Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reverse Engineering MacOS High Sierra Supplemental Update

cocoaengineering.com

Post reply on HN
Print view View original

111–120 of 135 posts

Re: Reverse Engineering MacOS High Sierra Supplemental Update

#111

Post by feelin_googley »

"This research has shone a light on some of the ways in which security patch support provided by Apple for 'firmware' is quite different than the security patch support they provide for 'software'."

"You can be software 'secure' but firmware vulnerable."

"The release QA on the FirmwareUpdate bundles is concerning."

https://duo.com/assets/ebooks/Duo-Labs-The-Apple-of-Your-EFI...

"The advent of UEFI brought with it a far more 'modern' pre-boot environment and 'finally' put an end to the many years of legacy workarounds that had to be applied to the aging IBM BIOS 'standard', providing a common, uniform and higher-level platform to 'innovate' on."

"However, that uniformity and accessibility also opened the door to far more generic and useful pre-boot environment attack opportunities."

Re: Reverse Engineering MacOS High Sierra Supplemental Update

#112

Post by emsy »

eru wrote: post #45
emsy wrote: post #12

Earlier quoted context omitted.

You don't even need static analysis (which they should use too) but just a strict coding style check that enforces curly braces. Should've happened after the first incident!

A coding style check _is_ static analysis. (But that's beating a straw man, of course: with that expanded definition your comment just because "you don't even need anything more than the most primitive forms of static analysis".)

I think the point I was trying to make was: If they don't even check for rudimentary things like coding style, can we expect them to check for more sophisticated sources of issues (e.g. memory corruption).

Re: Reverse Engineering MacOS High Sierra Supplemental Update

#113

Post by module0000 »

toyg wrote: post #98
pducks32 wrote: post #86

Earlier quoted context omitted.

If they thought of doing that they could and probably should be sued. CEOs have a fiduciary duty meaning they are legally implored to do what is best for the company and bringing money back at a 40% tax is not in the financial interest of the company.

Any judge would rule that following the law of the land is not against the interest of the company.

The judge has zero say in the CEO keeping his job though, and firing is a foregone conclusion when you make a decision that kills shareholder value. Decisions that don't increase shareholder value are "dubious" at best, and decisions that obviously decrease shareholder value are "insane" at best to the board.

Re: Reverse Engineering MacOS High Sierra Supplemental Update

#114

Post by Twisell »

danra wrote: post #16

It's pretty insane this sort of bug either passed or didn't even go through code review and testing at Apple, a company which has approximately infinite resources and whose marketing pitch is making high-quality products. I loved Apple products and still do, but as both a user of and a developer for their systems, I feel the quality has been steadily going downhill the last few years.

I strangely feel reassured by the post-mortem of this bug:

-It appear genuinely involuntary

-It's a (collective) human mistake not a design flaw

-It was quickly fixed

-Frankly if it's the only noticeable bug linked to the conversion of a huge userbase to a new file system this is actually a huge success

Re: Reverse Engineering MacOS High Sierra Supplemental Update

#115

Post by TheAceOfHearts »

jackhack wrote: post #104
madeofpalk wrote: post #95

Earlier quoted context omitted.

Never buy the first version of any new product

Mostly, that's true. Or at least understand you're on the edge. Cutting or bleeding, it's hard to say ahead of time but usually pretty obvious after a week of real-world use. I respect Apple, they take chances. Sometimes it pays off. Off the top of my head: Products where 1st generation was amazing: Apple ][ iPod Lisa iPhone Products where 1st gen was almost unusable, but v2+ was amazing: Macintosh (Amazing, but freq…

Original iPhone didn't have 3G, which many definitely considered to be a huge flaw. It also didn't have native applications.

Re: Reverse Engineering MacOS High Sierra Supplemental Update

#116

Post by 27182818284 »

rusk wrote: post #97
veidr wrote: post #71

Earlier quoted context omitted.

