Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS High Sierra: Anyone can login as “root” with empty password

twitter.com

Post reply on HN
Print view View original

901–910 of 1001 posts

Re: macOS High Sierra: Anyone can login as “root” with empty password

#901

Post by teddyh »

m_fayer wrote: post #870
teddyh wrote: post #859

Earlier quoted context omitted.

Nobody cares about what developers like in their computers, developers will go wherever the users are. And Apple now has a sizable chunk of computer users and an even larger chunk of smartphone users.

There's a big difference between a developer grudgingly keeping a cheap headless mini-computer under a stack of papers somewhere that gets used only as needed, and a developer using your system as their "home base" and buying into your entire ecosystem.

That’s not a big difference for Apple. They’ve got their user base now, they don’t need developers to spread the word anymore.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#902

Post by xtrimsky1234 »

angrygoat wrote: post #880
teddyh wrote: post #838

I see a lot of comments here wondering why Apple seems to not care about software quality anymore. I don’t know if that’s true, but there’s a perfectly obvious answer: They don’t have to. Software quality in macOS was important back when they were trying to get people to switch from Windows-based PCs to Macs. Nowadays, most people who were going to switch have already switched, so Apple has no incentive to keep up th…

These days, where is the lock-in? The core applications that I use (Firefox, Docker, VSCode, vim, ...) all work just as well on Linux, MacOS and Windows. I have a Mac, because it's (at least previously) been pretty secure by default, doesn't require me to invest a lot of time sysadmining my own box, and lets me dip into a healthy ecosystem of commercial software useful to my hobbies (like photography.) The software h…

There are many lock-ins, first there is iMessage, second there are some apps that still work only on Mac OS X I don't remember the name of the software but I once was sent a design file and was only able to open it on a Mac OS X software (there was a windows alternative but it didn't allow me to edit the file as needed). Another example is XCode, you need a Mac to properly create iPhone apps. For programming, there are also issues with symbolic links on Windows.

I personally prefer Windows, but as a software developer I had to buy a Mac, I grew tired of having to always power-on a Mac OS X virtual machine. My job is so much easier now then it was on windows.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#903

Post by pault »

baldfat wrote: post #895
angrygoat wrote: post #880

Earlier quoted context omitted.

These days, where is the lock-in? The core applications that I use (Firefox, Docker, VSCode, vim, ...) all work just as well on Linux, MacOS and Windows. I have a Mac, because it's (at least previously) been pretty secure by default, doesn't require me to invest a lot of time sysadmining my own box, and lets me dip into a healthy ecosystem of commercial software useful to my hobbies (like photography.) The software h…

It's a mental lock in now a days. Most people don't realize but the vast majority of Video Editing was Windows based till about 2010 when Final Cut was considered best in class (I can't stand Final Cut myself but to each their own...) The vast majority of video editing is now Premier due to Apple's handling of Final Cut Pro and the lack of support for the Mac Pro (They usually sit in back rooms as expensive file serv…

It's also display quality. If you're doing design work you can use a MacBook pro and be pretty sure that the color is accurate with no calibration. If you switch platforms you have to sort out the enterprise and gaming displays, which have totally different selling points (price and responsiveness, respectively). Getting a good display and accurate color on a Windows machine requires a lot more knowledge and effort. This is definitely less true since Apple abandoned their display line (one more bit of evidence that Apple doesn't care about the professionals that established their brand anymore).

Re: macOS High Sierra: Anyone can login as “root” with empty password

#904

Post by teddyh »

kakarot wrote: post #869
teddyh wrote: post #854

Earlier quoted context omitted.

Some years ago, I was hearing about people switching from PCs to Macs all the time. Later, not so much, but macOS was still getting praise. Maybe Apple looked at the conversion numbers at that time and decided that the cost of keeping up the quality of macOS wasn’t worth the few PC converts they were still getting, and they figured that not enough people would switch back to PCs since the iOS system lock-in effects,…

This goes against basically every corporate strategy ever, which is to always increase growth. At this state in the company's life there is a disconnect between those who make the software and those who make the business decisions. I don't think it's likely that Apple's board just decided to give up attracting new customers, and any apparent decline in quality is likely attributed to bad management; ineptitude, rathe…

