Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AppStore Preferences can be unlocked by a local admin with any bogus password

openradar.appspot.com

Post reply on HN
Print view View original

101–110 of 190 posts

Re: AppStore Preferences can be unlocked by a local admin with any bogus password

#101

Post by chisleu »

dkonofalski wrote: post #43
newscracker wrote: post #13

This does not help at all for the drubbing that macOS High Sierra has been getting recently. Long term OS X users have been waiting for a Snow Leopard like release, but it seems like Apple isn’t taking as much care as required on security and stability on the Mac. Something has to give — either Apple’s organizational structure needs a change or Apple needs to abandon certain things completely instead of releasing sub…

The thing that I don't understand, as a developer, is how these types of bugs even make it in to these releases. Was the "lock" functionality in System Preferences changed at all in any meaningful way for the App Store panel. It doesn't seem like anything about that functionality is sufficiently different so how did this break? Did they bypass the check in order to work on the panel and forget to re-enable it or some…

I have a correctly functioning lock in Sierra.

Re: AppStore Preferences can be unlocked by a local admin with any bogus password

#102

Post by aetherson »

natch wrote: post #38
oneeyedpigeon wrote: post #33

Earlier quoted context omitted.

Yes, exactly. It requires a password, then doesn't require a password on subsequent attempts for a certain period of time.

Good point. Clearly with sudo, aside from it following the UNIX convention for sudo, it is just a consciously made tradeoff between security and ease of use. Whereas with the security pane, the lack of checking of the password that is entered is most likely a bug. Maybe you already saw this but I see they also made the same security/ease of use tradeoff for the (non-buggy) locks in the other preference panes. After u…

It's not "most likely" a bug, it's definitely a bug.

Nobody said, "We want to lower the security level of this feature, so let's keep the password prompt but allow any input to the password prompt."

Re: AppStore Preferences can be unlocked by a local admin with any bogus password

#103

Post by knolan »

FabHK wrote: post #81
mbesto wrote: post #78

Earlier quoted context omitted.

The parent's point is that SL was almost explicitly a performance/optimization gain and not a feature release. It literally give you ~8GB (IIRC) of extra disk space for just installing it. I would fork over money to Apple for them to do another SL-like OS release. Are you listening Apple?!

Wasn't High Sierra supposed to be the same? Lots of improvements under the hood, few if any visible new features?

High Sierra was lots of new changes under tho hood whereas Snow Leopard was lots of improvements to existing stuff.

High Sierra switches solid state drives to the new APFS file system and the WindowServer is now rewritten to use Metal2.

So I would suggest that High Sierra is far from a stability release like Snow Leopard was. It was about ripping out the foundations and building new ones. The APFS transition, to Apple’s credit has been mostly painless while the WindowServer changes has been hit miss depending on your hardware.

These were things Apple had to do and they benefit all their platforms.

Re: AppStore Preferences can be unlocked by a local admin with any bogus password

#104

Post by loopbit »

rickmode wrote: post #53
dkonofalski wrote: post #43

Earlier quoted context omitted.

The thing that I don't understand, as a developer, is how these types of bugs even make it in to these releases. Was the "lock" functionality in System Preferences changed at all in any meaningful way for the App Store panel. It doesn't seem like anything about that functionality is sufficiently different so how did this break? Did they bypass the check in order to work on the panel and forget to re-enable it or some…

Maybe Apple has embraced one of these "Agile" methodologies where you basically eliminate your QA group in the promise that developer created unit and integration tests can cover the quality gap. QA and dev approach software with different mindsets, and I've noticed in Agile projects where QA is mostly or entirely missing, there is a skill gap. Edit: People - I'm not trying to be flippant. I really have seen a decrea…

I agree with you, the lack of QA skills in a team is a dangerous thing. But I disagree with the notion that the agile methodologies are the problem, more like an excuse from the same people that would use any other excuse to cut corners[0]. A QA column (or set of columns) fits perfectly with Kanban.

Years ago I started seeing companies combining QA and product teams[1]. It required product people with a bit of technical background but, when done right, worked incredibly well. Nowadays not only I've stopped seeing that trend, but most product teams I see are completely ignorant of technical matters. QA teams seem to be more or less missing or seriously understaffed.

---

[0] Not to speak of the need to be "agile" without changing a single thing in the process. I can't count the number of times I've seen teams using what is, essentially, a waterfall process (including long development cycles with no contact with the customer at all) self-describing themselves as agile.

[1] So the same team defining the new features also creates the tests, both automated and manual, and checked the results.

Re: AppStore Preferences can be unlocked by a local admin with any bogus password

#105

Post by FreedomWarrior »

eeks wrote: post #80
hanklazard wrote: post #72

Earlier quoted context omitted.

I'm also a long-time Mac user, but I've really had about enough of this. Between the seemingly constant stream of security problems and the dumbing down of OSX (MacOS, whatever), I'm not sure I'm willing to pay a premium for this product anymore. At the same time the Apple seems to be dropping the ball, some of the more noob-friendly linux distros are starting to look very attractive. And while Apple still seems to h…

> Slightly off topic, but one of the only software issues holding me back previously was 1Password compatibility on linux, but apparently, it is now available (1). Well, it's a Chrome extension. For some people (including yours truly), it's a deal breaker. I would suggest `password-store`[0] if you don't need to share your vault with anyone. [0] https://www.passwordstore.org

Actually, pass has great support for teams. Dropping one or more GPG keys in ".gpg-id" will encrypt the passwords for the various identities. This works globally or per sub-folder.

