Live data from Hacker News

Logs in High Sierra Show Plaintext Password for APFS Encrypted External Volumes

mac4n6.com

31–40 of 123 posts

Re: Logs in High Sierra Show Plaintext Password for APFS Encrypted External Volumes

#31
post #22

Earlier quoted context omitted.

Sloppy and marketed as a stability build. There were hardly any new features in it.

Yeah, they just deployed a whole new FS to 100s of millions of users, in record time, with almost zero incidents. Hardly any new features...

That's technically impressive but it's not much of a feature.

Re: Logs in High Sierra Show Plaintext Password for APFS Encrypted External Volumes

#32
post #22

Earlier quoted context omitted.

Sloppy and marketed as a stability build. There were hardly any new features in it.

Yeah, they just deployed a whole new FS to 100s of millions of users, in record time, with almost zero incidents. Hardly any new features...

What new features do users gain from the new file system?

Re: Logs in High Sierra Show Plaintext Password for APFS Encrypted External Volumes

#33
post #22

Earlier quoted context omitted.

Sloppy and marketed as a stability build. There were hardly any new features in it.

Yeah, they just deployed a whole new FS to 100s of millions of users, in record time, with almost zero incidents. Hardly any new features...

> new FS [...] in record time

That's an odd brag. I might be from a bygone era but it used to be the case that filesystems were particularly conservative and rollouts equally so. Getting one deployed in "record time" is hardly difficult because everyone else is so conservative it can take tens of years in some cases.

Look at Microsoft's ReFS, available in Server 2012, 2012 R2, Windows 8.1, Server 2016 and Windows 10 and has had eight public versions. Yet even after all of that it isn't the default partition type for Windows installations, and Microsoft only recommends it in specific circumstances[0].

So congrats to Apple's record time but I like my filesystems like I like my Toyota, reliable.

[0] https://docs.microsoft.com/en-us/windows-server/storage/refs...

Re: Logs in High Sierra Show Plaintext Password for APFS Encrypted External Volumes

#34

Please don't link to mac4n6, it serves malware on some page loads. The article author is aware of it but apparently doesn't have the ability to fix the issue

Not calling you out but I'd like to see a source for this. A quick web search for mac4n6 malware didn't turn up anything.

[deleted]

Re: Logs in High Sierra Show Plaintext Password for APFS Encrypted External Volumes

#35
post #3
post #2

Fixed in 10.13.2 - but wow, was High Sierra ever a sloppy release.

It’s appallingly sloppy. I can’t say I’m regretting my switch to essentially holding off on major OS upgrades until just before the next one is released. I wish Xcode’s current version still supported the most recent two OS versions, though.

how do you deal with the constant update prompts? ignoring them, or is there some defaults system key that can be used to turn them off?

Re: Logs in High Sierra Show Plaintext Password for APFS Encrypted External Volumes

#36
post #32
post #22

Earlier quoted context omitted.

Yeah, they just deployed a whole new FS to 100s of millions of users, in record time, with almost zero incidents. Hardly any new features...

What new features do users gain from the new file system?

being able to duplicate a 1GB directory in an instant

Re: Logs in High Sierra Show Plaintext Password for APFS Encrypted External Volumes

#37
post #3

Earlier quoted context omitted.

It’s appallingly sloppy. I can’t say I’m regretting my switch to essentially holding off on major OS upgrades until just before the next one is released. I wish Xcode’s current version still supported the most recent two OS versions, though.

how do you deal with the constant update prompts? ignoring them, or is there some defaults system key that can be used to turn them off?

https://appletoolbox.com/2018/01/disable-macos-software-upda...

Re: Logs in High Sierra Show Plaintext Password for APFS Encrypted External Volumes

#38

Earlier quoted context omitted.

Not calling you out but I'd like to see a source for this. A quick web search for mac4n6 malware didn't turn up anything.

Here is the source — https://twitter.com/iamevltwin/status/976627634066132992

To save others a click, that's the author of the website confirming that the site was compromised by a code injection attack via Squarespace control panel.

Re: Logs in High Sierra Show Plaintext Password for APFS Encrypted External Volumes

#39

Earlier quoted context omitted.

Bad idea cat /proc/ /environ

Wait, what's your threat model? Surely you're not imagining that you can pass data from one process to another without root being able to see it? (On Linux, since you're using /proc.) Other users' processes can't see /proc/$pid/environ, unlike using cmdline.

Don't recall right now for sure, but doesn't ps have an option to display the processes environment? I've done it by accident a few times and it does not take root.

Re: Logs in High Sierra Show Plaintext Password for APFS Encrypted External Volumes

#40
To be fair, does linux/unix system also has similar thing? If the cmd tool supports passing the password as argument, it is supposed to be logged in whatever logging facility in the system. I am not aware of a feature to sanitize the password argument.

The usual way is the cmd tool supports supplying password as password prompt, and the user should always supply the password in the prompt except testing purpose.

So, I think it is more like a UI problem then a vulnerability.

Post reply on HN