Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple isn’t patching all the security holes in older versions of macOS

arstechnica.com

Post reply on HN
Print view View original

61–70 of 132 posts

Re: Apple isn’t patching all the security holes in older versions of macOS

#61

Post by Wowfunhappy »

cmeacham98 wrote: post #57
Wowfunhappy wrote: post #36

Earlier quoted context omitted.

> But you need the updated certificate to view this website without warning I didn’t. IIRC they did some whacky thing on their own site such that it still worked in Chromium.

Doesn't Chromium use its own CA store, or is that different on the OS X version?

Chromium uses its own HTTPS implementation but does not currently use its own CA store. If it did, adding the aforementioned certificate would not have fixed all of the “Your Connection Is Not Private” errors I was encountering previously. :)

Re: Apple isn’t patching all the security holes in older versions of macOS

#62

Post by Joeri »

hyperstar wrote: post #33

Naive question: why is it that the newest version of macos doesn't run on older machines? (The solution is, of course, to install Linux on them.)

Apple always drops software support for hardware when they stop providing hardware repairs. They generally consider hardware “vintage” 7 years after its introduction, but sometimes make that longer. They drop support in new macos releases only but they keep shipping updates to the two older releases as well. This means in practice hardware gets about a decade of software support, and the last two years of that without new features. Since the reasons for dropping support usually aren’t hard technical limits the community makes patchers to put new macos releases on older hardware.

To my knowledge Linux has never worked well on intel macs with a T2 chip. Asahi linux is working on bringing good support to m1 macs, so it looks like for good linux support you either need a pre-T2 mac or a post-M1 mac.

Re: Apple isn’t patching all the security holes in older versions of macOS

#63

Post by deergomoo »

xfitm3 wrote: post #47
lwouis wrote: post #24

Earlier quoted context omitted.

I find fewer and fewer new features motivating an upgrade. These days it's integration or fluff like tracking the time you spend on each app. I'm on Catalina and have no incentive to upgrade, but have many incentives not to (e.g. breaking compatibility)

One aspect I find infuriating is UX changes. I like the way things were, change for change's sake is annoying.

I don’t mind visual spruce ups to keep things fresh, but over the last few years at Apple there has been a trend in “hiding things in drawers”. Buttons are removed from UIs and moved to hover actions or put inside overflow menus (which is basically a misnomer at this point as there are not enough buttons to fill a toolbar, let alone overflow one).

It’s awful, because you end up with software that is pretty in a screenshot but is objectively less simple to use, because discoverability drops like a lead balloon.

It seemed to start when Forstall was ousted and Jony Ive’s team took over software design as well as hardware. Their recent laptops have shown you can give up a little form in favour of a lot of function, so hopefully the software teams are (re-)learning the same lessons.

Re: Apple isn’t patching all the security holes in older versions of macOS

#65

Post by toyg »

Aaargh20318 wrote: post #58
ulfw wrote: post #56

Earlier quoted context omitted.

With all due respect. How much time do you think it will take to download and install an update every few years?

Especially since the update downloads in the background and doesn't require your input after starting it. You can start the update, go do something else, come back and hour later and it's done.

Ahaha yes, and then you're left "only" with a few hours figuring out what broke in your setup because stuff like /usr/local was "liberally" modified by the update. Plus, of course, oops all your 32bit games are ded.

(Yeah sure, not your average Mac user, but still - don't discount the pain that any arbitrary update can and will inflict).

Re: Apple isn’t patching all the security holes in older versions of macOS

#66

Post by jkestner »

sgt wrote: post #23

I'm still running Mojave. Never found the time to upgrade. Ridiculous, I know. Anyone else in the same boat?

Same. Mojave on one, Catalina on the other. Of course, because these are unsupported Macs, upgrading involves OpenCore and researching what potential quirks will arise with new OS versions. I’m perfectly happy with Mojave, so why upgrade if it means I probably have to get new hardware too?

The main thing that’ll drive me to that is Xcode, which Apple ties to macOS versions, so officially you can’t develop for an OS (macOS, iOS, etc) that is more than a year older than yours. The tricks used to get around that aren’t as reliable as OpenCore.

Re: Apple isn’t patching all the security holes in older versions of macOS

#67

Post by Laforet »

my123 wrote: post #60
Laforet wrote: post #49

Earlier quoted context omitted.

Linux would also require drivers to be recompiled for a new kernel. This is not an option for most proprietary drivers for products long abandoned by the manufacturer. For the more common and popular hardware there is a good chance that open source drivers can be maintained by the community but if your laptop relies on a somewhat obscure chipset or microcontroller then your mileage will vary...a lot. Look up "Intel G…

> Most notably, OSX dropped support for all nVidia GPUs from Mojave onwards Not those shipped with Macs. The GeForce kexts to support the NVIDIA GPU gens that Apple shipped, Fermi and Kepler, are still present even on Monterey.

Apparently they will not be in the stable release of Monterey though it is still possible to patch the drivers in.

https://github.com/chris1111/Geforce-Kepler-patcher

Fermi was never supported beyond High Sierra IIRC.

Re: Apple isn’t patching all the security holes in older versions of macOS

#68

Post by wazoox »

afandian wrote: post #43
darthrupert wrote: post #22

Earlier quoted context omitted.

Which part of upgrading macos to a supported version is not working?

The bit where Apple's OS tries to connect to Apple's update servers, and can't authenticate because Apple switched to an incompatible root CA.

Ah yeah, I've recently received for free an iMac running Macos 10.9. It's simply impossible to upgrade; the only proposed upgrade release is 10.11, the installation starts then fails in a loop. Fortunately I don't actually need to save anything from this machine, and I have another Mac to download a newer OS installer, but that's quite painful.

Re: Apple isn’t patching all the security holes in older versions of macOS

#69

Post by jkestner »

cgufus wrote: post #53
sgt wrote: post #23

I'm still running Mojave. Never found the time to upgrade. Ridiculous, I know. Anyone else in the same boat?

Even worse: Sierra. Ouch. 10 years ago I used to go for every upgrade immediately (even .0’s). IMO new versions since maybe 10.8 added mostly data collecting bloat. macOS moved far away from the OS I once loved (peaked at Snow Leopard IMO). Funnily, macOS became “free” after Snow Leopard, so you’ve probably paid with your data ever since.

Not data. You pay in service subscriptions and upsold hardware (especially since some features work less well or not at all unless your OSes are upgraded across the board).

Re: Apple isn’t patching all the security holes in older versions of macOS

#70

Post by mc32 »

qwertox wrote: post #51
sschueller wrote: post #28

They also never bothered to implement the 2 factor code popup on old systems but forcing user to use 2fa. So you now get to explain to grandma that she needs to enter her icloud password, get a password error, click on approve on her iPhone, then enter her password again with the 6 digit code shown on the iphone appended to the end of her password.

That's a neat hack if you only have one input box. But all the extra code on the backend needed to differentiate between a normal password and a password+pin sounds like something which could accidentally weaken security.

Maybe they’re leveraging radius for some of of that?
Post reply on HN