I use dedicated subkeys for work and mobile so that I don't have to share my main key, or indeed every password with every device.

Re: AppStore Preferences can be unlocked by a local admin with any bogus password

#106

Post by duncan_bayne »

hanklazard wrote: post #72
newscracker wrote: post #13

This does not help at all for the drubbing that macOS High Sierra has been getting recently. Long term OS X users have been waiting for a Snow Leopard like release, but it seems like Apple isn’t taking as much care as required on security and stability on the Mac. Something has to give — either Apple’s organizational structure needs a change or Apple needs to abandon certain things completely instead of releasing sub…

I'm also a long-time Mac user, but I've really had about enough of this. Between the seemingly constant stream of security problems and the dumbing down of OSX (MacOS, whatever), I'm not sure I'm willing to pay a premium for this product anymore. At the same time the Apple seems to be dropping the ball, some of the more noob-friendly linux distros are starting to look very attractive. And while Apple still seems to h…

I run 1Password in the browser (Firefox) and have no problem working with a team of OSX users running 1Password.

My own stuff I keep in a ccrypt-ed text file that I view and edit with Emacs.

Re: AppStore Preferences can be unlocked by a local admin with any bogus password

#107

Post by reaperducer »

hanklazard wrote: post #72
newscracker wrote: post #13

This does not help at all for the drubbing that macOS High Sierra has been getting recently. Long term OS X users have been waiting for a Snow Leopard like release, but it seems like Apple isn’t taking as much care as required on security and stability on the Mac. Something has to give — either Apple’s organizational structure needs a change or Apple needs to abandon certain things completely instead of releasing sub…

I'm also a long-time Mac user, but I've really had about enough of this. Between the seemingly constant stream of security problems and the dumbing down of OSX (MacOS, whatever), I'm not sure I'm willing to pay a premium for this product anymore. At the same time the Apple seems to be dropping the ball, some of the more noob-friendly linux distros are starting to look very attractive. And while Apple still seems to h…

If some of the Linux distros would start trying to look like MacOS instead of constantly aping Windows, then switching would be a lot easier.

That's been the big reason I've never really taken to Linux. The GUIs all look like Windows with a skin. Where's the innovation?

Re: AppStore Preferences can be unlocked by a local admin with any bogus password

#108

Post by rhizome »

cgb223 wrote: post #69
miles wrote: post #59

Earlier quoted context omitted.

> it seems like Apple isn’t taking as much care as required on security and stability on the Mac It's even worse than that according to[0] Mark Gurman[1]: In another sign that the company has prioritized the iPhone, Apple re-organized its software engineering department so there's no longer a dedicated Mac operating system team. There is now just one team, and most of the engineers are iOS first, giving the people wo…

I heard rumors that Apple is moving towards one unified App development process for both macOS and iOS Is it possible that this is related to that?

Microsoft Cairo...finally!

Re: AppStore Preferences can be unlocked by a local admin with any bogus password

#109

Post by Cyberdog »

reaperducer wrote: post #107
hanklazard wrote: post #72

Earlier quoted context omitted.

I'm also a long-time Mac user, but I've really had about enough of this. Between the seemingly constant stream of security problems and the dumbing down of OSX (MacOS, whatever), I'm not sure I'm willing to pay a premium for this product anymore. At the same time the Apple seems to be dropping the ball, some of the more noob-friendly linux distros are starting to look very attractive. And while Apple still seems to h…

If some of the Linux distros would start trying to look like MacOS instead of constantly aping Windows, then switching would be a lot easier. That's been the big reason I've never really taken to Linux. The GUIs all look like Windows with a skin. Where's the innovation?

Amen to this. A stickler for me personally is the universal menu bar at the top of the screen rather than separate menu bars inside windows.

I know that older versions of KDE could be configured to do this, but not sure if more recent ones can do it, or if other DEs can do it. Every now and then I do some research on it, but the results are never promising. (From what I remember, the Ubuntu/Unity bar gets close but still feels weird.)

Re: AppStore Preferences can be unlocked by a local admin with any bogus password

#110

Post by dmitriid »

derefr wrote: post #62
miles wrote: post #59

Earlier quoted context omitted.

> it seems like Apple isn’t taking as much care as required on security and stability on the Mac It's even worse than that according to[0] Mark Gurman[1]: In another sign that the company has prioritized the iPhone, Apple re-organized its software engineering department so there's no longer a dedicated Mac operating system team. There is now just one team, and most of the engineers are iOS first, giving the people wo…

Under a different lens, that implies that previously iOS-only engineers now must also become familiar with the macOS codebase, and so more able to contribute to it. Given the large number of those engineers compared to the previous size of the macOS team, this may help more than hurt macOS (as long as you assume the engineering teams are of equivalent quality.)

One woman has a baby in 9 months. In how many months will 9 women have a baby?

Also: “Mythical man month” etc.

You do not solve your problem by having a bunch of engineers from a different domain and having different priorities.

Post reply on HN