Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AppStore Preferences can be unlocked by a local admin with any bogus password

openradar.appspot.com

Post reply on HN
Print view View original

81–90 of 190 posts

Re: AppStore Preferences can be unlocked by a local admin with any bogus password

#81

Post by FabHK »

mbesto wrote: post #78
Asmod4n wrote: post #75

Earlier quoted context omitted.

Snow Leopard was only as good as you remember at its final release, two years later.

The parent's point is that SL was almost explicitly a performance/optimization gain and not a feature release. It literally give you ~8GB (IIRC) of extra disk space for just installing it. I would fork over money to Apple for them to do another SL-like OS release. Are you listening Apple?!

Wasn't High Sierra supposed to be the same? Lots of improvements under the hood, few if any visible new features?

Re: AppStore Preferences can be unlocked by a local admin with any bogus password

#82

Post by derefr »

btown wrote: post #67
derefr wrote: post #62

Earlier quoted context omitted.

Under a different lens, that implies that previously iOS-only engineers now must also become familiar with the macOS codebase, and so more able to contribute to it. Given the large number of those engineers compared to the previous size of the macOS team, this may help more than hurt macOS (as long as you assume the engineering teams are of equivalent quality.)

While it's tolerable to have engineers jumping between projects in, say, web frontend, I'd imagine that operating system security work is incredibly sensitive to programmer context-switching - you can't dive deep into the security model of a desktop system in your 20% time when you're working with an entirely different system (with a different CPU architecture) in your 80% time. Of course there will be some specializ…

Most of the codebases of both iOS and macOS are fundamentally the same kind of (low-level but architecture-independent C and Objective-C) code, and encouraging team unification will make that even more true—if the same people are working on both AppKit and UIKit, for example, it's a no-brainer to unify them rather than maintaining that duplication.

The exception is the kernels and drivers of each OS, which have to consider things like architecture, but I would expect that it'll still be the same individual engineers working on these who always have, no matter what their team structure looks like now. Whether or not Apple has a formal "macOS kernel team" or "iOS kernel team", those groups definitely exist and have rather static membership.

(In fact, one main benefit you might see from this is that Apple has hardware hires—many from Intel[1]—who have stepped up to apply their knowledge of formal verification methods to the iOS kernel and drivers, but haven't necessarily had the flexibility to spread that love to macOS. That can change now.)

[1] https://danluu.com/cpu-bugs/ (search for "Apple")

Re: AppStore Preferences can be unlocked by a local admin with any bogus password

#83

Post by real_estate »

jezfromfuture wrote: post #34
newscracker wrote: post #13

This does not help at all for the drubbing that macOS High Sierra has been getting recently. Long term OS X users have been waiting for a Snow Leopard like release, but it seems like Apple isn’t taking as much care as required on security and stability on the Mac. Something has to give — either Apple’s organizational structure needs a change or Apple needs to abandon certain things completely instead of releasing sub…

Snow leopard wasn’t all that till it got a few updates either

It was all downhill after 10.6.8.

Re: AppStore Preferences can be unlocked by a local admin with any bogus password

#84

Post by real_estate »

btown wrote: post #67
derefr wrote: post #62

Earlier quoted context omitted.

Under a different lens, that implies that previously iOS-only engineers now must also become familiar with the macOS codebase, and so more able to contribute to it. Given the large number of those engineers compared to the previous size of the macOS team, this may help more than hurt macOS (as long as you assume the engineering teams are of equivalent quality.)

While it's tolerable to have engineers jumping between projects in, say, web frontend, I'd imagine that operating system security work is incredibly sensitive to programmer context-switching - you can't dive deep into the security model of a desktop system in your 20% time when you're working with an entirely different system (with a different CPU architecture) in your 80% time. Of course there will be some specializ…

Look, who is in charge?

It is either Ive or Cook, or both, right?

Do either of them have any experience with software design?

One is good at making physical things look pretty, the other at large quantities of physical things to the proper location.

I miss Steve.

Re: AppStore Preferences can be unlocked by a local admin with any bogus password

#85

Post by TheCoreh »

TheCoreh wrote: post #16
dajohnson89 wrote: post #9

sorry if this is a dumb question, but: why is it unreasonable for a local admin to have the power to change AppStore preferences? without knowing much about the osx security model, this sounds like not a big deal?

