Live data from Hacker News

macOS High Sierra: Anyone can login as “root” with empty password

twitter.com

891–900 of 1001 posts

Re: macOS High Sierra: Anyone can login as “root” with empty password

#891
This is indeed a bad black mark on Apple. With all the money they have, it's terrible that they let this one slip by.

I'm still on 10.12 Sierra. Long ago I stopped major updating when those releases were new. I learned to wait months or many months for bugs to be dealt with and for older software to be updated to be compatible with the new release. High Sierra provides nothing critical that Sierra does not provide, and thus, I am happy in my position as late adopter.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#892
post #755

Earlier quoted context omitted.

This is very normal in ' nix' systems. ' ' indicates a locked account. (I've given up figuring out how to escape an asterisk) ex: daemon:*:1:1::0:0:Owner of many system processes:/root:/usr/sbin/nologin operator:*:2:5::0:0:System &:/:/usr/sbin/nologin bin:*:3:7::0:0:Binaries Commands and Source:/:/usr/sbin/nologin tty:*:4:65533::0:0:Tty Sandbox:/:/usr/sbin/nologin If the OS is letting you in with a '*'in the encrypte…

I'm confused, why do you have to escape an asterisk?

Famous last words of a Roman centurion.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#893
post #434

Earlier quoted context omitted.

> But since I don't work there, I have no good inside info Actually, I've been wondering why I hear less about people working at Apple than at other big tech companies. It seems everyone and their mother work at Google or Facebook, but no so much at Apple. Do they have less software engineers, or their employees are required to be more discrete?

> or their employees are required to be more discrete? Yes, I believe so. I've heard there are strict requirements on even internal discussion. (Who you can talk to; about what; where.)

I believe there was an article about how Apple was finding it extremely difficult to hire ML experts because of the secrecy they require. In order to mitigate that they mad an exception for their ML/AI engineers allowing them to publish papers to external journals and present at conferences.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#894
post #838

I see a lot of comments here wondering why Apple seems to not care about software quality anymore. I don’t know if that’s true, but there’s a perfectly obvious answer: They don’t have to. Software quality in macOS was important back when they were trying to get people to switch from Windows-based PCs to Macs. Nowadays, most people who were going to switch have already switched, so Apple has no incentive to keep up th…

I think it's more that desktop machines make them a fraction of the money that their iOS devices do. Development goes towards the profit centre.

Remember that back when Apple made only computers, right before the iPod, they were on the verge of bankruptcy and barely profitable.

Since then their laptops have taken off, of course, and I have no idea how much money they make off them. But compared to the huge torrent of cash Apple makes off iPhones I can't imagine the beancounters see a huge amount of value in investing heavily in the parts of OS X that aren't shared with iOS.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#895
post #838

I see a lot of comments here wondering why Apple seems to not care about software quality anymore. I don’t know if that’s true, but there’s a perfectly obvious answer: They don’t have to. Software quality in macOS was important back when they were trying to get people to switch from Windows-based PCs to Macs. Nowadays, most people who were going to switch have already switched, so Apple has no incentive to keep up th…

These days, where is the lock-in? The core applications that I use (Firefox, Docker, VSCode, vim, ...) all work just as well on Linux, MacOS and Windows. I have a Mac, because it's (at least previously) been pretty secure by default, doesn't require me to invest a lot of time sysadmining my own box, and lets me dip into a healthy ecosystem of commercial software useful to my hobbies (like photography.) The software h…

It's a mental lock in now a days.

Most people don't realize but the vast majority of Video Editing was Windows based till about 2010 when Final Cut was considered best in class (I can't stand Final Cut myself but to each their own...) The vast majority of video editing is now Premier due to Apple's handling of Final Cut Pro and the lack of support for the Mac Pro (They usually sit in back rooms as expensive file servers) Also most people mentally think that somehow Apple is better for design but the software runs just as well on Windows.

