What do you get when you tell everyone that “MacOS and desktop computing are as important to our company as ever” when in reality you barely give a crap about it.
AppStore Preferences can be unlocked by a local admin with any bogus password
61–70 of 190 posts
Re: AppStore Preferences can be unlocked by a local admin with any bogus password
#62This does not help at all for the drubbing that macOS High Sierra has been getting recently. Long term OS X users have been waiting for a Snow Leopard like release, but it seems like Apple isn’t taking as much care as required on security and stability on the Mac. Something has to give — either Apple’s organizational structure needs a change or Apple needs to abandon certain things completely instead of releasing sub…
> it seems like Apple isn’t taking as much care as required on security and stability on the Mac It's even worse than that according to[0] Mark Gurman[1]: In another sign that the company has prioritized the iPhone, Apple re-organized its software engineering department so there's no longer a dedicated Mac operating system team. There is now just one team, and most of the engineers are iOS first, giving the people wo…
Under a different lens, that implies that previously iOS-only engineers now must also become familiar with the macOS codebase, and so more able to contribute to it. Given the large number of those engineers compared to the previous size of the macOS team, this may help more than hurt macOS (as long as you assume the engineering teams are of equivalent quality.)
Re: AppStore Preferences can be unlocked by a local admin with any bogus password
#63This does not help at all for the drubbing that macOS High Sierra has been getting recently. Long term OS X users have been waiting for a Snow Leopard like release, but it seems like Apple isn’t taking as much care as required on security and stability on the Mac. Something has to give — either Apple’s organizational structure needs a change or Apple needs to abandon certain things completely instead of releasing sub…
The thing that I don't understand, as a developer, is how these types of bugs even make it in to these releases. Was the "lock" functionality in System Preferences changed at all in any meaningful way for the App Store panel. It doesn't seem like anything about that functionality is sufficiently different so how did this break? Did they bypass the check in order to work on the panel and forget to re-enable it or some…
> Was the "lock" functionality in System Preferences changed at all in any meaningful way for the App Store panel.
I don't know about local authentication, but iCloud account authentication was changed a couple of times in recent macOS versions (from 1FA to optional pseudo-2FA to real 2FA.) I know that parts of the App Store prefpane (e.g. "remember password after purchases") require the iCloud auth flow. That might have affected the local auth flow somehow.
Re: AppStore Preferences can be unlocked by a local admin with any bogus password
#64This does not help at all for the drubbing that macOS High Sierra has been getting recently. Long term OS X users have been waiting for a Snow Leopard like release, but it seems like Apple isn’t taking as much care as required on security and stability on the Mac. Something has to give — either Apple’s organizational structure needs a change or Apple needs to abandon certain things completely instead of releasing sub…
The thing that I don't understand, as a developer, is how these types of bugs even make it in to these releases. Was the "lock" functionality in System Preferences changed at all in any meaningful way for the App Store panel. It doesn't seem like anything about that functionality is sufficiently different so how did this break? Did they bypass the check in order to work on the panel and forget to re-enable it or some…
Interesting, I do have the lock in Sierra 10.12.6 on my MBP.
Re: AppStore Preferences can be unlocked by a local admin with any bogus password
#65What do you get when you tell everyone that “MacOS and desktop computing are as important to our company as ever” when in reality you barely give a crap about it.
a cookie.
And a raise.
Re: AppStore Preferences can be unlocked by a local admin with any bogus password
#66If an Apple developer is reading this, your team should consider system-wide input testing. It'd be worth the developer time. Who knows how things can break if long, crazy strings are inserted.
Re: AppStore Preferences can be unlocked by a local admin with any bogus password
#67Earlier quoted context omitted.