On OS X, administrative accounts still need to authenticate with their passwords to perform administrative tasks. This is to avoid (presumably) someone using your computer and changing settings without your consent if you have automatic login enabled, and to make sure you pay attention to what you're doing (similar to the UAC prompts on Windows, and sudo on Windows)

I can no longer edit the comment above, but I meant sudo on linux, not on Windows.

Re: AppStore Preferences can be unlocked by a local admin with any bogus password

#86

Post by gurkendoktor »

xattt wrote: post #57
gregoriol wrote: post #14

Earlier quoted context omitted.

Most of the recently discussed High Sierra bugs were not there on Sierra, while the features were there, like this one. So it's not that much pen tensting, but Apple making changes and not validating them correctly. Maybe they have their Vista moment with High Sierra, maybe we forgot previous buggy versions.

Could this be the result of shifting quality assurance to the general public through public betas?

For security-related bugs, maybe. When I file bugs with Apple (which I've mostly given up on), they are usually marked as a duplicate of another still-open bug. So it seems that people actually file bugs -- free QA works! -- but there's not enough time to fix them.

Re: AppStore Preferences can be unlocked by a local admin with any bogus password

#87

Post by jaclaz »

briandear wrote: post #37
foz wrote: post #31

Earlier quoted context omitted.

A user with access to a mac could enable the option to automatically install macOS updates, which given recent trends, could impose a security risk.

> could impose a security risk How? Installing a Mac OS update could be considered a security risk? That makes little sense since the security risks you're alluding to were solved by updates. 10.13.2 partially fixed the Intel problem in December and 10.13.3 will have more fixes. If you were still running 10.13.1, you'd have both the root login bug and the Intel security issues. If you were still running Sierra, keepi…

>If you are in a higher risk computing environment, it would be logical that you would sign out of your account after you've finished using the system -- you would essentially have to provide an unauthorized person access to your Mac while you were signed in before this would be an actual threat.

So, the most that can realistically happen is that if you leave your Mac unattended while logged in as Admin, a co-worker or friend might get in and install some app to play a prank on you.

I mean, unless somehow a malicious app has been approved on the Apple store and is available to download through the changed setting (and the "evil" co-worker/friend knows about it), but still the base security risk remains leaving the device unattended and making it phisically accessible by smeone else while still logged in as Admin.

Re: AppStore Preferences can be unlocked by a local admin with any bogus password

#88

Post by raverbashing »

niteshade wrote: post #55
raverbashing wrote: post #50

Earlier quoted context omitted.

Edit: El Capitain doesn't have the padlock on that pane Other panes validate the password correctly

On El Capitan, I don't even see a padlock on the AppStore prefpane.

You're right and I'm wrong

Re: AppStore Preferences can be unlocked by a local admin with any bogus password

#89

Post by dmitriid »

rickmode wrote: post #53
dkonofalski wrote: post #43

Earlier quoted context omitted.

The thing that I don't understand, as a developer, is how these types of bugs even make it in to these releases. Was the "lock" functionality in System Preferences changed at all in any meaningful way for the App Store panel. It doesn't seem like anything about that functionality is sufficiently different so how did this break? Did they bypass the check in order to work on the panel and forget to re-enable it or some…

Maybe Apple has embraced one of these "Agile" methodologies where you basically eliminate your QA group in the promise that developer created unit and integration tests can cover the quality gap. QA and dev approach software with different mindsets, and I've noticed in Agile projects where QA is mostly or entirely missing, there is a skill gap. Edit: People - I'm not trying to be flippant. I really have seen a decrea…

Not agile methodologies. The “omg we must do a release with splashy features once a year” mindset.

They released exactly one version (Mountain Lion IIRC Edit: Snow Leopard) which was just fixing bugs and improving system stability. Everything else was “oh look another shiny toy” where toys are increasingly inane, iOS-like and unfinished (hell, they can’t even fix Photos).

Re: AppStore Preferences can be unlocked by a local admin with any bogus password

#90

Post by IBM »

nolok wrote: post #60
jezfromfuture wrote: post #34

Earlier quoted context omitted.

Snow leopard wasn’t all that till it got a few updates either

Didn't use OSX back then, but I think there is a good distance between "not all that" and the security fiasco going on with High Sierra.

What about having it wipe all your user data?

https://www.computerworld.com/article/2528936/mac-os-x/snow-...

Post reply on HN