Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS lock screen: “I just sent my session pass to my whole team”

twitter.com

Post reply on HN
Print view View original

251–260 of 276 posts

Re: macOS lock screen: “I just sent my session pass to my whole team”

#251

Post by bartvk »

jamesfmilne wrote: post #32
malchow wrote: post #31

Not to pile on, but my MBP (with "TouchBar" which will assuredly not exist in another year) is always in clamshell mode and connected to two external LG 4K displays. Whether, on which screen(s), or in what state the Mac wakes each morning is completely random. Sometimes it doesn't wake at all. Sometimes I have artifacts on one screen and a desktop on another screen. The sleep/wake sequence is a complete mess, and it…

I have a similar problem running my touchbar Macbook Pro in clamshell mode via a CalDigit USB-C dock. All sorts of issues with it discovering USB devices when you plug the hub in too.

Really!? Me too. I have the USB discovery problem with two other hubs. It only recently started, maybe since 10.13.1 or so.

Re: macOS lock screen: “I just sent my session pass to my whole team”

#252

Post by daveFNbuck »

gaius wrote: post #188
EpicEng wrote: post #127

Earlier quoted context omitted.

Yes because I'm sure those same people are also able to work on security.

Someone made the decision, this year we will hire X number of security engineers and Y number of poop animators. Ultimately that guy is Tim Cook.

You can't just hire arbitrary numbers of security engineers. These positions are difficult to fill. There's a good chance that Tim Cook wanted to hire more security engineers than was possible.

Re: macOS lock screen: “I just sent my session pass to my whole team”

#253

Post by bartvk »

ebbv wrote: post #76

The quality of the software and the sacrifice of key functionality in the hardware (dropping of MagSafe, which was a huge differentiator, going to just USB-C ports which almost nothing supports, not even Apple's own in box phone chargers) demonstrates that Apple is purely a design house lately. It has completely faltered on the engineering side. Tim Cook is not an engineer and Jony Ive is not an engineer. There are e…

You talk as though you're stating facts. However I very much like USB-C for the usual reasons. Of course it's in the early stages, but personally I hook up all my peripherals to my laptop with a single cable. Much convenience.

Re: macOS lock screen: “I just sent my session pass to my whole team”

#254

Post by jagermo »

gonational wrote: post #63

With no disrespect to the developers at Apple, et al, each one of these problems that goes viral before reaching “proper” channels is a well-deserved slap in the face of these behemoth organizations. Perhaps, if the entire tech community regards Apple as a joke, they will start paying attention. “Responsible disclosure” is great stuff for creating a culture of free outsourcing of tech companies’ most imporant feature…

If you look at the "root" issue last week, public shaming seems to be the only way to get Apple to work on problems in macOS.

They didn't even include it into the big bounty, did they?

It feels like they don't give a shit about non-iOS-devices.

Re: macOS lock screen: “I just sent my session pass to my whole team”

#255

Post by pfranz »

thomastjeffery wrote: post #241
pfranz wrote: post #238

Earlier quoted context omitted.

I completely agree it is an advantage and I'm very happy there are options that are mostly Open Source (I say mostly because I'm not a fan of binary drivers, which are often a necessity for decent performance or features). > Why all-or-nothin? The parent was citing the existence of a few specific bugs in macOS and Open Source as an alternative (implying it wasn't vulnerable). I really think the "given enough eyeballs…

> too much comfort That may be true, but the alternative is certainly worse.

I really think you're overstating things because that's not true for a majority of people. A 0-day found in open source code is no different than a 0-day in closed source. In both cases you need to responsibly disclose it to the maintainer and sit and wait for the fix to trickle through support channels. With open source you can attempt to submit a patch.

If I found a bug in ssl, I can't imagine I'd re-compile that and track down every package I use that relies on it and re-compile those. Everyone uses their own build system and managing dependencies suck. I'd try and mitigate the risk against those tools until fixes were distributed through normal channels--just like I would in Windows or macOS.

If I was a large company, with closed source software I would have a vendor agreement to get fixes/changes, with open source I would have the expertise in-house and extra labor (or I'd have an agreement with a support company like Red Hat much like closed source software). A small company likely won't have the expertise in house or the spare bandwidth to mess with those things. For home users it would have to be someone with a serious hobby and specific skills.

Re: macOS lock screen: “I just sent my session pass to my whole team”

#256

Post by Arnt »

lostlogin wrote: post #140
Arnt wrote: post #85

Earlier quoted context omitted.

