Apple clearly refuses to ship software covered by GPLv3, so you're getting the rapidly ancient, last GPLv2 versions. It's quite a rare exception for updated GNU software to be available under GPLv2--the FSF basically moved their entire code base from GPLv2+ to GPLv3+ when GPLv3 was released and that has cascading effects since GPLv2 and GPLv3 are incompatible. I was unaware of the sorry state of things on MacOS actually as I don't use Apple products, but it at least enlightened me about all the bash bashing we tend to see on HN.
- _delirium 15y ago
  Yeah, I recently realized why various bash examples I tried out don't work on OSX. I guess it's an obvious thing to check, but somehow it never occurred to me that OSX's bash would be five years old.
  - Cieplak 15y ago
    Also worth noting, osx uses bsd versions of various utilities like grep and sed, instead of gnu counterparts Interesting sidenote: http://lists.freebsd.org/pipermail/freebsd-current/2010-August/019310.html http://lists.freebsd.org/pipermail/freebsd-current/2010-Augu...
  - adsr 15y ago
    Some bash examples contains Linuxisms that is not UNIX-03 compliant which OS X is in full, might be that as well.
- earl 15y ago
  to upgrade bash on OS X: brew install bash then follow directions at [1] [1] http://concisionandconcinnity.blogspot.com/2009/03/upgrade-bash-to-40-in-mac-os-x.html http://concisionandconcinnity.blogspot.com/2009/03/upgrade-b...
  - Quequau 15y ago
    I use MacPorts and "oh-my-Zsh"... but thinking about it, it should not be all that hard to update all of the outdated GNU stuff in Mac OS... but I don't think the system would actually use the updated stuff, so the security problems probably would still remain.
- bouncing 15y ago
  GPL2 and GPL3 are compatible. You just can't make GPL2 derivatives of GPL3 software.
  - fluidcruft 15y ago
    No, they are not unfortunately. From the FAQ: "Is GPLv3 compatible with GPLv2? (#v2v3Compatibility) No. Some of the requirements in GPLv3, such as the requirement to provide Installation Information, do not exist in GPLv2. As a result, the licenses are not compatible: if you tried to combine code released under both these licenses, you would violate section 6 of GPLv2. However, if code is released under GPL “version 2 or later,” that is compatible with GPLv3 because GPLv3 is one of the options it permits." http://www.gnu.org/licenses/gpl-faq.html#v2v3Compatibility http://www.gnu.org/licenses/gpl-faq.html#v2v3Compatibility
Quequau 15y ago
I've been a Apple & FreeBSD user for decades and it really looks to me like Apple is coming up for a long cycle of public and embarrassing security failures because of this... Or perhaps I should say, I don't think Apple is going to either update the lagging GNU utilities to current or put for the effort to migrate to current BSD alternatives until they have a protracted public shaming which demonstrably impacts the bottom line of iOS sales. Which sort of reminds me of what MS went through before they started taking security more seriously. (I haven't used Windows in years, so I can't really comment on the state of MS security today). Which is a shame because there is a lot of opportunity in the eddies of GNU, BSD, and Darwin. We all could benefit from an Apple sponsored security focused FOSS code review / bug hunt / development effort. Sort of like what Google does only focused on Security.
- X-Istence 15y ago
  I don't think that is the case, there won't be a requirement for public shaming, Apple is already removing more and more GPL licensed tools each release cycle and it won't be long until they are using more up-to-date BSD licensed tools. Also, one thing I have noticed is that Apple has started reacting faster to security threats and is at least willing to acknowledge the researchers behind them in their updates, which is much better compared to what previously happened. Not only that but before Lion was released many security researchers received an advanced copy. The other thing is that almost all of the GPL utilities are command line utilities and are not shipped with iOS so even if there are vulnerabilities in them it is highly unlikely that there will be a target painted on iOS's back. I don't foresee that there will be any major impact on their iOS product line.
  - Quequau 15y ago
    Actually what I was inferring is that between the rate of migration from older GNU tools to current BSD tools and the rate of response for security issues would combine to create a series of security failures in Mac OS. If that went on long enough and is publicized enough, it will effect iOS simply by guilt by association. Certainly I have also noticed a slight improvement on the way Apple handles security problems but I don't really think it's an adequate response. More importantly I have the general impression that long term Apple is moving away from Mac OS & workstations and towards iOS & devices. So them ignoring Mac OS problems or becoming slower to react on them would not really surprise me... at least until people started to view iOS in an equally negative light because of it. In any event, I honestly wish that Apple would maintain a larger presence in the FOSS community and put more effort into a more positive two way relationship.
ryannielsen 15y ago
"The Samba on Mac OS X (on Monday) had an exploitable remote root vulnerability in it...it hadn’t been updated since February 2005!" If anything, Apple removing GPL software creates a better situation, because fink/macports/homebrew will be available to pick up the slack and provide more timely updates. Plus, it seems like FreeBSD is trying to get rid of as much GNU stuff as they can, so that more of what they release is covered under a BSD license (see BSD grep, for example). It may be that Apple is just picking up some of these changes from FreeBSD and doing a little bit of housekeeping on their end. First, a nit pick: Samba doesn't exist on current releases of Mac OS X. They've rewritten their SMB stack and it's under a dual BSD/ASPL license: http://opensource.apple.com/source/smb/smb-552.3/ http://opensource.apple.com/source/smb/smb-552.3/ Second: bingo. Why should Apple relinquish any control over their platform? If their eyes, removing GPL code reduces risk to their platform. There's going to be a constant fear that GPL code could "contaminate" non-GPL code. Why bother? As you note, other BSD platforms are undertaking the same endeavor, so Apple's not alone and can support that effort. Which seems to be exactly what they're doing. They remove a perceived major risk to their products and continue helping the OSS community. Finally, again as you note, there are better ways to keep rarely used software up to date. (Rarely used by the majority of Apple's user base.) I bet Apple desperately wants to get out of the business of shipping updates to command-line-only software, just as they've gotten out of the business of shipping Flash and Java updates. Why should they exert significant effort to try and update software that's rarely used on their platform and is better kept up to date via other mechanisms. Apple can provide the base, and anyone who needs OSS libraries, utilities or apps not provided by that base can use something like Homebrew and much more easily stay up to date. And if Apple stops vending that software, systems like Homebrew are far less likely to be broken by Apple OS updates. Win-win.
jacobolus 15y ago
For what it’s worth, the guy who writes Rixstep.com is a vitriolic asshole who has been periodically bashing nice projects for incredibly lame reasons for a decade now, and who seems to bear unreasonable grudges and fixate on them. What he’s saying in this particular example might be legitimate, but he’s just not a credible source, in general.

