Hidden backdoor API to root privileges in Apple OS X • Hacker News Board

Re: Hidden backdoor API to root privileges in Apple OS X

#301

Post by wvenable » Fri, Apr 10, 2015, 4:44 AM UTC

lqdc13 wrote: post #277

fr0styMatt2 wrote: post #247

Earlier quoted context omitted.

I wish I could upvote this comment a million times. I see the same kind of ignorance-of-their-options (note I specifically say ignorance-of-their-options; I'm not saying anyone is generally ignorant) reflected when developers complain that it's hard to get under the hood of Windows or when developers complain about the tooling on Windows. You'd at least hope that this segment of the user-base would have more intellec…

I agree with the poster above about usability, but I disagree about ease of development. This is partially because linux is the dominant platform for Python developers, but developing/using Python libraries on Windows is really difficult. Many people simply overlook it. The default command prompt is really really bad. There are alternatives, but none of them come close to the gnome shell. The Batch scripting language…

> Try the same thing on Windows... It will crash on the first week for sure.

What is this, 1998?

Re: Hidden backdoor API to root privileges in Apple OS X

#302

Post by Tiksi » Fri, Apr 10, 2015, 4:48 AM UTC

soup10 wrote: post #289

sls wrote: post #239

Earlier quoted context omitted.

> JWZ used to say that Linux is only free if you don't value your time. My reply to that has always been that Windows is only $300 if you don't value your time. (Preserving archaic cost of Windows to match JWZ quote.) The implication that the one system is free and time-consuming and the other moderately in price but not time-consuming is entirely false. At the time, for many requirements, configuring and administeri…

Linux desktop is and has been second rate for a long long time. Turns out unless there are corporate sponsors paying for development, open source software sucks. The OSS community is pretty much in denial about that.

That's funny, because I haven't managed to find a desktop OS that is up to par with Linux for me. Preferences may vary, but second rate in your book is the only viable contender in mine. Also turns out that Linux does in fact have corporate sponsors, like oracle, red hat, etc. so I'm not sure I follow. Is closed source software top notch without corporate sponsorship?

The sad truth is that most software sucks, regardless of the license, there's just a lower barrier to entry, use, and discoverability with OSS so it's more visible. At least with OSS we can fix the issues instead of just accepting the suckage.

Re: Hidden backdoor API to root privileges in Apple OS X

#303

Post by utbabya » Fri, Apr 10, 2015, 5:41 AM UTC

Tiksi wrote: post #302

soup10 wrote: post #289

Earlier quoted context omitted.

Linux desktop is and has been second rate for a long long time. Turns out unless there are corporate sponsors paying for development, open source software sucks. The OSS community is pretty much in denial about that.

That's funny, because I haven't managed to find a desktop OS that is up to par with Linux for me. Preferences may vary, but second rate in your book is the only viable contender in mine. Also turns out that Linux does in fact have corporate sponsors, like oracle, red hat, etc. so I'm not sure I follow. Is closed source software top notch without corporate sponsorship? The sad truth is that most software sucks, regard…

I'm probably biased.

After a year I find the only advantage of OSX are browser with touchpad gesture experience and windows edge handling. Haven't tried any distro ever since switching to MBP, wayland might have a better chance of replicating the experience. Hoping for the camera driver to be done.

In Linux everything else is better, fuller implementation of base tools, customizability, no crap like /var/folders..

Re: Hidden backdoor API to root privileges in Apple OS X

#304

Post by CountSessine » Fri, Apr 10, 2015, 5:42 AM UTC

hug wrote: post #238

PopsiclePete wrote: post #195

Earlier quoted context omitted.

>Fair play. Research the manufacturer's policy if you're buying pre-built. If you build your own desktops, this is not an issue. I can build my own desktop, but I can't build my own laptop. I use laptops exclusively for work. >When's the last time you actually installed drivers on a fresh Windows install? Less than year ago on my girlfriend's VAIO laptop, actually. Windows 7. >Microsoft has made progress on supportin…

None of your complaints are about Windows. They're all, almost universally, about OEM and third-party shovelware. You want to avoid OEMs trashing your computer? Don't pretend this is about a lack of choice, or about Microsoft being stuck in the past. It's about you being ignorant of your options, or ignorant of the ecosystem. Buy a Signature Series machine from Microsoft.[1] No crapware, no bundled "features" or "tri…

None of your complaints are about Windows. They're all, almost universally, about OEM and third-party shovelware.

You can't separate windows from its ecosystem - it's allegedly the choice of vendors and the availability of commodity hardware that makes windows at all appealing for most computer users. And the windows ecosystem sucks - it's full of weeds and parasites. Windows can't be examined in the abstract - if 99 out of 100 randomly chosen configurations in the marketplace are just terrible, then that's just Windows. It's the incredible leeway that Microsoft gives IHVs that makes Windows as popular and at the same time as terrible as it is. That's what characterizes Windows. As an operating system, it isn't half bad (it's architecture is quite good, actually) . As a platform, it's terrible.

See, you're doing it again. You're not dealing with "Windows issues", you're dealing with issues on Windows boxes, caused by non-Windows problems

What exactly is it that you're arguing? It seems like you and the parent are largely in agreement and you're trying to generate friction.

I would contend that you're right that it's absolutely true that with enough research and with constant vigilance, you can bring a retail Windows system into an acceptable configuration, have all of your hardware enumerating properly, and avoid malware.

I would contend that the parent is right that maintaining a Windows system is just barely worth it if it's your own machine and is a hopeless time-sink if you're doing it for free for anyone else, like family.

Are you two really just arguing past each other?

The point here, though, is that you're not an idiot. Your family aren't idiots. You're just all too lazy for your own good.