The iPhone and the money spent on software is what is keeping people these days. But whenever I talk with my friends they are certainly not thrilled and zealots of Macs anymore. The vast majority of my video editing friends are getting really frustrated with what they call the ceiling. Do you really want to be editing full time on a lap top? The Mac Pro isn't a real solution for full time editors.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#896
post #855
post #838

I see a lot of comments here wondering why Apple seems to not care about software quality anymore. I don’t know if that’s true, but there’s a perfectly obvious answer: They don’t have to. Software quality in macOS was important back when they were trying to get people to switch from Windows-based PCs to Macs. Nowadays, most people who were going to switch have already switched, so Apple has no incentive to keep up th…

I really hope that's not true and this is just some extended blip. That said, between this, the disk encryption bug, not being able to type "I" on an iphone you have to wonder what is going on. I recently upgrade my MacBook Pro to High Sierra and it's been plagued with problems (Weird red flash when displaying menus, hangs/crashes with external monitors etc.) Then I look at switching away, and I lose all the OSX soft…

I've been actively investigating that for over a year:

https://taoofmac.com/space/blog/2016/10/29/2240

I have to use Windows for work, though (I'm at a Microsoft subsidiary, and all we get are Windows machines), and I can live OK inside WSL.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#897
post #300

I've been a developer for a long time. I understand bugs happen, even bugs with terrible consequences. A lot of bugs seem understandable, like I can see the chain of ifs/thens required to end up at some hilarious broken state. But I'm breaking my brain trying to figure out how in the hell a login attempt for "root" will enable it if it's disabled. Why is this is a possibility, to just enable root, no questions asked?

I hope a judge will order Apple to make all source code of macOS to be readable by everyone. This does not necessarily mean open source: you will not be allowed to modify and re-release it.

I don't think you understand the difference between open source and free software. Allowing everyone to read it makes it open source.

https://www.gnu.org/philosophy/open-source-misses-the-point....

Re: macOS High Sierra: Anyone can login as “root” with empty password

#898
post #881
post #875

Earlier quoted context omitted.

From one bad upgrade that cost me a bunch of productivity - believe it was Lion - as well as observing the struggles of colleagues, these days always wait 6 months at least before upgrading OSX

I basically only update when (a beta of) Xcode tells me it won't run on my current version. Usually that's the point when either all bugs have been fixed or they will not be fixed before the new version.

Yea, Xcode is so annoying with this. What magical features does it use under the hood to not allow basic functionality and iOS support that seems completely unrelated to the macOS version? I have zero incentive to update macOS except Xcode telling me it needs a new version that only runs on the new one.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#899

Earlier quoted context omitted.

These days, where is the lock-in? The core applications that I use (Firefox, Docker, VSCode, vim, ...) all work just as well on Linux, MacOS and Windows. I have a Mac, because it's (at least previously) been pretty secure by default, doesn't require me to invest a lot of time sysadmining my own box, and lets me dip into a healthy ecosystem of commercial software useful to my hobbies (like photography.) The software h…

The lock-in is Messages, at least for a lot of people.

I'd wager the number of people using Messages on macOS is really not that high. Most people are content to message using their phone.

iMessage absolutely is a lock-in for iOS, though.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#900
post #838

I see a lot of comments here wondering why Apple seems to not care about software quality anymore. I don’t know if that’s true, but there’s a perfectly obvious answer: They don’t have to. Software quality in macOS was important back when they were trying to get people to switch from Windows-based PCs to Macs. Nowadays, most people who were going to switch have already switched, so Apple has no incentive to keep up th…

These days, where is the lock-in? The core applications that I use (Firefox, Docker, VSCode, vim, ...) all work just as well on Linux, MacOS and Windows. I have a Mac, because it's (at least previously) been pretty secure by default, doesn't require me to invest a lot of time sysadmining my own box, and lets me dip into a healthy ecosystem of commercial software useful to my hobbies (like photography.) The software h…

Without directly disagreeing with your post, I think there is a slight OS lock-in, in the fact that the MS alternative is a horrible piece of burning wreckage. Anybody that had to put up with the autoupdate experience in Windows 10 (oh, you were doing something important? Never mind, I'll just hog your network in random intervals for like an hour without you having a way to stop me and then I'll take 2 hours to apply the patches before the reboot), can understand that Apple was playing without serious competition for some years now.
Post reply on HN