Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple patches CVE-2020-9859 (unc0ver)

support.apple.com

Post reply on HN
Print view View original

61–70 of 79 posts

Re: Apple patches CVE-2020-9859 (unc0ver)

#61

Post by jagged-chisel »

Wowfunhappy wrote: post #52
jagged-chisel wrote: post #51

Earlier quoted context omitted.

And you can. Doesn't mean all your users' personal devices comply with the request to do so.

On iOS? iPhones don't update automatically (if you tell them not to), but I'm not aware of a way to stop them from downloading updates, other than weird workarounds like installing a tvOS beta profile.

I forget that perhaps Apple's intent is to do what people complain about: download the update anyway, regardless of the setting. My anecdotal experience (I have yet to have an iOS device actually download the update when I have automatic updates turned off) allows me to forget.

Re: Apple patches CVE-2020-9859 (unc0ver)

#62

Post by baggy_trough »

rexfm wrote: post #59
baggy_trough wrote: post #55

Earlier quoted context omitted.

I tried to make that work, but it didn't seem to do anything. Repeat downloads took just as long as before.

you can verify if Content Cache is working in a couple ways... first, while installing the update, you should see a CPU usage spike in Activity Monitor for the process "AssetCache". secondly, you can run this command on the machine you want to upgrade, to verify that it can see your Content Caching Server (it should report the local IP address of the machine you set up Content Caching on) "AssetCacheLocatorUtil"

great info, thanks.

Looks like if the machine is asleep it won't use it for a content cache, even if "wake for network access" is turned on. So a pretty useless feature if you have a machine that's allowed to sleep.

Re: Apple patches CVE-2020-9859 (unc0ver)

#63

Post by frandroid »

jagged-chisel wrote: post #61
Wowfunhappy wrote: post #52

Earlier quoted context omitted.

On iOS? iPhones don't update automatically (if you tell them not to), but I'm not aware of a way to stop them from downloading updates, other than weird workarounds like installing a tvOS beta profile.

I forget that perhaps Apple's intent is to do what people complain about: download the update anyway, regardless of the setting. My anecdotal experience (I have yet to have an iOS device actually download the update when I have automatic updates turned off) allows me to forget.

How about silent updates, like the one Apple pushed to remove Zoom's ghost server last year?

Re: Apple patches CVE-2020-9859 (unc0ver)

#64

Post by sneak »

frandroid wrote: post #63
jagged-chisel wrote: post #61

Earlier quoted context omitted.

I forget that perhaps Apple's intent is to do what people complain about: download the update anyway, regardless of the setting. My anecdotal experience (I have yet to have an iOS device actually download the update when I have automatic updates turned off) allows me to forget.

How about silent updates, like the one Apple pushed to remove Zoom's ghost server last year?

Those are non-executable rulesets that are part of XProtect, the system-level antivirus. It’s not an OS update.

Re: Apple patches CVE-2020-9859 (unc0ver)

#65

Post by nnx »

minedwiz wrote: post #46
jmull wrote: post #14

Earlier quoted context omitted.

It might seem strange, but they are using a change/build/deploy mechanism designed to deliver updates to any and all parts of an OS across a range of hardware devices. I'm pretty sure the mechanism, from end-to-end, is complex, and providing an optimized path for small changes would require resources, introduce more risk, and come at the expense of something else. Sucks, though, for everyone who doesn't have a reason…

I just wish it didn't take 30 minutes to install, even on modern Macs with PCIe drives.

It’s indeed infuriating than any small-ish kernel patch takes so long to install. I wonder what the update system is doing.

Re: Apple patches CVE-2020-9859 (unc0ver)

#66

Post by nitrogen »

hu3 wrote: post #42
Wowfunhappy wrote: post #33

Earlier quoted context omitted.

I apologize if this is a stupid question, but, is there a reason they can't do a diff patch on the binary? Would it end up not introducing savings?

Incompetence. A private company can deliver two human beings alive to a point in space with millimeter precision. Meanwhile another can't deliver Operating Systems without gross bugs or smaller updates with binary diff patching.

I want to point out that software and space are quite different problems. Much of the engineering for space appears to be mathematically differentiable and continuous -- a small change in inputs usually results in a predictable change in outputs. It's hard work, but relatively intuitive.

Software is more chaotic though. A small change in inputs can change behavior drastically, like stepping a tiny bit to the right on a branch of the Mandelbrot set. It's sometimes easier work, but often relatively counterintuitive.

Re: Apple patches CVE-2020-9859 (unc0ver)

#67

Post by LeoPanthera »

baggy_trough wrote: post #55
LeoPanthera wrote: post #44

Earlier quoted context omitted.

If you have at least one Mac, you can use Content Caching: https://support.apple.com/guide/mac-help/what-is-content-cac... It works for iCloud content, too.

I tried to make that work, but it didn't seem to do anything. Repeat downloads took just as long as before.

If you've just turned on Content Caching, or the machine running it has rebooted, client devices will not discover the server immediately. You need to wait a while, or reboot the client devices, which will force them to discover it.

Re: Apple patches CVE-2020-9859 (unc0ver)

#68

Post by blinkingled »

prvc wrote: post #49
saagarjha wrote: post #5

I think this might be the fastest patch of a security issue affecting Apple's operating systems, ever. Aside from *.0.1 releases that fixed critical bugs with core features in new OSes, has anything been patched this fast? (I'm also obligated to post that the bug that this fixes is not new; it was discovered back in iOS 11, fixed, and Apple reopened it in an iOS 13 update: https://www.synacktiv.com/posts/exploit/retu…

If that doesn't illustrate their true priorities re: user security/ privacy, then I'm not sure what could.

https://twitter.com/s1guza/status/1266433756270866433

This may also illustrate their priority to reintroduce the same bug and re-fix it at faster speeds to wow their fanbase. Or you know the priority may also be keeping the walled garden - walled? Also it might just be security response 101 - like every other major OS vendor out there depending on the bug. But yeah privacy and security for users that's a much nicer marketing pitch.

Re: Apple patches CVE-2020-9859 (unc0ver)

#70

Post by hu3 »

nitrogen wrote: post #66
hu3 wrote: post #42

Earlier quoted context omitted.

Incompetence. A private company can deliver two human beings alive to a point in space with millimeter precision. Meanwhile another can't deliver Operating Systems without gross bugs or smaller updates with binary diff patching.

I want to point out that software and space are quite different problems. Much of the engineering for space appears to be mathematically differentiable and continuous -- a small change in inputs usually results in a predictable change in outputs. It's hard work, but relatively intuitive. Software is more chaotic though. A small change in inputs can change behavior drastically, like stepping a tiny bit to the right on…

There's no amount of handwaving that will excuse Apple for messing up their signin authentication, mobile throttling, faulty keyboards being delivered for years despite customer outcry or allowing anyone to login as root with blank password on macos. Those things should get caught in basic QA. It's not rocket science.

I repeat: it's incompetence.

Post reply on HN