Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AppStore Preferences can be unlocked by a local admin with any bogus password

openradar.appspot.com

Post reply on HN
Print view View original

71–80 of 190 posts

Re: AppStore Preferences can be unlocked by a local admin with any bogus password

#71

Post by whhwer823 »

newscracker wrote: post #13

This does not help at all for the drubbing that macOS High Sierra has been getting recently. Long term OS X users have been waiting for a Snow Leopard like release, but it seems like Apple isn’t taking as much care as required on security and stability on the Mac. Something has to give — either Apple’s organizational structure needs a change or Apple needs to abandon certain things completely instead of releasing sub…

Prepare to be disappointed

They're unifying their SDKs to produce one app type.

The Mac line is on its way out for content consumption devices, and UI's that offload the real work to services: iPhone/iPad

That way management can keep tabs on everything.

This is Toyota manufacturing taken to its extremes. We're just dumb machine operators, only allowed a partial view into how things work.

Re: AppStore Preferences can be unlocked by a local admin with any bogus password

#72

Post by hanklazard »

newscracker wrote: post #13

This does not help at all for the drubbing that macOS High Sierra has been getting recently. Long term OS X users have been waiting for a Snow Leopard like release, but it seems like Apple isn’t taking as much care as required on security and stability on the Mac. Something has to give — either Apple’s organizational structure needs a change or Apple needs to abandon certain things completely instead of releasing sub…

I'm also a long-time Mac user, but I've really had about enough of this. Between the seemingly constant stream of security problems and the dumbing down of OSX (MacOS, whatever), I'm not sure I'm willing to pay a premium for this product anymore.

At the same time the Apple seems to be dropping the ball, some of the more noob-friendly linux distros are starting to look very attractive. And while Apple still seems to have the best hardware overall, a Lenovo Carbon X1 seems like a very decent option. I'm by no means a "pro" user (I have a decent understanding of computers, can get around on linux command line, some basic experiences in programming, etc), but I'm probably going to start making the switch, at least for my laptop.

Slightly off topic, but one of the only software issues holding me back previously was 1Password compatibility on linux, but apparently, it is now available (1). Anyone tried it? It's not a stand-alone application, but I'm probably okay with that.

(1) https://discussions.agilebits.com/discussion/79940/a-present...

Re: AppStore Preferences can be unlocked by a local admin with any bogus password

#73

Post by raverbashing »

dkonofalski wrote: post #46
aetherson wrote: post #18

Earlier quoted context omitted.

For certain features, they want you to reconfirm that the user presently at the keyboard is the real admin at the moment that you do it. This prevents a situation where the actual admin logs in, their attention is taken away from the computer, and someone sits at their chair and does awful things with the computer.

What "awful" things could be done exactly in the App Store panel?

Disabling password requirements for app purchases

Disabling/enabling automatic updates

Re: AppStore Preferences can be unlocked by a local admin with any bogus password

#74

Post by teilo »

spike021 wrote: post #52
dcx wrote: post #8

I'm on 10.12.6 and a local admin account, and it only unlocks to my actual password. That might mean it's a recently-introduced bug (assuming someone else can reproduce my result).

Same here.

I reproduced it in 10.13.2 on the first try.

Re: AppStore Preferences can be unlocked by a local admin with any bogus password

#75

Post by Asmod4n »

newscracker wrote: post #13

This does not help at all for the drubbing that macOS High Sierra has been getting recently. Long term OS X users have been waiting for a Snow Leopard like release, but it seems like Apple isn’t taking as much care as required on security and stability on the Mac. Something has to give — either Apple’s organizational structure needs a change or Apple needs to abandon certain things completely instead of releasing sub…

Snow Leopard was only as good as you remember at its final release, two years later.

Re: AppStore Preferences can be unlocked by a local admin with any bogus password

#76

Post by Someone1234 »

dkonofalski wrote: post #46
aetherson wrote: post #18

Earlier quoted context omitted.

For certain features, they want you to reconfirm that the user presently at the keyboard is the real admin at the moment that you do it. This prevents a situation where the actual admin logs in, their attention is taken away from the computer, and someone sits at their chair and does awful things with the computer.