by sc68cal 15y ago

fluidcruft 15y ago

> It's not like Apple were keeping this stuff updated Well, obviously as the major point of the article is that Apple clearly refuses to ship software covered by GPLv3, so you're getting the rapidly ancient, last GPLv2 versions. It's quite a rare exception for updated GNU software to be available under GPLv2--the FSF basically moved their entire code base from GPLv2+ to GPLv3+ when GPLv3 was released and that has cascading effects since GPLv2 and GPLv3 are incompatible. I was unaware of the sorry state of things on MacOS actually as I don't use Apple products, but it at least enlightened me about all the bash bashing we tend to see on HN.

_delirium 15y ago
Yeah, I recently realized why various bash examples I tried out don't work on OSX. I guess it's an obvious thing to check, but somehow it never occurred to me that OSX's bash would be five years old.
- Cieplak 15y ago
  Also worth noting, osx uses bsd versions of various utilities like grep and sed, instead of gnu counterparts Interesting sidenote: http://lists.freebsd.org/pipermail/freebsd-current/2010-August/019310.html http://lists.freebsd.org/pipermail/freebsd-current/2010-Augu...
- adsr 15y ago
  Some bash examples contains Linuxisms that is not UNIX-03 compliant which OS X is in full, might be that as well.
earl 15y ago
to upgrade bash on OS X: brew install bash then follow directions at [1] [1] http://concisionandconcinnity.blogspot.com/2009/03/upgrade-bash-to-40-in-mac-os-x.html http://concisionandconcinnity.blogspot.com/2009/03/upgrade-b...
- Quequau 15y ago
  I use MacPorts and "oh-my-Zsh"... but thinking about it, it should not be all that hard to update all of the outdated GNU stuff in Mac OS... but I don't think the system would actually use the updated stuff, so the security problems probably would still remain.
bouncing 15y ago
GPL2 and GPL3 are compatible. You just can't make GPL2 derivatives of GPL3 software.
- fluidcruft 15y ago
  No, they are not unfortunately. From the FAQ: "Is GPLv3 compatible with GPLv2? (#v2v3Compatibility) No. Some of the requirements in GPLv3, such as the requirement to provide Installation Information, do not exist in GPLv2. As a result, the licenses are not compatible: if you tried to combine code released under both these licenses, you would violate section 6 of GPLv2. However, if code is released under GPL “version 2 or later,” that is compatible with GPLv3 because GPLv3 is one of the options it permits." http://www.gnu.org/licenses/gpl-faq.html#v2v3Compatibility http://www.gnu.org/licenses/gpl-faq.html#v2v3Compatibility

