Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS lock screen: “I just sent my session pass to my whole team”

twitter.com

Post reply on HN
Print view View original

261–270 of 276 posts

Re: macOS lock screen: “I just sent my session pass to my whole team”

#261

Post by abakker »

joeblau wrote: post #207
tracker1 wrote: post #164

Earlier quoted context omitted.

I'm pretty sure you'd find a LOT of people to do that work for $300k/year... Apple has lots of money to go as far as they like.

Yeah, but if you can make $300k a year, you're likely not dedicating your software engineering career to fixing bugs. Also, you can go a few miles south to Los Gatos and work at Netflix and make $400k/year.

I am not an engineer, but from my non-technical POV, this seems ridiculous. Is the cult of building new software really so much more attractive than making the software actually work? I mean, I think this attitude perfectly encapsulates why Apple has problems. Is bug fixing much harder than building the systems from the beginning? Is the difficulty in reading and checking code for errors really hiding the fact that this "unsexy" work of bug fixing involves the actual difficulty?

If, in any other field you found people that only wanted to make first drafts, you'd call them copywriters and designers, not engineers. And even if it is totally normal to eschew bug fixing in favor of drafting, isn't there a salary that would cause people to do it? If so, Apple should just pay that and hire those people - it'll still pay off in the long run.

Re: macOS lock screen: “I just sent my session pass to my whole team”

#262

Post by floatboth »

pornel wrote: post #185
floatboth wrote: post #149

Earlier quoted context omitted.

If you reused the password, yeah, instant pwnage everywhere. If your local account password isn't used anywhere else, meh, random IRC people don't have physical access to your machine :)

Unless you have remote SSH logon enabled and IRC exposes your IP address.

Remote logon with passwords allowed and sshd exposed to the whole internet (not behind ISP's NAT, not behind home NAT, port allowed on home firewall, port allowed on laptop firewall).

Re: macOS lock screen: “I just sent my session pass to my whole team”

#263

Post by pfranz »

gurkendoktor wrote: post #258
pfranz wrote: post #204

Earlier quoted context omitted.

Clamshell mode has notoriously been a problem for many years over a bunch of models. Sleep/wake has usually been way better than Windows or Linux, but has also had it's share of problems. The sleep/wake issues usually get fixed, the clamshell issues from what I've gathered get resolved less often.

I've just bought my first MacBook Pro with a dedicated GPU this year, and I'm having WAY more tiny glitches than with the pure Intel machines I'd had before. (10.13 has thankfully fixed lots of them!) I love my 5K screen, but I hope I'll never have to buy a machine with GPU switching again.

I'm really surprised Apple is still releasing MacBook Pros with gpu switching after all these years. They've always had serious problems and I figure they would stop selling them or make the major changes needed to resolve the issue.

Thankfully, I haven't owned one, but I hear so much. Which sucks, because there are more and more nvidia-specific things I'd like to do on a mac laptop.

Re: macOS lock screen: “I just sent my session pass to my whole team”

#264

Post by abakker »

gurkendoktor wrote: post #259
joeblau wrote: post #152

Earlier quoted context omitted.

I'm guessing that it's going to be pretty difficult to hire an engineer who is: - Very good - Wants to live near Palo Alto - Is able to live in the US - Wants to be subjected to Apple's privacy rules - Wants to work on fixing bugs instead of making new features In the software engineering game, money only goes so far.

If I could work from a European Apple office, this would be 100% my dream job. When you implement new features, you are slave to your marketing department - I'd hate to waste my time on pointless gimmicks like the macOS Siri UI, for example. Maintenance work is much more satisfying because you're directly serving your users (usually skewing towards power users too!). Also, I don't think the privacy restrictions would…

For a company that loves minimalism so much, you've hit it right on the money WRT management.

The TouchBar, while interesting, is the perfect example of this. I'd love to have had it along with the physical buttons - there's plenty of room. Alone, though, it is pretty weird.

I assume that the real problem is that Apple's managers do email and web browsing, and that's it. They probably don't spend enough time in pro apps or trying to be productive to understand that a window manager built in, or physical keys or an improvement to their native text editor would be helpful.

Re: macOS lock screen: “I just sent my session pass to my whole team”

#265

Post by CodeWriter23 »

daveFNbuck wrote: post #248
CodeWriter23 wrote: post #214

Earlier quoted context omitted.

So, security through obscurity. No thanks. I'd rather know about the exploit ASAP so I can implement a workaround, rather than wait months for the vendor to get off their ass while my systems are getting hacked by the hundreds if not thousands of hackers that have 0-day knowledge. Calling what you describe as "Responsible" is intellectually dishonest.