Increase growth, yes, but not at any cost. My point is that Apple may have decided that at this time they don’t need the growth as much as they need internal developers to work on other things than macOS.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#905

Post by sanbor »

TonnyGaric wrote: post #864

Apple released the following statement regarding this bug: "We are working on a software update to address this issue. In the meantime, setting a root password prevents unauthorized access to your Mac. To enable the Root User and set a password, please follow the instructions here: https://support.apple.com/en-us/HT204012 . If a Root User is already enabled, to ensure a blank password is not set, please follow the in…

Thank you! I was looking for a workaround to avoid leaving my system vulnerable until the patch lands in App Store.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#906

Post by lloeki »

neotek wrote: post #738
pls2halp wrote: post #715

Earlier quoted context omitted.

That’s absolutely terrible. Does Apple not monitor those forums at all?

Apple's support forums aren't a place where Apple provides their users with support, they're where Apple users seek support from other Apple users, mostly unhelpful and often inaccurate support. In fact, 99% of the time the only advice you'll get is "restore your iPhone", "restore your MacBook Pro", "restore your Apple TV" and so on into bitter infinity.

You forgot about "repair permissions" and "do a SMC+NVRAM reset"

Re: macOS High Sierra: Anyone can login as “root” with empty password

#907

Post by nathanvanfleet »

teddyh wrote: post #838

I see a lot of comments here wondering why Apple seems to not care about software quality anymore. I don’t know if that’s true, but there’s a perfectly obvious answer: They don’t have to. Software quality in macOS was important back when they were trying to get people to switch from Windows-based PCs to Macs. Nowadays, most people who were going to switch have already switched, so Apple has no incentive to keep up th…

I kind of love how you frame it as "everyone who has switched has switched" as if the job is done. As if there would be no market to capture. Which isn't true. And doesn't even consider the reality that there are young computer buyers who they need to capture because existing users don't buy new machines or won't last in the long run (people die).

Re: macOS High Sierra: Anyone can login as “root” with empty password

#908

Post by LeifCarrotson »

akvadrako wrote: post #839
rtpg wrote: post #820

Earlier quoted context omitted.

But at one point a root account is created with an empty password right? There's a specific line somewhere that's doing this, in theory. Maybe they should have opted for "create `root` with unguessable password"

No, that's a hack. And it opens new attacks, like on the hashing algorithm and poor randomness or predictability in the generation logic.

You have some pretty high standards. Being imperfect doesn't automatically make it better than the alternative of not doing it.

If the system can't generate a secure hash, or can't generate cryptographically random numbers, you're in serious trouble. Those tools are foundational to security.

Moving the problem from "a root account is created with the first password you try" to "you have to break crypt(1) or /dev/random" is basically equivalent to solving it.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#909

Post by lultimouomo »

INTPenis wrote: post #857
qualitytime wrote: post #848

Top 10 software blunders of all time: 1) (Apple) 1 + 2 + 3 = 24 https://news.ycombinator.com/item?id=15538666 2) (Apple) Blank root password https://news.ycombinator.com/item?id=15800676 3) ...

Well I remember when the Ubuntu installer left your root password in a clear text file that was world readable on your FS.[1] I would really like to see a top 10 list of software blunders, I think everyone on HN would. 1. https://launchpad.net/ubuntu/+source/shadow/+bug/34606

In that case the bug was fixed in less than a day. Let's see how Apple fares.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#910

Post by Dangeranger »

manmal wrote: post #846
skygazer wrote: post #840

Earlier quoted context omitted.

While your theory is interesting, if deeply cynical, the thing I find most interesting is that it's the top comment on an 800+ comment discussion when it was less than a minute old. Do new comments start at the top? I've never noticed that before. Edit: By the way, regarding the vulnerability, ANY password you use when you first attempt to login as root BECOMES root's new password. (Blank is a red herring.) So if you…

The higher the poster's karma, the higher her comment will be upon posting. This user has almost 6k karma, so it can rise high. Once the comment is at the top for a minute or so, it can stay there if enough people keep upvoting it. Try it and post a top level comment now. I'm pretty sure it won't be at the top initially because you don't have enough karma for that.

I have also seen new comments spring to the top of the conversation, but always assumed they were selected randomly, as some of them were from posters who were fairly new or had a low karma count.
Post reply on HN