I think you might be looking at the past through rose-colored glasses. Apple's always had horrible show-stopping bugs, in every single OS X / macOS release[1], from when simple operations like updating iTunes or enabling the OS's Guest Mode might delete your home directories, to this latest failure. I suspect one reason is that they like one-person teams so much. I like one-person projects too! But there is always pa…

except maybe Mac OS X 10.6 Snow Leopard. What a wonderful high-point in Desktop OSes that was. Seriously considering rolling back one or two of my old computers, even just to have a living breathing reference-point.

Snow Leopard was so good it was like exciting. I couldn't wait to get my hands on the final release and installing it felt more akin to getting a new video game.

You evangelized it to friends back then even. Like "Dude you have to get this"

Re: Reverse Engineering MacOS High Sierra Supplemental Update

#117

Post by microtonal »

veidr wrote: post #71
danra wrote: post #16

It's pretty insane this sort of bug either passed or didn't even go through code review and testing at Apple, a company which has approximately infinite resources and whose marketing pitch is making high-quality products. I loved Apple products and still do, but as both a user of and a developer for their systems, I feel the quality has been steadily going downhill the last few years.

I think you might be looking at the past through rose-colored glasses. Apple's always had horrible show-stopping bugs, in every single OS X / macOS release[1], from when simple operations like updating iTunes or enabling the OS's Guest Mode might delete your home directories, to this latest failure. I suspect one reason is that they like one-person teams so much. I like one-person projects too! But there is always pa…

I think you might be looking at the past through rose-colored glasses.

Indeed, we tend to forget the problems. I tend to have the same feeling (10.5 and 10.6 were rock-solid), but with a little digging I found this comment from 2008-me on another website:

And a lot doesn't. My printer (a Laserjet 5L, connected through a parallel to USB converter) works without a hassle on GNU/Linux. It worked terrible on Leopard until 10.5.2, after a certain number of pages, it just refused to print anything but empty or mangled pages.

Similarly, the wireless support is quite bad in Leopard. E.g. I worked for two months on the Eduroam wireless network full-time. On a MacBook plus Leopard, the connection was constantly dropped, and it usually took ten minutes to authenticate succesfully. A friend, who has an Ubuntu laptop OTOH, had no problems connecting at all.

[snip Linux rant, irrelevant]

Re: Reverse Engineering MacOS High Sierra Supplemental Update

#118

Post by r00fus »

TheAceOfHearts wrote: post #115
jackhack wrote: post #104

Earlier quoted context omitted.

Mostly, that's true. Or at least understand you're on the edge. Cutting or bleeding, it's hard to say ahead of time but usually pretty obvious after a week of real-world use. I respect Apple, they take chances. Sometimes it pays off. Off the top of my head: Products where 1st generation was amazing: Apple ][ iPod Lisa iPhone Products where 1st gen was almost unusable, but v2+ was amazing: Macintosh (Amazing, but freq…

Original iPhone didn't have 3G, which many definitely considered to be a huge flaw. It also didn't have native applications.

It's not a huge flaw, as the mobile 3G (esp. AT&T's) networks weren't that good in 2007.

The fact that you could get (edge speed) unlimited internet for $20/iPhone was pretty amazing. Same for Palm/Verizon was $45 and more for 3G.

Native apps showed up in jailbreaks which I installed literally months after the release. The app install process was unparalleled.

Re: Reverse Engineering MacOS High Sierra Supplemental Update

#120

Post by madeofpalk »

TheAceOfHearts wrote: post #115
jackhack wrote: post #104

Earlier quoted context omitted.

Mostly, that's true. Or at least understand you're on the edge. Cutting or bleeding, it's hard to say ahead of time but usually pretty obvious after a week of real-world use. I respect Apple, they take chances. Sometimes it pays off. Off the top of my head: Products where 1st generation was amazing: Apple ][ iPod Lisa iPhone Products where 1st gen was almost unusable, but v2+ was amazing: Macintosh (Amazing, but freq…

Original iPhone didn't have 3G, which many definitely considered to be a huge flaw. It also didn't have native applications.

Lacking features is not what the “don’t buy first version” people are talking about.

They’ve warning against unknown bugs, not the obvious and known lack of 3G

Post reply on HN