Does this work from single user mode?
macOS High Sierra: Anyone can login as “root” with empty password
801–810 of 1001 posts
Re: macOS High Sierra: Anyone can login as “root” with empty password
#802I wonder what is going on with software quality and testing at Apple. It feels like recently there have been quite a few issues like this (the FileVault password bug, numerous issues with iOS 11, the issue that totally broke iOS Safari a couple of years ago) which should have been fairly easily caught, especially given the limited range of devices their software runs on. I know testing is hard, but a company with App…
Anecdotal but I started noticing a decline in quality after Steve Jobs died.
i'm still wondering if that impression ( which i share) is real or not.
At the minimum, i'd say i feel apple release less innovating os versions while producing at least the same number of bugs.
Re: macOS High Sierra: Anyone can login as “root” with empty password
#803This is comical at this point. I have no idea how such vulnerable software makes it to production. It is really ironic that a company, making billions of dollars and branding itself as the leaders of quality, stability and so on, to have this kind of vulnerability. I have truly lost faith in Apple.
> and branding itself as the leaders of quality, stability
> and so on
Re: macOS High Sierra: Anyone can login as “root” with empty password
#804I miss Snow Leopard.
:/
Re: macOS High Sierra: Anyone can login as “root” with empty password
#805Earlier quoted context omitted.
iTunes had QA problems for more than 10 years, only the early versions were really solid. I am not sure that it is a recent problem.
Subjectively it feels like Apple bugs have become larger and more prevalent, over the last few years. That and IMO clean OSX/iOS installs don't quite feel as polished as they used to. (I stopped using Apple products, except for a MBP, for a few years and recently started using them again, and the MBP still runs 10.10 for precisely this reason) The last solid OSX release was Snow Leopard
They've added features over the years without removing or polishing them; there's Launchpad which was added in a period where OSX seemed to lean towards becoming touch-friendly, but it didn't replace any existing feature (iirc) and just feels off. Might just be me though. Notification center? Don't use it.
Re: macOS High Sierra: Anyone can login as “root” with empty password
#806Anyone else think it was a bad idea to disclose this so publicly over Twitter? I thought that the usual practice was to let the development team know first.
Nah, Apple really needs to realize that they need to step up their game. This might hurt some users, but it sets a much needed fire under Apple's ass.
Re: macOS High Sierra: Anyone can login as “root” with empty password
#807Does this work from single user mode?
Yeah, everyone seems to be forgetting that until very recent versions of MacOS you could just boot into SUM and make your own admin account to get access to a mac.
Re: macOS High Sierra: Anyone can login as “root” with empty password
#808This is comical at this point. I have no idea how such vulnerable software makes it to production. It is really ironic that a company, making billions of dollars and branding itself as the leaders of quality, stability and so on, to have this kind of vulnerability. I have truly lost faith in Apple.
i am not saying something like this will always happen, but it can happen. No matter what kind of testing and QA you employ (and i bet it's gigantic in Apples case), not having critical bugs in something as complex as an OS every few years is kind of impossible.
Should it happen ? Obviously not. But even popular open source software used by millions and developed by hundreds is not free of issues like this, like Heartbleed showed.
Re: macOS High Sierra: Anyone can login as “root” with empty password
#809Earlier quoted context omitted.
Have you used an iPhone X? The notch actually makes a lot of sense once you've used the gestures associated with it, same with how it integrates into apps. I'll agree that they've made a lot of mistakes in their product lines recently but the iPhone X was not one of them. Well, sparing software. I've had intermittent phantom screen input using the latest betas on the X, making it infuriatingly unusable at times.
I get that you can swipe down from the left or the right. But obscuring a chunk of the screen is not something to aspire to. The notch is clearly a compromise to make room for hardware. They should have found a way to fit the hardware such that it doesn’t cutaway the screen.
Nothing wrong with incremental upgrades.
Re: macOS High Sierra: Anyone can login as “root” with empty password
#810I've been a developer for a long time. I understand bugs happen, even bugs with terrible consequences. A lot of bugs seem understandable, like I can see the chain of ifs/thens required to end up at some hilarious broken state. But I'm breaking my brain trying to figure out how in the hell a login attempt for "root" will enable it if it's disabled. Why is this is a possibility, to just enable root, no questions asked?
I'm having a hard time understanding how this could happen too. It would have to be that looking up the root account enabled it, maybe users go dormant or something, and this was a way to readd them? then once it was enabled it defaulted to a blank password, but you would think that it needs sudo to enable root in the first place.
Blank password is not necessary. Any password provided on initial attempt WILL BECOME the root password. Blank is being circulated simply because that's what was discovered first.
Edit: Which also means it's possible to "secure" a vulnerable (unexploited) machine simply by attempting to log in as root with a long random password.