What "awful" things could be done exactly in the App Store panel?

If they have "'Always Require' Password for Purchase" enabled, you could disable that and buy apps from the app store without a password.

For example you could let your kid use your Mac, but you don't want them spending your money via your app-store linked credit card. If they have access to the App Store Preferences panel they can disable the requirement and do so.

Re: AppStore Preferences can be unlocked by a local admin with any bogus password

#77

Post by whhwer823 »

nolok wrote: post #60
jezfromfuture wrote: post #34

Earlier quoted context omitted.

Snow leopard wasn’t all that till it got a few updates either

Didn't use OSX back then, but I think there is a good distance between "not all that" and the security fiasco going on with High Sierra.

Security fiascos that most of the time, required one have physical access to the machine in many cases (discounting the recent discovery of Intel bugs). In which case you're screwed anyway.

Remember Windows track record as a Swiss cheese POS? They took the complaints, did work to better monitor for issues, now it's a privacy invasion!

And how you could basically crack a Mac too, but no one noticed because they weren't as ubiquitous?

Selective memory is thing in IT communities. Forgetting that forehead smacking security issues have always been here.

Put a Windows XP box online pre-sp1 and instantly get hit with RPC attacks.

'Net security only became a concern for companies in the last decade. And they're still terrible. There are still boxes of disks and tapes being stolen, along with Intel-like bugs we'll never find.

But yeah, I'm sure soon we'll figure these all out. Any day now.

Just accept it's lowest common denominator engineering and chill.

Re: AppStore Preferences can be unlocked by a local admin with any bogus password

#78

Post by mbesto »

Asmod4n wrote: post #75
newscracker wrote: post #13

This does not help at all for the drubbing that macOS High Sierra has been getting recently. Long term OS X users have been waiting for a Snow Leopard like release, but it seems like Apple isn’t taking as much care as required on security and stability on the Mac. Something has to give — either Apple’s organizational structure needs a change or Apple needs to abandon certain things completely instead of releasing sub…

Snow Leopard was only as good as you remember at its final release, two years later.

The parent's point is that SL was almost explicitly a performance/optimization gain and not a feature release. It literally give you ~8GB (IIRC) of extra disk space for just installing it.

I would fork over money to Apple for them to do another SL-like OS release.

Are you listening Apple?!

Re: AppStore Preferences can be unlocked by a local admin with any bogus password

#79

Post by roryisok »

newscracker wrote: post #13

This does not help at all for the drubbing that macOS High Sierra has been getting recently. Long term OS X users have been waiting for a Snow Leopard like release, but it seems like Apple isn’t taking as much care as required on security and stability on the Mac. Something has to give — either Apple’s organizational structure needs a change or Apple needs to abandon certain things completely instead of releasing sub…

> Something has to give

I disagree, I think Apple can continue to release sub standard products for macos with little or no consequence as long as people are willing to hand them $1000 for an iPhone.

Re: AppStore Preferences can be unlocked by a local admin with any bogus password

#80

Post by eeks »

hanklazard wrote: post #72
newscracker wrote: post #13

This does not help at all for the drubbing that macOS High Sierra has been getting recently. Long term OS X users have been waiting for a Snow Leopard like release, but it seems like Apple isn’t taking as much care as required on security and stability on the Mac. Something has to give — either Apple’s organizational structure needs a change or Apple needs to abandon certain things completely instead of releasing sub…

I'm also a long-time Mac user, but I've really had about enough of this. Between the seemingly constant stream of security problems and the dumbing down of OSX (MacOS, whatever), I'm not sure I'm willing to pay a premium for this product anymore. At the same time the Apple seems to be dropping the ball, some of the more noob-friendly linux distros are starting to look very attractive. And while Apple still seems to h…

> Slightly off topic, but one of the only software issues holding me back previously was 1Password compatibility on linux, but apparently, it is now available (1).

Well, it's a Chrome extension. For some people (including yours truly), it's a deal breaker. I would suggest `password-store`[0] if you don't need to share your vault with anyone.

[0] https://www.passwordstore.org

Post reply on HN