4 ms·

What about older OSes? Are they not vulnerable or simply ignored?

treesknees 3y ago
Apple only releases Rapid Security Response updates for the latest versions of its operating systems [1]. So any devices running iOS 16.4.X or MacOS 13.3.X won't see one, and anything before that didn't support Rapid Security Response updates. Unfortunately there's not enough information available to know if older releases are vulnerable. [1] https://support.apple.com/en-us/HT201224 https://support.apple.com/en-us/HT201224
- vaxman 3y ago
  > Unfortunately there's not enough information available to know if older releases are vulnerable. Assume YES.
vaxman 3y ago
Hell, what about newer OSes ...like iOS 17 Beta? visionOS 1 Beta?
- gumby 3y ago
  Betas don't need a rapid response; people running beta can wait. Though for all you know this bug doesn't even exist in the newer versions. Or the mitigation was already in the beta but this rapid response required an extra day for testing as it is being shipped to users.
  - jifncidbdi 3y ago
    people will run whatever. recently the pixels had a remote exploit just by being connected to a 4g network. we got two victims in our group in the 3wk google took to patch (it was the first late security update on the same time)... and we did warn everyone to turn radio off (or limit to 3g if out of the us)... nobody cares and they just use the device thinking they won't be a target.
  - vaxman 3y ago
    That's not how it works. The peeps working on the new stuff ARE WORKING ON THE NEW STUFF. This would fall under backports (er, forward ports?)
    - gumby 3y ago
      They’ll just get it in the next beta
      - vaxman 3y ago
        Yep. It’s a good reason to stop using your beta device until the update tho.
Rolcol 3y ago
Apple also released Safari 16.5.2 for Big Sur and Monterey to address this: https://support.apple.com/en-us/HT213826 https://support.apple.com/en-us/HT213826
jiveturkey 3y ago
https://arstechnica.com/gadgets/2022/10/apple-clarifies-security-update-policy-only-the-latest-oses-are-fully-patched/ https://arstechnica.com/gadgets/2022/10/apple-clarifies-secu... I remember just after this announcement was the first super-critical update for ventura. It was about 31 days before older OS versions got the patch, even though they were identified as vulnerable at the time of the ventura update. :(

Apple only releases Rapid Security Response updates for the latest versions of its operating systems [1]. So any devices running iOS 16.4.X or MacOS 13.3.X won't see one, and anything before that didn't support Rapid Security Response updates. Unfortunately there's not enough information available to know if older releases are vulnerable. [1] https://support.apple.com/en-us/HT201224 https://support.apple.com/en-us/HT201224

vaxman 3y ago
> Unfortunately there's not enough information available to know if older releases are vulnerable. Assume YES.

vaxman 3y ago

Hell, what about newer OSes ...like iOS 17 Beta? visionOS 1 Beta?

gumby 3y ago
Betas don't need a rapid response; people running beta can wait. Though for all you know this bug doesn't even exist in the newer versions. Or the mitigation was already in the beta but this rapid response required an extra day for testing as it is being shipped to users.
- jifncidbdi 3y ago
  people will run whatever. recently the pixels had a remote exploit just by being connected to a 4g network. we got two victims in our group in the 3wk google took to patch (it was the first late security update on the same time)... and we did warn everyone to turn radio off (or limit to 3g if out of the us)... nobody cares and they just use the device thinking they won't be a target.
- vaxman 3y ago
  That's not how it works. The peeps working on the new stuff ARE WORKING ON THE NEW STUFF. This would fall under backports (er, forward ports?)
  - gumby 3y ago
    They’ll just get it in the next beta
    - vaxman 3y ago
      Yep. It’s a good reason to stop using your beta device until the update tho.

Rolcol 3y ago

Apple also released Safari 16.5.2 for Big Sur and Monterey to address this: https://support.apple.com/en-us/HT213826 https://support.apple.com/en-us/HT213826

jiveturkey 3y ago

https://arstechnica.com/gadgets/2022/10/apple-clarifies-security-update-policy-only-the-latest-oses-are-fully-patched/ https://arstechnica.com/gadgets/2022/10/apple-clarifies-secu... I remember just after this announcement was the first super-critical update for ventura. It was about 31 days before older OS versions got the patch, even though they were identified as vulnerable at the time of the ventura update. :(