Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS lock screen: “I just sent my session pass to my whole team”

twitter.com

Post reply on HN
Print view View original

231–240 of 276 posts

Re: macOS lock screen: “I just sent my session pass to my whole team”

#231

Post by thomastjeffery »

dwyerm wrote: post #42
jerf wrote: post #30

Lock screens are harder than they first appear: www.jwz.org/xscreensaver/toolkits.html (Which, you'll note, mentions this exact failure case in the "Transfer Grabs?" section.) There's some X-specific stuff in there, but there's a lot of general issues in there, and with just a bit of imagination most or all of the X-specific issues can be seen as general issues as well.

Fair warning: Jamie doesn't appreciate the discourse this crowd brings to his site. Visit this URL without a referrer for the best results.

Now that the link has been changed, I have no idea what you are talking about.

Re: macOS lock screen: “I just sent my session pass to my whole team”

#232

Post by valuearb »

ghostly_s wrote: post #135
dawnerd wrote: post #79

Earlier quoted context omitted.

Same problems as you, but I disagree on the touchbar. It’s one of the better things Apple has added recently. But holy hell do they need to work on their external monitor support. Yesterday I had one of my monitors randomly go black for a second. I’ve had audio over usbc just not show up anymore and it refusing to see my gigabit ethernet when waking up unless I unplug the actual ethernet cable. Simply amazing this pa…

We have many staff with MBP + dual external displays and it's always been the least reliable aspect of the platform. From reading between the lines in the unusually arcane history of support docs on the topic, I've surmised their stance can be summed up as "it might work!" Which of course runs counter to the Apple It Just Works ideal, so they can never come out and admit as such. They've gone to great lengths to sque…

I use my MBP with 4 different external monitors (all different types, Apple, Samsung, Acer and Dell), two at a time, and it almost always works. Once in a blue moon something glitchy happens, not sure if that's reasonable performance or extraordinary performance given I haven't seen any other platform do as well.

Re: macOS lock screen: “I just sent my session pass to my whole team”

#233

Post by will_hughes »

CodeWriter23 wrote: post #214
daveFNbuck wrote: post #108

Earlier quoted context omitted.

Responsible disclosure is about preventing the bug from being exploited before it can be fixed. Knowing about this bug doesn't help me compromise someone else, but it does help me avoid getting compromised.

So, security through obscurity. No thanks. I'd rather know about the exploit ASAP so I can implement a workaround, rather than wait months for the vendor to get off their ass while my systems are getting hacked by the hundreds if not thousands of hackers that have 0-day knowledge. Calling what you describe as "Responsible" is intellectually dishonest.

Perhaps you can write a patch or mitigate effects of (say) an OpenSSL bug. I can't. Certainly not for the myriad of devices that embed well known libraries in firmware images that I don't get to modify myself.

I'd much rather that those things which are remotely exploitable across millions of devices to be kept quite for a small period of time (30-90 days depending on the complexity of the fix required) so that I can get patches from our vendors and schedule an update at the first available opportunity.

You might call it security through obscurity, I call it keeping shit from burning down.

Re: macOS lock screen: “I just sent my session pass to my whole team”

#234

Post by yeukhon »

eridius wrote: post #180
yeukhon wrote: post #118

Earlier quoted context omitted.

> Oh, wow - I've reported this problem along with na example exploit to Apple about 6-7 years ago Any proofs? Perhaps you can demand a bounty payout or sue them ignoring!

You can't demand a bug bounty payout, especially because Apple didn't have a bug bounty back then (and their bug bounty today is invite-only). Also, if you read the rest of the comment, Apple didn't ignore it. They fixed it.

I did read the rest of the comment. So I am asking if someone is either making this up or if not it's important to shame Apple for its secrecy. That's my view on responsible disclosure; either ack someone's hard work or let every bug free in the wild. What's the point when your work isn't being acked?

Re: macOS lock screen: “I just sent my session pass to my whole team”

#235

Post by hashbig »

AlexandrB wrote: post #211
hashbig wrote: post #191

Earlier quoted context omitted.

Wouldn't be surprised if it was intentional. Apple is known for planned obsolescence for their products, especially iPhones.

I hear this line a lot and yet iPhones get the latest iOS updates for many years after release while many Android phone are lucky to get 1 year of updates.

I would be much happier if Apple didn't "force" me to update my iPad with a pop up message every day. It was running smooth like butter, even with an older version of iOS.

Re: macOS lock screen: “I just sent my session pass to my whole team”

#236

Post by eridius »

yeukhon wrote: post #234
eridius wrote: post #180

Earlier quoted context omitted.

