Logs in High Sierra Show Plaintext Password for APFS Encrypted External Volumes • Hacker News Board

Re: Logs in High Sierra Show Plaintext Password for APFS Encrypted External Volumes

#121

Post by Corrado » Tue, Mar 27, 2018, 7:05 PM UTC

orclev wrote: post #103

glandium wrote: post #73

Earlier quoted context omitted.

You don't even need to look at security vulnerabilities to wonder what happened to macOS development at Apple. My wife recently bought a mighty mouse. It worked for a few days, but then macOS would fail to associate with it via Bluetooth unless it's plugged in via the lightning cable, in which case it's unusable, the connector being on the side that normally sits on the table. Anyways, after a quick Google, I found a…

Or this awesome issue on any of the newer MacBook Pro laptops, if you plug or unplug any USB devices while the system is either going into or recovering from sleep mode (I.E. after you've closed the lid, but before you see the login screen again after opening it), it will randomly kernel panic. I spent almost a month trying to figure out why I would randomly get a kernel panic in the morning since my evening routine…

Since we're complaining about stupid stuff that's broken in macOS that shouldn't be, I'll add my Ethernet problem. Apparently, it's no longer supported to move between Thunderbolt Ethernet adapters without rebooting.

I have 2 Thunderbolt Ethernet adapters, one at home and one at work, and if I move between them my wired Ethernet connection stops working. The hardware is working fine and it even shows up properly in System Report but the networking stack is completely brain dead. One "solution" is to unplug the adapter, turn off wired Ethernet, wait 30 seconds, plug the adapter back in, turn wired Ethernet back on. Or I can just reboot.

This started happening in 10.12.x and I've filed a bug report for it with every release. Still no fix. WTF?!?

Re: Logs in High Sierra Show Plaintext Password for APFS Encrypted External Volumes

#122

Post by ken » Tue, Mar 27, 2018, 10:00 PM UTC

vondur wrote: post #110

Just curious, could Apple actually ditch Darwin and use linux as their kernel? I'm not sure how the licensing works in regard to their proprietary stuff that may have to touch the kernel. It seems that if they aren't going to invest the money on MacOS dev teams, this may help them out by not having to do as much kernel dev stuff.

From "Design Principles of the I/O Kit": https://developer.apple.com/library/content/documentation/De...

> "OS X is largely the product of two strains of operating-system technology: Mac OS 9 (and its predecessors) and BSD. Given this pedigree, one might have expected Apple to adopt the device-driver model of Mac OS 9 or FreeBSD. Instead, Apple chose to redesign the model. Several reasons motivated this decision.

> "First, neither the Mac OS 9 driver model nor the FreeBSD driver model offers a set of features rich enough to meet the needs of OS X. The OS X kernel is significantly more advanced than its Mac OS precursors; it handles memory protection, preemptive multitasking, multiprocessing, and other features not present in previous versions of Mac OS. Although FreeBSD is capable of handling these features, the BSD model does not offer other features expected in a modern operating system, including automatic configuration, driver stacking, power management, and dynamic loading of devices."

It sounds like switching to a different kernel, and extending it to support everything that the Mac needs, would be a lot more work than finding and fixing the issues they have now. 3 nasty security bugs in 6 months is bad, but how many would they have if they changed kernels entirely? Mac OS X 10.0 sure wasn't bug-free. (For fun times: try creating a new user on 10.0 with login "root".)

I suspect it's very similar to why they didn't switch the display layer to X11: https://developers.slashdot.org/comments.pl?sid=75257&cid=67...

Re: Logs in High Sierra Show Plaintext Password for APFS Encrypted External Volumes

#123

Post by your-nanny » Tue, Mar 27, 2018, 10:57 PM UTC

tinus_hn wrote: post #94

your-nanny wrote: post #91

Earlier quoted context omitted.

So what is the proper way?

Either store them in environment variables or pass them through file descriptors, such as standard input. Note that you do need to take care to clean up the environment if you create new, unprivileged subprocesses or these secrets may leak.

Thanks.