Quequau 15y ago

I've been a Apple & FreeBSD user for decades and it really looks to me like Apple is coming up for a long cycle of public and embarrassing security failures because of this... Or perhaps I should say, I don't think Apple is going to either update the lagging GNU utilities to current or put for the effort to migrate to current BSD alternatives until they have a protracted public shaming which demonstrably impacts the bottom line of iOS sales. Which sort of reminds me of what MS went through before they started taking security more seriously. (I haven't used Windows in years, so I can't really comment on the state of MS security today). Which is a shame because there is a lot of opportunity in the eddies of GNU, BSD, and Darwin. We all could benefit from an Apple sponsored security focused FOSS code review / bug hunt / development effort. Sort of like what Google does only focused on Security.

X-Istence 15y ago
I don't think that is the case, there won't be a requirement for public shaming, Apple is already removing more and more GPL licensed tools each release cycle and it won't be long until they are using more up-to-date BSD licensed tools. Also, one thing I have noticed is that Apple has started reacting faster to security threats and is at least willing to acknowledge the researchers behind them in their updates, which is much better compared to what previously happened. Not only that but before Lion was released many security researchers received an advanced copy. The other thing is that almost all of the GPL utilities are command line utilities and are not shipped with iOS so even if there are vulnerabilities in them it is highly unlikely that there will be a target painted on iOS's back. I don't foresee that there will be any major impact on their iOS product line.
- Quequau 15y ago
  Actually what I was inferring is that between the rate of migration from older GNU tools to current BSD tools and the rate of response for security issues would combine to create a series of security failures in Mac OS. If that went on long enough and is publicized enough, it will effect iOS simply by guilt by association. Certainly I have also noticed a slight improvement on the way Apple handles security problems but I don't really think it's an adequate response. More importantly I have the general impression that long term Apple is moving away from Mac OS & workstations and towards iOS & devices. So them ignoring Mac OS problems or becoming slower to react on them would not really surprise me... at least until people started to view iOS in an equally negative light because of it. In any event, I honestly wish that Apple would maintain a larger presence in the FOSS community and put more effort into a more positive two way relationship.

ryannielsen 15y ago

"The Samba on Mac OS X (on Monday) had an exploitable remote root vulnerability in it...it hadn’t been updated since February 2005!" If anything, Apple removing GPL software creates a better situation, because fink/macports/homebrew will be available to pick up the slack and provide more timely updates. Plus, it seems like FreeBSD is trying to get rid of as much GNU stuff as they can, so that more of what they release is covered under a BSD license (see BSD grep, for example). It may be that Apple is just picking up some of these changes from FreeBSD and doing a little bit of housekeeping on their end. First, a nit pick: Samba doesn't exist on current releases of Mac OS X. They've rewritten their SMB stack and it's under a dual BSD/ASPL license: http://opensource.apple.com/source/smb/smb-552.3/ http://opensource.apple.com/source/smb/smb-552.3/ Second: bingo. Why should Apple relinquish any control over their platform? If their eyes, removing GPL code reduces risk to their platform. There's going to be a constant fear that GPL code could "contaminate" non-GPL code. Why bother? As you note, other BSD platforms are undertaking the same endeavor, so Apple's not alone and can support that effort. Which seems to be exactly what they're doing. They remove a perceived major risk to their products and continue helping the OSS community. Finally, again as you note, there are better ways to keep rarely used software up to date. (Rarely used by the majority of Apple's user base.) I bet Apple desperately wants to get out of the business of shipping updates to command-line-only software, just as they've gotten out of the business of shipping Flash and Java updates. Why should they exert significant effort to try and update software that's rarely used on their platform and is better kept up to date via other mechanisms. Apple can provide the base, and anyone who needs OSS libraries, utilities or apps not provided by that base can use something like Homebrew and much more easily stay up to date. And if Apple stops vending that software, systems like Homebrew are far less likely to be broken by Apple OS updates. Win-win.

jacobolus 15y ago

For what it’s worth, the guy who writes Rixstep.com is a vitriolic asshole who has been periodically bashing nice projects for incredibly lame reasons for a decade now, and who seems to bear unreasonable grudges and fixate on them. What he’s saying in this particular example might be legitimate, but he’s just not a credible source, in general.