121–130 of 367 posts
Earlier quoted context omitted.
To be fair, OS X updates are free and usually run well even on 5+ years old hardware. OS X has kinda gone the way of Chrome, with most users on the newest version.
[citation needed]
Only 50% on Windows 7 or 8: https://analytics.usa.gov
Oh, wait, Windows 7 is from 2009. Only 10% use a Windows younger than two years.
While this is a significant vulnerability, I don't think the article is correct when it calls it a 'backdoor.' The term backdoor typically implies something that was intentionally left to allow illicit access, and while this is a significant bug, I don't see anything to indicate that's the case here.
Earlier quoted context omitted.
They'll just think "oh god, I have viruses!" and call whoever is the family's "computer whiz". The very concept of "this system is not secure" is something that ordinary user does not understand. Source: I'm a family "computer whiz" :/.
That's completely untrue, and pretty cynical. People understand if a system is insecure, and now apparently all non-Yosemite Macs are insecure. Folks will grok that. Whether or not they find out about it, well that's up to you and I, and everyone else on this website.
OT but I have to say that the amount of Apple apologists in these comments is mind blowing. HN reader of all people should be the ones urging Apple to issue a fix for a very serious bug such as this one. Yet many comments here are saying that people should just upgrade while it might solve the problem for some, there are ones who can't upgrade machines at will.
I don't see a single comment in this thread that says that.
Earlier quoted context omitted.
I'm with you on this; I can't leave Mavericks just yet. Every colleague I have that's moved on has had numerous issues with their machine. And now this crap. Ugh.
What kind of issues? I've literally noticed no differences besides UI.
While this is a significant vulnerability, I don't think the article is correct when it calls it a 'backdoor.' The term backdoor typically implies something that was intentionally left to allow illicit access, and while this is a significant bug, I don't see anything to indicate that's the case here.
So, this was clearly intentional, because it's used by Apple directly. And it allows illicit access, because any program can use it to gain access.
> Apple indicated that this issue required a substantial amount of changes on their side, and that they will not back port the fix to 10.9.x and older. What ? So all OS X boxes are simply broken, privileges-wise, if they're not on 10.10?
Apple's model customer is one who upgrades often. If you want solid support for old products, stick with Microsoft, and accept that their products can be clunkier because of deliberate choices to maintain backwards-compatibility.
I don't know any tech company that doesn't have that idea of a model customer :)
To their credit, I can run the latest on a pretty old Mac Mini at home. It's not as fast as it used to be, but it is supported long after the form factor of the Mini has undergone big changes. I don't consider myself being squeezed to upgrade.
Earlier quoted context omitted.
In that case, I think "backdoor" is hyperbolic. That word is usually uses to indicate intentional secret security holes.
What do you call something that grants root access without authentication, but wasn't intended to let arbitrary people or programs use it? "Backdoor" isn't quite right, since that implies that the intent was to allow unauthorized use. "Security vulnerability" isn't quite right either , since that usually implies getting code to exhibit some sort of behavior it was never supposed to have. I can't think of any other te…
Local privilege escalation. In a huge number of established LPEs, the exploit is by leveraging a weakness in checking who makes the call that allows legitimate privilege escalation. This is a legitimate privilege escalation (sshd binds to port 22, among others tasks), that can be exploited through a weakness in checking who is making that request and if they can have that granted.
Earlier quoted context omitted.
Interestingly, the release notes for the 2015-004 patch that includes the fix specifically mention it is also available for Mavericks and Mountain Lion. https://support.apple.com/en-us/HT201222
No it doesn't: from https://support.apple.com/en-us/HT204659 : > Admin Framework > Available for: OS X Yosemite v10.10 to v10.10.2 > Impact: A process may gain admin privileges without properly authenticating Description: An issue existed when checking XPC entitlements. This issue was addressed with improved entitlement checking. > CVE-ID > CVE-2015-1130 : Emil Kvarnhammar at TrueSec
I can't really believe Apple will actually leave this unpatched, as opposed to just saying it won't at this time. The impact of this exploit and the number of affected systems is way too big, they really can't let this sit in OS X versions that were brand new only one or two years ago, that would be insane. With all the resources they have a statement like 'the impact of the changes would be too large' is quite ridiculous.
My guess is that they will patch it in a later update, but haven't finished it yet. Maybe they are even hoping for a few more people to upgrade to Yosemite before they release it. I would be willing to bet that they don't leave a gaping hole like this sitting indefinitely.