Live data from Hacker News

Hidden backdoor API to root privileges in Apple OS X

truesecdev.wordpress.com

51–60 of 367 posts

Re: Hidden backdoor API to root privileges in Apple OS X

#51
post #13
post #3

Related to this, how have people found running Yosemite compared to Mavericks, performance and compatibility-wise? Are you sorry you upgraded? (I'm asking for a friend.)

[deleted]

Xcode 6.3 is out now and requires 10.10. I also waited as long as I could, so now I have a machine that's been installing Yosemite for the last 18 hours...

Re: Hidden backdoor API to root privileges in Apple OS X

#52
post #50
post #27

I'm having a hard time understanding whether this is an intentional backdoor or just an accident.

Smells like an oversight to me. Some new developer got assigned to implement or tweak the SSH enabling switch (or whatever), and this was their solution, which never got reviewed.

In that case, I think "backdoor" is hyperbolic. That word is usually uses to indicate intentional secret security holes.

Re: Hidden backdoor API to root privileges in Apple OS X

#53
post #24

> Apple indicated that this issue required a substantial amount of changes on their side, and that they will not back port the fix to 10.9.x and older. What ? So all OS X boxes are simply broken, privileges-wise, if they're not on 10.10?

What better way to encourage people to upgrade.

There are still organizations paying huge stacks of money for Windows XP support past EOL.

Re: Hidden backdoor API to root privileges in Apple OS X

#54

Earlier quoted context omitted.

Apple's model customer is one who upgrades often. If you want solid support for old products, stick with Microsoft, and accept that their products can be clunkier because of deliberate choices to maintain backwards-compatibility.

To be fair, OS X updates are free and usually run well even on 5+ years old hardware. OS X has kinda gone the way of Chrome, with most users on the newest version.

To be even more fair, there's been a number of issues with Yosemite that make some of us want to stick with Mavericks.

Just because something is free doesn't make it better.

Re: Hidden backdoor API to root privileges in Apple OS X

#55

> Apple indicated that this issue required a substantial amount of changes on their side, and that they will not back port the fix to 10.9.x and older. What ? So all OS X boxes are simply broken, privileges-wise, if they're not on 10.10?

If nothing else, they should feel a moral obligation to fix it in previous versions.

Re: Hidden backdoor API to root privileges in Apple OS X

#56

> Apple indicated that this issue required a substantial amount of changes on their side, and that they will not back port the fix to 10.9.x and older. What ? So all OS X boxes are simply broken, privileges-wise, if they're not on 10.10?

They even released "Security Update 2015-004" at the same time, including many updates for 10.8 and 10.9, but not the admin framework.

https://support.apple.com/en-us/HT204659

Re: Hidden backdoor API to root privileges in Apple OS X

#58

> Apple indicated that this issue required a substantial amount of changes on their side, and that they will not back port the fix to 10.9.x and older. What ? So all OS X boxes are simply broken, privileges-wise, if they're not on 10.10?

Apple's model customer is one who upgrades often. If you want solid support for old products, stick with Microsoft, and accept that their products can be clunkier because of deliberate choices to maintain backwards-compatibility.

Or LTS versions of Linux.

Re: Hidden backdoor API to root privileges in Apple OS X

#59
post #43

Earlier quoted context omitted.

If you're seriously concerned, why not use an external drive of some sort and install Yosemite to it? (Bonus points: clone your internal disk to it first, and upgrade that.) Boot it up, test out your critical functions, and then update your main volume if it works out for you.

Would using an external drive make it noticeably slower, making performance non-representative?

Not if you get one of these:

http://www.amazon.com/Samsung-Portable-250GB-External-MU-PS2...

Re: Hidden backdoor API to root privileges in Apple OS X

#60

Earlier quoted context omitted.

Apple's model customer is one who upgrades often. If you want solid support for old products, stick with Microsoft, and accept that their products can be clunkier because of deliberate choices to maintain backwards-compatibility.

To be fair, OS X updates are free and usually run well even on 5+ years old hardware. OS X has kinda gone the way of Chrome, with most users on the newest version.

Indeed, I'm running 10.10 on a 2006 Mac Pro, and it's running really really well (boot.efi replaced to get it working, not supported:).

I was surprised just how well it's working tbh.

Post reply on HN