> it seems like Apple isn’t taking as much care as required on security and stability on the Mac It's even worse than that according to[0] Mark Gurman[1]: In another sign that the company has prioritized the iPhone, Apple re-organized its software engineering department so there's no longer a dedicated Mac operating system team. There is now just one team, and most of the engineers are iOS first, giving the people wo…
Under a different lens, that implies that previously iOS-only engineers now must also become familiar with the macOS codebase, and so more able to contribute to it. Given the large number of those engineers compared to the previous size of the macOS team, this may help more than hurt macOS (as long as you assume the engineering teams are of equivalent quality.)
While it's tolerable to have engineers jumping between projects in, say, web frontend, I'd imagine that operating system security work is incredibly sensitive to programmer context-switching - you can't dive deep into the security model of a desktop system in your 20% time when you're working with an entirely different system (with a different CPU architecture) in your 80% time. Of course there will be some specialization on this team, but it doesn't seem to be nearly enough. Unfortunately, it will take something like a botched release (not just a security problem) and heads rolling to reverse this trend.
Re: AppStore Preferences can be unlocked by a local admin with any bogus password
#68Earlier quoted context omitted.
The thing that I don't understand, as a developer, is how these types of bugs even make it in to these releases. Was the "lock" functionality in System Preferences changed at all in any meaningful way for the App Store panel. It doesn't seem like anything about that functionality is sufficiently different so how did this break? Did they bypass the check in order to work on the panel and forget to re-enable it or some…
Maybe Apple has embraced one of these "Agile" methodologies where you basically eliminate your QA group in the promise that developer created unit and integration tests can cover the quality gap. QA and dev approach software with different mindsets, and I've noticed in Agile projects where QA is mostly or entirely missing, there is a skill gap. Edit: People - I'm not trying to be flippant. I really have seen a decrea…
This seems like a legitimate point. This is true. OS development is typically too large to run through a single monolithic team.
It is possible that the team in this area is applying a methodology that has different QA best practices. It could be a poorly applied Agile methodology at fault here.
Although it's impossible to know without more information.
Re: AppStore Preferences can be unlocked by a local admin with any bogus password
#69This does not help at all for the drubbing that macOS High Sierra has been getting recently. Long term OS X users have been waiting for a Snow Leopard like release, but it seems like Apple isn’t taking as much care as required on security and stability on the Mac. Something has to give — either Apple’s organizational structure needs a change or Apple needs to abandon certain things completely instead of releasing sub…
> it seems like Apple isn’t taking as much care as required on security and stability on the Mac It's even worse than that according to[0] Mark Gurman[1]: In another sign that the company has prioritized the iPhone, Apple re-organized its software engineering department so there's no longer a dedicated Mac operating system team. There is now just one team, and most of the engineers are iOS first, giving the people wo…
I heard rumors that Apple is moving towards one unified App development process for both macOS and iOS
Is it possible that this is related to that?
Re: AppStore Preferences can be unlocked by a local admin with any bogus password
#70Earlier quoted context omitted.
Most OS's require admin rights to change the date/time because of the ability to mess with things like kerberos ticket TTL's, and other security issues.
I can understand why it would be there for date & time. I guess I more don't understand why it's not there for networking - you can add a proxy in (or even a whole new network adapter) for all network traffic without admin rights!?
I don't think "sharing-only" accounts can; only regular accounts. Keep in mind that a non-"sharing only" account is an account with a special privilege: it can log in through the local-framebuffer LoginWindow. This translates to an assumption that the computer is–at least temporarily—in the physical possession of said user. They're at least sitting down in front of it; they may have been leased it by their employer.
The global prefs that can be reconfigured by "regular users" (i.e. non-"sharing only" users) are precisely those prefs required to keep the system in a working state if you're physically in possession of it and doing the things that possession of a computer implies. For example, you can move a computer you physically possess to a new location–at which point the same wireless networks won't be available, and maybe you won't be able to get online without a proxy. So, in order to ensure that just going places doesn't necessitate a call to corporate IT, the default† is to let any non-"sharing only" user configure networking.
† "Default" because these prefs can be locked down using a configuration profile (like a windows Group Policy Object) by corporate IT if they need a computer specifically secured against these changes, such as a public-use kiosk.