Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AppStore Preferences can be unlocked by a local admin with any bogus password

openradar.appspot.com

Post reply on HN
Print view View original

131–140 of 190 posts

Re: AppStore Preferences can be unlocked by a local admin with any bogus password

#131

Post by jmull »

This is a fairly minor bug, since, apparently, it’s only happens when already logged in as admin (and it’s “just” App Store prefs). (I get that you can come up with scenarios to exploit this, but come in.)

But, wow, how many bugs is this for High Sierra where a password prompt can be bypassed?

It’s like password prompt flu is going around Apple.

Was there bad sample code distributed or some change in the default behavior of some key API? (In addition to the obviously inadequate testing.) I guess it would make more sense to me if there was something connecting all these issues. (Besides the inadequate testing.)

Re: AppStore Preferences can be unlocked by a local admin with any bogus password

#132

Post by tpush »

reaperducer wrote: post #107
hanklazard wrote: post #72

Earlier quoted context omitted.

I'm also a long-time Mac user, but I've really had about enough of this. Between the seemingly constant stream of security problems and the dumbing down of OSX (MacOS, whatever), I'm not sure I'm willing to pay a premium for this product anymore. At the same time the Apple seems to be dropping the ball, some of the more noob-friendly linux distros are starting to look very attractive. And while Apple still seems to h…

If some of the Linux distros would start trying to look like MacOS instead of constantly aping Windows, then switching would be a lot easier. That's been the big reason I've never really taken to Linux. The GUIs all look like Windows with a skin. Where's the innovation?

?

Two of the three most popular DEs (Gnome and Unity) both don't look like Windows. I'd say only KDE does, and most major distros have Unity or Gnome as the default. So I think you're a bit off with your assessment.

Re: AppStore Preferences can be unlocked by a local admin with any bogus password

#133

Post by mackey »

mwaoe09wteo wrote: post #121
mackey wrote: post #117

Earlier quoted context omitted.

I think it has more to do with the complete lack of testing infrastructure and tooling that Apple has produced over the years, despite the explosion of APIs and developers on their platforms. Even on iOS, which rumors have being more of a focus compared to macOS, still has a long way to go to catch up to other platforms. If they required these tools internally, no way would they be this far behind.

Can you elaborate on what's missing? I do a lot of graphics work, and their macOS debugging tools for OpenGL were terrible, but the ones for Metal (which came out first on iOS) are pretty cool! I also use Instruments a lot and some of the other more esoteric tools supplied with Xcode. Not to mention the static analyzer, Address Sanitizer, and lately the Undefined Behavior Sanitizer. But I'd love to have even more too…

I am talking specifically about unit testing, ui testing, integration testing and then supporting those tools in some type of ci system.

And to be clear, they provide these things in the form of XCTest, XCUITest, and Xcode bots, but they aren't good enough. Tons of resources have been spent by the community and major corporations trying to fill in the gaps and offer useful alternatives, but the closed nature of Xcode and its build environment make this difficult.

Re: AppStore Preferences can be unlocked by a local admin with any bogus password

#134

Post by pjmlp »

willtim wrote: post #118
reaperducer wrote: post #107

Earlier quoted context omitted.

If some of the Linux distros would start trying to look like MacOS instead of constantly aping Windows, then switching would be a lot easier. That's been the big reason I've never really taken to Linux. The GUIs all look like Windows with a skin. Where's the innovation?

This is not true in general. Linux Desktop UIs like Gnome 3 have taken a lot of criticism precisely because they have not been copying Windows and have deviated considerably (due to patent concerns). Of course, there are some fringe "garage effort" Linux distros that don't care about patents and do just give some part of the community what they want. As for innovation, Linux desktop UIs had virtual desktops and windo…

> As for innovation, Linux desktop UIs had virtual desktops and window tiling features long before Windows and MacOS.

Well, all commercial UNIXes had them before Linux was even a thing.

Re: AppStore Preferences can be unlocked by a local admin with any bogus password

#136

Post by threeseed »

djsumdog wrote: post #126
threeseed wrote: post #91

Earlier quoted context omitted.