What do you think it is that I'm calling responsible? I'm in favor of the public disclosure for this particular bug, and that seems to be your position too.

Sorry, I man-read your first sentence then hit reply. Please accept my apology.

Re: macOS lock screen: “I just sent my session pass to my whole team”

#266

Post by CodeWriter23 »

will_hughes wrote: post #233
CodeWriter23 wrote: post #214

Earlier quoted context omitted.

So, security through obscurity. No thanks. I'd rather know about the exploit ASAP so I can implement a workaround, rather than wait months for the vendor to get off their ass while my systems are getting hacked by the hundreds if not thousands of hackers that have 0-day knowledge. Calling what you describe as "Responsible" is intellectually dishonest.

Perhaps you can write a patch or mitigate effects of (say) an OpenSSL bug. I can't. Certainly not for the myriad of devices that embed well known libraries in firmware images that I don't get to modify myself. I'd much rather that those things which are remotely exploitable across millions of devices to be kept quite for a small period of time (30-90 days depending on the complexity of the fix required) so that I can…

There are numerous potential workarounds besides authoring a patch. And they can be distributed in a user-accessible fashion, like the workaround for the macOS blank root password was.

Not telling the world about it does not keep shit from burning down. Eliminating vulnerable targets is the only thing that does that. And that is more expediently served by full and prompt disclosure.

Re: macOS lock screen: “I just sent my session pass to my whole team”

#267

Post by lostlogin »

Arnt wrote: post #256
lostlogin wrote: post #140

Earlier quoted context omitted.

But what about pop ups that come from within the application? Anything that has dialogues come up when there is a chance the user might be using enter/return for a different purpose is a bit crap, especially with multi-screen systems where there is a fair chance the user is looking elsewhere. Even just having no pre-selected default would help (so arrow - enter/return would be needed).

Is this an example of what you have in mind: The user is typing at Microsoft Word, and it's not a keyboard shortcut to open the "document properties" window, and Microsoft Word chooses to open another window during the typing and divert keyboard focus there?

I think so, yes. Diverting keyboard focus in the middle of anything should never happen. Should there any exception to this?

Re: macOS lock screen: “I just sent my session pass to my whole team”

#268

Post by lostlogin »

linkregister wrote: post #225
lostlogin wrote: post #74

Earlier quoted context omitted.

Hell yes. I wonder wha’s the worst thing someone has done with this? When you hit return and just before the keystroke a pop up comes up and you agree to something you didn’t want. I’ve see a couple of bad ones in the radiology world.

Yes, stealing focus by another application should not be permitted by the window manager / OS. Windows XP had a feature or a 3rd party plugin that would simply blink the application in the task bar if it attempted to steal focus. I also seem to remember a similar feature in Gnome 2, though it could be a false memory.

I remember this (I think). The worst offenders that come to mind for me are applications themselves, not other programs or the OS.

Edit: a possible exception being the “please enter your iCloud password” curse I somehow cast on myself sometimes.

Re: macOS lock screen: “I just sent my session pass to my whole team”

#269

Post by fny »

y3sh wrote: post #136

FWIW this is a known security bug at Apple. I filed a bug about similar behavior where you can see the desktop briefly without logging in. Apple marked it as a duplicate. https://imgur.com/YxXtU2y Here are the steps to reproduce: - Start Mac - Login - Turn on Screen Lock: System Preferences > Security > General > Check "Require Password" and Select 5 Seconds. - Turn on Hot Corner Sleep Display: System Preferences > M…

I actually think I've experienced something similar across every OS I've ever used. With Linux distros I was always able to trigger it by opening and closing the lid a few times. With Windows, I don't remember the exact sequence or what version.

Overall, there appears to be something funky with this overlay technique and how things are asynchronously rendered.

Re: macOS lock screen: “I just sent my session pass to my whole team”

#270

Post by zeveb »

quesera wrote: post #242
eridius wrote: post #230

Earlier quoted context omitted.

macOS has something called Fast User Switching, which is completely separate login sessions, but you access it through a menu on the right side of the menubar, not with keys. macOS also has Spaces, which is just virtual desktops, but again, it doesn't use the F-keys to switch between them.

I'm strongly reading GP comments as trolling, given indirect context, but I respect your approach of taking the high road by assuming simple ignorance.

I really wasn't trolling. I've not used macOS for almost twenty years now, so I genuinely didn't know if it supported multiple graphics consoles. I'm not surprised that it does, but I wouldn't have been terribly surprised if it didn't, either.

My (un-trolling) point still stands, though: I use the Function keys on a daily basis, to switch between consoles.

Post reply on HN