You can't demand a bug bounty payout, especially because Apple didn't have a bug bounty back then (and their bug bounty today is invite-only). Also, if you read the rest of the comment, Apple didn't ignore it. They fixed it.

I did read the rest of the comment. So I am asking if someone is either making this up or if not it's important to shame Apple for its secrecy. That's my view on responsible disclosure; either ack someone's hard work or let every bug free in the wild. What's the point when your work isn't being acked?

> What's the point when your work isn't being acked?

To get the bugs fixed?

Also, we don't know why they didn't get recognition. The simplest answer is someone else may have reported it first. But it doesn't really matter. And I really don't see how "secrecy" comes into play here.

Re: macOS lock screen: “I just sent my session pass to my whole team”

#237

Post by cuckcuckspruce »

gaius wrote: post #123
username223 wrote: post #105

Earlier quoted context omitted.

No -- I don't know him personally -- but I would guess that he thinks it's a pile of amoral greed-heads and ignorant children.

amoral greed-heads and ignorant children. Basically HN is him when he worked for Netscape and he doesn't like the reminder...

No, because HN is the people he worked for - the people who use him winning the startup lottery to explain away all the losers of that lottery and keep feeding young, impressionable people to the startup destruction machine.

Re: macOS lock screen: “I just sent my session pass to my whole team”

#238

Post by pfranz »

thomastjeffery wrote: post #228
pfranz wrote: post #202

Earlier quoted context omitted.

In addition to the many xscreensaver bugs over the years that the sibling post mentioned, last year there was a systemd root escalation exploit that was the same class of programming error as Apple's bug that enabled the root account with an empty password. From my understanding, in both cases they misinterpreted the return code's magic number (-1) as something it wasn't. Also, Linus' Law has some doubters. Things li…

> isn't immune Why all-or-nothing? The fact is that free software has transparency as one of its advantages. When software is closed-source, its users must rely on the developers to maintain that software.

I completely agree it is an advantage and I'm very happy there are options that are mostly Open Source (I say mostly because I'm not a fan of binary drivers, which are often a necessity for decent performance or features).

> Why all-or-nothin?

The parent was citing the existence of a few specific bugs in macOS and Open Source as an alternative (implying it wasn't vulnerable). I really think the "given enough eyeballs, all bugs are shallow" is something Open Source advocates take too much comfort in. The idea does have merit, but there needs to be more study/context to how it plays out in real life.

Another example where this idea fails; there are credible suspicions that the NSA has influenced encryption standards introducing backdoors or known flaws even though the algorithms themselves are publicly known and freely available as well as the implementations.

Re: macOS lock screen: “I just sent my session pass to my whole team”

#239

Post by rdtsc »

gonational wrote: post #63

With no disrespect to the developers at Apple, et al, each one of these problems that goes viral before reaching “proper” channels is a well-deserved slap in the face of these behemoth organizations. Perhaps, if the entire tech community regards Apple as a joke, they will start paying attention. “Responsible disclosure” is great stuff for creating a culture of free outsourcing of tech companies’ most imporant feature…

> “Responsible disclosure” is great stuff for creating a culture of free outsourcing of tech companies’ most imporant feature (security) to the same people that paid those companies thousands of dollars for that privilege.

Also "Responsible disclosure" means absolute nothing to most people who are not security researchers. They don't know about it, even if there is a bounty and they could make a decent profit, they have no idea what those things are. They notice they can get root access or the focus sends their password to Slack and they'll tweet about it.

Re: macOS lock screen: “I just sent my session pass to my whole team”

#240

Post by rdtsc »

daveFNbuck wrote: post #108
gonational wrote: post #63

With no disrespect to the developers at Apple, et al, each one of these problems that goes viral before reaching “proper” channels is a well-deserved slap in the face of these behemoth organizations. Perhaps, if the entire tech community regards Apple as a joke, they will start paying attention. “Responsible disclosure” is great stuff for creating a culture of free outsourcing of tech companies’ most imporant feature…

Responsible disclosure is about preventing the bug from being exploited before it can be fixed. Knowing about this bug doesn't help me compromise someone else, but it does help me avoid getting compromised.

But these bugs the kind that anyone could stumble upon, and if they are not security researches their first instinct is to let everyone know about a crazy thing they found. I can't really blame them.

If companies want more responsible disclosure they should introduce harder to find bugs - sneaky edge cases in memory allocation sequences, stuff you'd have to pore over a disassembler for weeks, or slightly weakened PRNGs that would take some serious knowledge of finite fields to discover :-)

Post reply on HN