Not sure if you're familiar with how iOS/OSX works. For the Darwin team which is the actual core OS they would have to deal a lot with CPU architectures. But they again they have always dealt with this since back in the NeXT days. ARM and x86 isn't a big deal to manage and there isn't much evidence that something is wrong in that area. For the UI teams i.e. System Frameworks, Cocoa, WindowServer etc. They are abstrac…

So which team might have screwed up here? Is this a UI issue or a backend/system library issue? What about the previous root account unlock issue?

I actually put the blame on Agile.

A few years ago there was a noticeable increase in the frequency of point updates at the expense of quality. In agile, testing either (a) relies heavily on automation or (b) only tests that particular story. In highly complex systems that's often not sufficient and rarely do security teams for example involve themselves on a per story basis.

Personally I think the industry as a whole needs to sit back and realise that Agile wasn't the panacea it was made out to be.

Re: AppStore Preferences can be unlocked by a local admin with any bogus password

#137

Post by threeseed »

loopbit wrote: post #104
rickmode wrote: post #53

Earlier quoted context omitted.

Maybe Apple has embraced one of these "Agile" methodologies where you basically eliminate your QA group in the promise that developer created unit and integration tests can cover the quality gap. QA and dev approach software with different mindsets, and I've noticed in Agile projects where QA is mostly or entirely missing, there is a skill gap. Edit: People - I'm not trying to be flippant. I really have seen a decrea…

I agree with you, the lack of QA skills in a team is a dangerous thing. But I disagree with the notion that the agile methodologies are the problem, more like an excuse from the same people that would use any other excuse to cut corners[0]. A QA column (or set of columns) fits perfectly with Kanban. Years ago I started seeing companies combining QA and product teams[1]. It required product people with a bit of techni…

I am sure we have both spent time in Agile projects. Let me ask you. When stories end up in the QA column do they just test the story or everything the story could possibly touch ? Be honest.

Because that right there is the problem when you are dealing with systems with lots of interconnected components. There just isn't enough time for the "randomly try to break anything" phase.

Re: AppStore Preferences can be unlocked by a local admin with any bogus password

#138

Post by nextos »

reaperducer wrote: post #107
hanklazard wrote: post #72

Earlier quoted context omitted.

I'm also a long-time Mac user, but I've really had about enough of this. Between the seemingly constant stream of security problems and the dumbing down of OSX (MacOS, whatever), I'm not sure I'm willing to pay a premium for this product anymore. At the same time the Apple seems to be dropping the ball, some of the more noob-friendly linux distros are starting to look very attractive. And while Apple still seems to h…

If some of the Linux distros would start trying to look like MacOS instead of constantly aping Windows, then switching would be a lot easier. That's been the big reason I've never really taken to Linux. The GUIs all look like Windows with a skin. Where's the innovation?

This is really not true at all. The most popular desktop in Linux, GNOME, has always drawn heavy inspiration from Mac. The latest version is really polished.

But there are so many options! Including IMHO the best one on any platform for a developer: no desktop environment and a tiling window manager.

There are even NeXTStep clones with binary compatibility! So saying Linux GUIs copy Windows is nonsense.

Re: AppStore Preferences can be unlocked by a local admin with any bogus password

#139

Post by willtim »

pjmlp wrote: post #134
willtim wrote: post #118

Earlier quoted context omitted.

This is not true in general. Linux Desktop UIs like Gnome 3 have taken a lot of criticism precisely because they have not been copying Windows and have deviated considerably (due to patent concerns). Of course, there are some fringe "garage effort" Linux distros that don't care about patents and do just give some part of the community what they want. As for innovation, Linux desktop UIs had virtual desktops and windo…

> As for innovation, Linux desktop UIs had virtual desktops and window tiling features long before Windows and MacOS. Well, all commercial UNIXes had them before Linux was even a thing.

Yes I remember the CDE desktop had virtual desktops, but they go back even to Xerox Parc (according to Wikipedia). There are many minor aspects that have been tweaked and are perhaps newer ideas though. For example, on my desktop, I can search for a window title and get a list of windows across virtual desktops that are matches, and jump to the relevant desktop and window.

Re: AppStore Preferences can be unlocked by a local admin with any bogus password

#140

Post by bitL »

Maybe it's Apple's strategy - let macOS slowly disintegrate and then give iOS to frustrated desktop users as the only right way? Last time I've seen that strategy was when Nokia had a mole as CEO installed, though the outcome wasn't very nice to either Nokia nor MS...
Post reply on HN