5 ms·

This issue is an awesome demonstration of how bad closed ecosystems are. The open systems that are running on Linux (RedHat, ubuntu, etc) are patched and update

This issue is an awesome demonstration of how bad closed ecosystems are. The open systems that are running on Linux (RedHat, ubuntu, etc) are patched and updated. However, OSX which is also affected is still waiting. If I owned an Apple server I'd be screaming right now. Embedded devices with closed eco systems are also stuffed (we've got to moved to open router firmware like OpenWRT). Basically, you can carry on as normal if you use open source the way it was intended.

PinguTS 12y ago
There are many ways to argue this way or that way. I could argue, that there is a bug for over 20 years in open source and nobody discovered it? WTF? So Windows is better, because it does not has this bug in the first place? There is no right or wrong. Open Source is not better and not worse. Everything has its place and its purpose. Regarding those embedded device I can say, they don't use BASH. Because of size constraints they all use Busybox, which does not have this problem, like all those other Shells.
Osmium 12y ago
Devil's advocate: most OS X systems aren't running exposed services that could be exploited, and if you were running an OS X server you can always re-compile bash manually for something of this severity (and Homebrew/MacPorts make this even easier). That said, I do think it's ridiculous though how slow Apple is. It's absolutely crazy. I can only hope that Heartbleed and now this are causing some major internal reviews over there...
- shabble 12y ago
  Even though I've got MacPorts bash installed, it lives in /opt/local/bin, while the default one in /bin/{ba,}sh is the ancient apple 3.2 one. https://apple.stackexchange.com/questions/146849/#146851 https://apple.stackexchange.com/questions/146849/#146851 has a simple enough step-by-step guide to patching & recompiling the system version with the appropriate patches, if you've got XCode installed and are comfortable with that sort of thing. Agreed on the Apple security response time though. I reckon they have all their best guys fighting the IOS jailbreakers :P
  - ergzay 12y ago
    You should jump to using Homebrew. It's superior in most ways. I'd used MacPorts and Fink before Homebrew came about and I never much liked either. Homebrew is as simple as it can be and is really good at detecting conflicts which MacPorts and Fink were terrible at.
    - shabble 12y ago
      I've fought with both of them in the past, and ultimately went back to MacPorts when I last reinstalled. Homebrew was (at the time, maybe a year or so ago) missing a lot of things I wanted to use, and some packages broke for no obvious reason. I'm sure some of it was the result of my rather frankensteinien setup by that point, but I have no real desire to reinstall things again until I have to. MacPorts may be occasionally annoying, but at least it's usually in a way have come to understand. :)
acdha 12y ago
I don't want to defend Apple too much – at various points I spent many months hoping nobody else discovered a MITM exploit before they shipped the next OS release – but this is a near-complete non-issue for an OS X desktop user and even servers have fairly limited exposure. If you want to beat Apple up, a much better case was goto fail where they left all of the Mac users hanging for a long period of time after shipping the iOS patch and disclosing the vulnerability.
aroch 12y ago
How is OSX a closed system in this particular case? You can easily compile bash, with patches, and replace the system binary -- using the same code that's used to build those Debian/Redhat/whatever binary. Its all the same gnu code. What about all those EOLed distros that don't see most security updates? Being "Open" is a non-issue here.

PinguTS 12y ago

There are many ways to argue this way or that way. I could argue, that there is a bug for over 20 years in open source and nobody discovered it? WTF? So Windows is better, because it does not has this bug in the first place? There is no right or wrong. Open Source is not better and not worse. Everything has its place and its purpose. Regarding those embedded device I can say, they don't use BASH. Because of size constraints they all use Busybox, which does not have this problem, like all those other Shells.

Osmium 12y ago

Devil's advocate: most OS X systems aren't running exposed services that could be exploited, and if you were running an OS X server you can always re-compile bash manually for something of this severity (and Homebrew/MacPorts make this even easier). That said, I do think it's ridiculous though how slow Apple is. It's absolutely crazy. I can only hope that Heartbleed and now this are causing some major internal reviews over there...

shabble 12y ago
Even though I've got MacPorts bash installed, it lives in /opt/local/bin, while the default one in /bin/{ba,}sh is the ancient apple 3.2 one. https://apple.stackexchange.com/questions/146849/#146851 https://apple.stackexchange.com/questions/146849/#146851 has a simple enough step-by-step guide to patching & recompiling the system version with the appropriate patches, if you've got XCode installed and are comfortable with that sort of thing. Agreed on the Apple security response time though. I reckon they have all their best guys fighting the IOS jailbreakers :P
- ergzay 12y ago
  You should jump to using Homebrew. It's superior in most ways. I'd used MacPorts and Fink before Homebrew came about and I never much liked either. Homebrew is as simple as it can be and is really good at detecting conflicts which MacPorts and Fink were terrible at.
  - shabble 12y ago
    I've fought with both of them in the past, and ultimately went back to MacPorts when I last reinstalled. Homebrew was (at the time, maybe a year or so ago) missing a lot of things I wanted to use, and some packages broke for no obvious reason. I'm sure some of it was the result of my rather frankensteinien setup by that point, but I have no real desire to reinstall things again until I have to. MacPorts may be occasionally annoying, but at least it's usually in a way have come to understand. :)

acdha 12y ago

I don't want to defend Apple too much – at various points I spent many months hoping nobody else discovered a MITM exploit before they shipped the next OS release – but this is a near-complete non-issue for an OS X desktop user and even servers have fairly limited exposure. If you want to beat Apple up, a much better case was goto fail where they left all of the Mac users hanging for a long period of time after shipping the iOS patch and disclosing the vulnerability.

aroch 12y ago

How is OSX a closed system in this particular case? You can easily compile bash, with patches, and replace the system binary -- using the same code that's used to build those Debian/Redhat/whatever binary. Its all the same gnu code. What about all those EOLed distros that don't see most security updates? Being "Open" is a non-issue here.