It's not too difficult. a) only the application with keyboard focus gets to open new windows with keyboard focus less than about two seconds after a keystroke (with no intervening mouse activity). b) no keyboard input into a new window for the first second, unless the user clicks there. We looked into this while I was Trolltech. Decided against doing it for Qt unilaterally, it's really something the system must do, o…

But what about pop ups that come from within the application? Anything that has dialogues come up when there is a chance the user might be using enter/return for a different purpose is a bit crap, especially with multi-screen systems where there is a fair chance the user is looking elsewhere. Even just having no pre-selected default would help (so arrow - enter/return would be needed).

Is this an example of what you have in mind: The user is typing at Microsoft Word, and it's not a keyboard shortcut to open the "document properties" window, and Microsoft Word chooses to open another window during the typing and divert keyboard focus there?

Re: macOS lock screen: “I just sent my session pass to my whole team”

#257

Post by gurkendoktor »

tachion wrote: post #13

Oh, wow - I've reported this problem along with na example exploit to Apple about 6-7 years ago. Never got any recognition for it, but It was fixed some time after that. It's quite sad to see old bugs getting new lives like that. For those interested, the sample exploitation that I've discovered was connecting any iPod/iPhone device to a OSX laptop while screen was locked was taking the focus away from login prompt '…

Hah. I've reported a similar issue with attaching an iDevice to a locked Mac in 2014. In my case, iTunes was opening a new space to restore its window in fullscreen mode, and the desktop contents were revealed while the animation was running (the lockscreen reappeared afterwards). Now I'm disappointed that I didn't try to get keyboard input into the system and fully pwn myself :)

Re: macOS lock screen: “I just sent my session pass to my whole team”

#258

Post by gurkendoktor »

pfranz wrote: post #204
malchow wrote: post #31

Not to pile on, but my MBP (with "TouchBar" which will assuredly not exist in another year) is always in clamshell mode and connected to two external LG 4K displays. Whether, on which screen(s), or in what state the Mac wakes each morning is completely random. Sometimes it doesn't wake at all. Sometimes I have artifacts on one screen and a desktop on another screen. The sleep/wake sequence is a complete mess, and it…

Clamshell mode has notoriously been a problem for many years over a bunch of models. Sleep/wake has usually been way better than Windows or Linux, but has also had it's share of problems. The sleep/wake issues usually get fixed, the clamshell issues from what I've gathered get resolved less often.

I've just bought my first MacBook Pro with a dedicated GPU this year, and I'm having WAY more tiny glitches than with the pure Intel machines I'd had before. (10.13 has thankfully fixed lots of them!) I love my 5K screen, but I hope I'll never have to buy a machine with GPU switching again.

Re: macOS lock screen: “I just sent my session pass to my whole team”

#259

Post by gurkendoktor »

joeblau wrote: post #152
abakker wrote: post #142

So, Apple has the most available cash resource of any company out there (or at least close to). Yet, bugs galore, and strange product decisions. The obvious conclusion is that their management is failing to staff accordingly to the work that needs to be done. This could be because they are not aware that work needs to be done, which means engineers are not telling them, or that the management is not succeeding in hir…

I'm guessing that it's going to be pretty difficult to hire an engineer who is: - Very good - Wants to live near Palo Alto - Is able to live in the US - Wants to be subjected to Apple's privacy rules - Wants to work on fixing bugs instead of making new features In the software engineering game, money only goes so far.

If I could work from a European Apple office, this would be 100% my dream job. When you implement new features, you are slave to your marketing department - I'd hate to waste my time on pointless gimmicks like the macOS Siri UI, for example. Maintenance work is much more satisfying because you're directly serving your users (usually skewing towards power users too!).

Also, I don't think the privacy restrictions would be so bad. Apple's UIKit engineers occasionally chit-chat with indie devs on Twitter.

The problem is that this job would be absolutely futile. If Apple hired 100 great engineers to fix bugs, management would simply double the amount of features that go into each yearly release.

Re: macOS lock screen: “I just sent my session pass to my whole team”

#260

Post by hhbbhhg »

j_s wrote: post #52

I often wonder how many authentication log files contain passwords because people in a hurry append it to the username on accident (not visually confirming the Tab/Enter/switch to the password entry). This is also vaguely similar to the 'test SSL submit' security technique of first entering enough data into login forms to process a submission, and then entering real login info into the 'login failed' retry page after…

> I often wonder how many authentication log files contain passwords because people in a hurry append it to the username on accident

Is this why everyone does 2-step login on websites now?

Post reply on HN