Six months for a fix? I would have given them 90 days and released it.
Hidden backdoor API to root privileges in Apple OS X
61–70 of 367 posts
Re: Hidden backdoor API to root privileges in Apple OS X
#62Earlier quoted context omitted.
If you're seriously concerned, why not use an external drive of some sort and install Yosemite to it? (Bonus points: clone your internal disk to it first, and upgrade that.) Boot it up, test out your critical functions, and then update your main volume if it works out for you.
Would using an external drive make it noticeably slower, making performance non-representative?
That would depend on which interface and drive technologies you use. A SSD connected via Thunderbolt would likely be faster than an internal hard drive.
Re: Hidden backdoor API to root privileges in Apple OS X
#63Earlier quoted context omitted.
Apple's model customer is one who upgrades often. If you want solid support for old products, stick with Microsoft, and accept that their products can be clunkier because of deliberate choices to maintain backwards-compatibility.
To be fair, OS X updates are free and usually run well even on 5+ years old hardware. OS X has kinda gone the way of Chrome, with most users on the newest version.
Maybe most personal users but those of us in larger IT-managed organizations don't always have the luxury of updating on day one (point: I am on 10.9.5 right now).
Re: Hidden backdoor API to root privileges in Apple OS X
#64Earlier quoted context omitted.
Smells like an oversight to me. Some new developer got assigned to implement or tweak the SSH enabling switch (or whatever), and this was their solution, which never got reviewed.
In that case, I think "backdoor" is hyperbolic. That word is usually uses to indicate intentional secret security holes.
I guess. It's a backdoor in the sense that you can intentionally bypass privilege checks by calling a certain API with a particular argument. But I don't think it's a backdoor in the sense that the developers wanted a secret way to gain root on an arbitrary machine.
Re: Hidden backdoor API to root privileges in Apple OS X
#65Earlier quoted context omitted.
What better way to encourage people to upgrade.
"What better way to encourage people to upgrade." The majority of their user base doesn't know and wouldn't care about this type of thing even if they did.
They'll care when their mouse starts moving by itself.
Re: Hidden backdoor API to root privileges in Apple OS X
#66Earlier quoted context omitted.
Smells like an oversight to me. Some new developer got assigned to implement or tweak the SSH enabling switch (or whatever), and this was their solution, which never got reviewed.
In that case, I think "backdoor" is hyperbolic. That word is usually uses to indicate intentional secret security holes.
Worked wonders for getting to the top of HN though.
Re: Hidden backdoor API to root privileges in Apple OS X
#67Earlier quoted context omitted.
Apple's model customer is one who upgrades often. If you want solid support for old products, stick with Microsoft, and accept that their products can be clunkier because of deliberate choices to maintain backwards-compatibility.
To be fair, OS X updates are free and usually run well even on 5+ years old hardware. OS X has kinda gone the way of Chrome, with most users on the newest version.
I'm currently running 10.10.3 on a Mac Pro 1,1, at almost 9 years of use. Of course 10.10 isn't supported by Apple, but it works just fine, and with the combination of an SSD and cheap RAM, I imagine I can get another 3-4 years out of this desktop barring a hardware failure that pushes me to a new system.
Re: Hidden backdoor API to root privileges in Apple OS X
#68Objective-C's "null pointer dereferences doesn't crash" behaviour rears its ugly horrible head again.
Programs crash for a reason! Crashing when faced with nonsense is a good thing! Let us not forget this.
Re: Hidden backdoor API to root privileges in Apple OS X
#69OT but I have to say that the amount of Apple apologists in these comments is mind blowing. HN reader of all people should be the ones urging Apple to issue a fix for a very serious bug such as this one. Yet many comments here are saying that people should just upgrade while it might solve the problem for some, there are ones who can't upgrade machines at will.
Re: Hidden backdoor API to root privileges in Apple OS X
#70I am really pissed they are only releasing a patch for 10.10, and forcing me to upgrade to 10.10.