Please see the posting guidelines. Personal attacks are not acceptable.

Re: Hidden backdoor API to root privileges in Apple OS X

#305

Post by laumars » Fri, Apr 10, 2015, 6:14 AM UTC

dragonwriter wrote: post #228

laumars wrote: post #225

Earlier quoted context omitted.

In fairness to Windows (and I can't believe I'm defending it because I happen to hate the platform!), bundling software is exactly what got Microsoft into trouble in previous years (Internet Explorer, MSN Messenger, Windows Defender, etc). Hopefully the package manager in Windows 10 will offer up a happy medium between expected software being easily available, and 3rd parties not being pushed out of the market place.

> In fairness to Windows (and I can't believe I'm defending it because I happen to hate the platform!), bundling software is exactly what got Microsoft into trouble in previous years (Internet Explorer, MSN Messenger, Windows Defender, etc). Except that bundling itself is not what got Microsoft in trouble. Having a monopoly , and then taking a coordinated series of actions relating to conditions of sale, bundling, an…

It's the same thing. If you don't have a monopoly then it's a feature, if you do have a monopoly then it's anti competitive.

I do agree that Microsoft did a whole boat load of other, really down right despicable, business practices as well. But in the MSN Messenger and Defender cases it was purely about shipping their own products preinstalled in Windows when competitors weren't included.

I guess you're right that my wording was perhaps a little too vague though. But my point was that when it comes to software bundling, Microsoft are damned if they do and damned if they don't.

Re: Hidden backdoor API to root privileges in Apple OS X

#306

Post by Untit1ed » Fri, Apr 10, 2015, 6:46 AM UTC

ekianjo wrote: post #288

endtime wrote: post #284

Earlier quoted context omitted.

I don't think I've ever had to install a driver manually on Windows 7.

So you don't have a GPU card I guess?

With XP this was valid, but from Windows 7 onwards you don't need to do it anymore unless you actually want to play a game - the majority of users would never need to at all.

Re: Hidden backdoor API to root privileges in Apple OS X

#307

Post by fr0styMatt2 » Fri, Apr 10, 2015, 7:34 AM UTC

lqdc13 wrote: post #277

fr0styMatt2 wrote: post #247

Earlier quoted context omitted.

I wish I could upvote this comment a million times. I see the same kind of ignorance-of-their-options (note I specifically say ignorance-of-their-options; I'm not saying anyone is generally ignorant) reflected when developers complain that it's hard to get under the hood of Windows or when developers complain about the tooling on Windows. You'd at least hope that this segment of the user-base would have more intellec…

I agree with the poster above about usability, but I disagree about ease of development. This is partially because linux is the dominant platform for Python developers, but developing/using Python libraries on Windows is really difficult. Many people simply overlook it. The default command prompt is really really bad. There are alternatives, but none of them come close to the gnome shell. The Batch scripting language…

I will say is that the Linux ecosystem has Windows beat hands-down when it comes to installing third-party apps and updating them - 'apt-get' is fantastic. OSX confuses me a little in that regard - some apps you copy to the Applications folder; others require an installer to run; for the ones that require an installer it's often not entirely clear how you uninstall them, etc. I always feel like OSX is a little inconsistent in that way. The Mac App Store is nice and unified updating through the app store is also nice.

Stability-wise my machines have actually been very good. I don't reboot much at all and mainly put the machine into suspend instead of turning it off. My first instinct/fear with a spontaneous BSOD now is that my RAM or HDD or something has gone bad.

Agree with you about development with things such as Python (though in that specific case I remember the Python Tools for Visual Studio being okay), or for that matter any new and upcoming language. My first thought when i want to try something like that out is to drop into Linux. It's just better supported for that kind of thing.

Re: Hidden backdoor API to root privileges in Apple OS X

#308

Post by syllogism » Fri, Apr 10, 2015, 7:49 AM UTC

brudgers wrote: post #283

jshevek wrote: post #269

Earlier quoted context omitted.

> JWZ used to say that Linux is only free if you don't value your time. Used to say? How long ago was that? Ubuntu and many other distros are incredibly easy and effortless to use. I know devs using apple products who spend more time mucking about with brew and other tools trying to accomplish things that are very easy to do on the most popular linux distros.

I prefer and run Linux. However, troubleshooting Linux issues, even on Ubuntu is a pain in the ass. The fact that Google's page rank favors older stable pages in search results is a factor. A forum post from 2004 is not the best source of information in regards to dual monitors (and xrandr). 2007 instructions for changing the default boot will be based around Grub. I shouldn't adjust ~/.bash_login in 14.10 despite wh…

On the Google search results page, click "search tools", and change "any time" to e.g. "past year".

Re: Hidden backdoor API to root privileges in Apple OS X

#309

Post by robbintt » Fri, Apr 10, 2015, 7:57 AM UTC

dzhiurgis wrote: post #263

andreyf wrote: post #257

Earlier quoted context omitted.

What about without local privilege escalation? Is there no way for a malware payload or RCE to turn your computer into a botnet without root privileges?

There are advertising networks that use JavaScript on client machine do distributed computing. Is that a botnet or not?

Do you know where I can observe this? I'd like to review the code.

Re: Hidden backdoor API to root privileges in Apple OS X

#310

Post by olefoo » Fri, Apr 10, 2015, 8:04 AM UTC

diminoten wrote: post #16

> Apple indicated that this issue required a substantial amount of changes on their side, and that they will not back port the fix to 10.9.x and older. What ? So all OS X boxes are simply broken, privileges-wise, if they're not on 10.10?

That's how I read it. And that's why I'm making plans to migrate away from Apple Desktop.