Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple patches CVE-2020-9859 (unc0ver)

support.apple.com

Post reply on HN
Print view View original

41–50 of 79 posts

Re: Apple patches CVE-2020-9859 (unc0ver)

#41

Post by machello13 »

jmull wrote: post #14
baggy_trough wrote: post #10

Be nice if they could patch a kernel bug in macOS with less than a 1.5GB download.

It might seem strange, but they are using a change/build/deploy mechanism designed to deliver updates to any and all parts of an OS across a range of hardware devices. I'm pretty sure the mechanism, from end-to-end, is complex, and providing an optimized path for small changes would require resources, introduce more risk, and come at the expense of something else. Sucks, though, for everyone who doesn't have a reason…

It's funny how rarely you see a reasonable response to a question about "why doesn't my software do X" on a site full of software developers.

Re: Apple patches CVE-2020-9859 (unc0ver)

#42

Post by hu3 »

Wowfunhappy wrote: post #33
jmull wrote: post #14

Earlier quoted context omitted.

It might seem strange, but they are using a change/build/deploy mechanism designed to deliver updates to any and all parts of an OS across a range of hardware devices. I'm pretty sure the mechanism, from end-to-end, is complex, and providing an optimized path for small changes would require resources, introduce more risk, and come at the expense of something else. Sucks, though, for everyone who doesn't have a reason…

I apologize if this is a stupid question, but, is there a reason they can't do a diff patch on the binary? Would it end up not introducing savings?

Incompetence.

A private company can deliver two human beings alive to a point in space with millimeter precision. Meanwhile another can't deliver Operating Systems without gross bugs or smaller updates with binary diff patching.

Re: Apple patches CVE-2020-9859 (unc0ver)

#43

Post by igreulich »

machello13 wrote: post #41
jmull wrote: post #14

Earlier quoted context omitted.

It might seem strange, but they are using a change/build/deploy mechanism designed to deliver updates to any and all parts of an OS across a range of hardware devices. I'm pretty sure the mechanism, from end-to-end, is complex, and providing an optimized path for small changes would require resources, introduce more risk, and come at the expense of something else. Sucks, though, for everyone who doesn't have a reason…

It's funny how rarely you see a reasonable response to a question about "why doesn't my software do X" on a site full of software developers.

I would venture to guess that often it is because the answer is 'business reasons', which is often not reasonable.

Re: Apple patches CVE-2020-9859 (unc0ver)

#44

Post by LeoPanthera »

joshocar wrote: post #32
jmull wrote: post #14

Earlier quoted context omitted.

It might seem strange, but they are using a change/build/deploy mechanism designed to deliver updates to any and all parts of an OS across a range of hardware devices. I'm pretty sure the mechanism, from end-to-end, is complex, and providing an optimized path for small changes would require resources, introduce more risk, and come at the expense of something else. Sucks, though, for everyone who doesn't have a reason…

I work on a ship part of the year. Satellite internet shared between 50 people. These Apple updates would saturate the network and grind it to a halt before we started blocking them on the firewall. iMessage got caught in the crossfire and now sometimes works and sometimes doesn't.

If you have at least one Mac, you can use Content Caching:

https://support.apple.com/guide/mac-help/what-is-content-cac...

It works for iCloud content, too.

Re: Apple patches CVE-2020-9859 (unc0ver)

#45

Post by clairity »

igreulich wrote: post #43
machello13 wrote: post #41

Earlier quoted context omitted.

It's funny how rarely you see a reasonable response to a question about "why doesn't my software do X" on a site full of software developers.

I would venture to guess that often it is because the answer is 'business reasons', which is often not reasonable.

that's a flippant guess. the underlying reasons or the reasoning for others' decisions may not be apparent to you (i.e., under-explained).

beyond that, if decisions others make often seem not reasonable, it's probable that you disagree with the values on which those decisions are based, rather than those business decisions being without reason. you may be entirely justified in your disagreement, but that's a different animal from unreasonableness.

also, most business decisions are made under uncertainty and with imperfect information (under-informed), and many can seem less reasonable in hindsight as a result.

in any case, it's really unlikely that decision makers are chaos monkeys even if it seems that way from your vantage point.

Re: Apple patches CVE-2020-9859 (unc0ver)

#46

Post by minedwiz »

jmull wrote: post #14
baggy_trough wrote: post #10

Be nice if they could patch a kernel bug in macOS with less than a 1.5GB download.

It might seem strange, but they are using a change/build/deploy mechanism designed to deliver updates to any and all parts of an OS across a range of hardware devices. I'm pretty sure the mechanism, from end-to-end, is complex, and providing an optimized path for small changes would require resources, introduce more risk, and come at the expense of something else. Sucks, though, for everyone who doesn't have a reason…

I just wish it didn't take 30 minutes to install, even on modern Macs with PCIe drives.

Re: Apple patches CVE-2020-9859 (unc0ver)

#47

Post by saagarjha »

why_only_15 wrote: post #30
saagarjha wrote: post #28

Earlier quoted context omitted.

That's a bit before I was using iOS, so I'll take your word on that one ;) AFAIK some system call filtering went into WebKit at some point to make this specific exploit unreachable from the web process, so I guess you could call it "less severe" than JailbreakMe was. That being said, I guess "zero day affecting all current devices" is probably good enough to get priority. (FWIW, heavily publicized non-security bugs o…

That syscall filtering still exists and broke a build for three or four days recently.

Is this something that made it into the public WebKit sources? Would be curious to see the commit for that :)

Re: Apple patches CVE-2020-9859 (unc0ver)

#48

Post by rowawey »

snazz wrote: post #37
rowawey wrote: post #31

Earlier quoted context omitted.

You didn't communicate that. There is no "download" to delete on iOS (and derivatives) and it's managed by the system on macOS. It's not a small delta when it should be tiny (100 MiB), that eats up data plan and storage.

You can delete a downloaded (but not installed) update on iOS.

That's not my point. It's not a user-accessible file, but still steals space from the user.

Re: Apple patches CVE-2020-9859 (unc0ver)

#49

Post by prvc »

saagarjha wrote: post #5

I think this might be the fastest patch of a security issue affecting Apple's operating systems, ever. Aside from *.0.1 releases that fixed critical bugs with core features in new OSes, has anything been patched this fast? (I'm also obligated to post that the bug that this fixes is not new; it was discovered back in iOS 11, fixed, and Apple reopened it in an iOS 13 update: https://www.synacktiv.com/posts/exploit/retu…

If that doesn't illustrate their true priorities re: user security/ privacy, then I'm not sure what could.
Post reply on HN