undefined | Better HN

0 pointsaquova8y ago0 comments

I think there's a middle ground to this. Submit your report to Apple security, allow them time to develop a patch, and then in a week go ahead and tweet at the big media outlets about it.

I'm a die-hard Apple user myself, but I agree that the long list of severe bugs in High Sierra is absurd, and a big public backlash might be enough to kick them into gear. On the other hand, I, a university student with next to no understanding of computer security, can simply walk onto campus, sit down at a Mac, and within seconds have complete access to the computer. It's ridiculous, it's horrendous that it shipped like this, but it's not something that needed to get out, especially something so easy to utilize.

0 comments

kristofferR8y ago

The fact that you as the ordinary student can become root and create a lot of damage so easily is the only reason the public will care.

Us geeks have been complaining about the horrible QA in macOS for years, yet nothing has been done. The fact that this is so simple to do will probably/hopefully get ordinary people to start talking about it too ("Hey, have you heard that you can hack Macs without a password? Very insecure"), which would force Apple to improve.

openasocket8y ago

It sounds to me like you're arguing that full disclosure in this situation could lead to a worse outcome for users in the short term, but the negative publicity will force Apple to improve their security posture, leading to a better outcome for users in the long term. (Please let me know if I'm miss-characterizing your argument)

I think you have to be very careful about that line of argument. It's a single vulnerability researcher making a unilateral decision about the short term and long term security of an entire user base, based entirely on personal judgement. I personally think the researcher should make the decision that best protects users from that specific vulnerability. Making long-term changes to a company's QA should come second.

AlexandrB8y ago

> I personally think the researcher should make the decision that best protects users from that specific vulnerability.

I find it odd that you're putting the responsibility of making decisions about how to protect Apple's users on an unaffiliated third party.

Apple has a multi-hundred-billion dollar war chest and, if they wanted to, could afford to make macOS the most secure operating system on the market. The fact that they don't is their own choice and a reflection of their priorities, not some act of God or a natural disaster. Putting the onus for cleaning up the mess in the most "responsible" way possible on third parties with a fraction of Apple's resources is being too kind to Apple.

1 more reply

ridgeguy8y ago

I think only economic consequences would cause Apple to up its QA game. Like decreased sales or lawsuits with good prospects of winning serious money.

Unfortunately, I don't believe those will happen.

brianpgordon8y ago

Maybe it's crazy that we give people physical access to machines and expect them not to be able to obtain root.

I don't have any experience with enterprise-grade IT, but it seems like shared computers should be thin clients or at least use UEFI to securely boot an image over the network and not keep anything sensitive locally.

If you give someone physical access to a box, they will be able to own it.

jzl8y ago

This is actually how the public workstations in MIT computer clusters have always worked. The root password is public to anyone with a legit account, but access to it gets you almost nothing because all services including the network filesystem are kerberized, and machines are really good at wiping all local changes upon logout. Some more details here: https://www.quora.com/Are-computer-networks-in-MIT-harder-to...

ekianjo8y ago

yes. physical access should never be considered secure.

ekianjo8y ago

> On the other hand, I, a university student with next to no understanding of computer security, can simply walk onto campus, sit down at a Mac, and within seconds have complete access to the computer.

its educational for the end user. You cannot trust Apple. Good reminder there are other OS available out there.

j / k navigate · click thread line to collapse

0 comments

kristofferR8y ago

The fact that you as the ordinary student can become root and create a lot of damage so easily is the only reason the public will care.

openasocket8y ago

AlexandrB8y ago

> I personally think the researcher should make the decision that best protects users from that specific vulnerability.

I find it odd that you're putting the responsibility of making decisions about how to protect Apple's users on an unaffiliated third party.

1 more reply

ridgeguy8y ago

I think only economic consequences would cause Apple to up its QA game. Like decreased sales or lawsuits with good prospects of winning serious money.

Unfortunately, I don't believe those will happen.

brianpgordon8y ago

Maybe it's crazy that we give people physical access to machines and expect them not to be able to obtain root.

If you give someone physical access to a box, they will be able to own it.

jzl8y ago

ekianjo8y ago

yes. physical access should never be considered secure.

ekianjo8y ago

its educational for the end user. You cannot trust Apple. Good reminder there are other OS available out there.

j / k navigate · click thread line to collapse