Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS High Sierra: Anyone can login as “root” with empty password

twitter.com

Post reply on HN
Print view View original

921–930 of 1001 posts

Re: macOS High Sierra: Anyone can login as “root” with empty password

#921

Post by teddyh »

nathanvanfleet wrote: post #907
teddyh wrote: post #838

I see a lot of comments here wondering why Apple seems to not care about software quality anymore. I don’t know if that’s true, but there’s a perfectly obvious answer: They don’t have to. Software quality in macOS was important back when they were trying to get people to switch from Windows-based PCs to Macs. Nowadays, most people who were going to switch have already switched, so Apple has no incentive to keep up th…

I kind of love how you frame it as "everyone who has switched has switched" as if the job is done. As if there would be no market to capture. Which isn't true. And doesn't even consider the reality that there are young computer buyers who they need to capture because existing users don't buy new machines or won't last in the long run (people die).

There is always more market to capture, but the cost of capturing those few additional users might not be worth it (to Apple, currently). And new users don’t look to the quality of the OS to pick their platforms, they look to existing user bases. And Apple now has a sizable existing user base, especially if you also count iPhones.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#922

Post by baldfat »

pault wrote: post #903
baldfat wrote: post #895

Earlier quoted context omitted.

It's a mental lock in now a days. Most people don't realize but the vast majority of Video Editing was Windows based till about 2010 when Final Cut was considered best in class (I can't stand Final Cut myself but to each their own...) The vast majority of video editing is now Premier due to Apple's handling of Final Cut Pro and the lack of support for the Mac Pro (They usually sit in back rooms as expensive file serv…

It's also display quality. If you're doing design work you can use a MacBook pro and be pretty sure that the color is accurate with no calibration. If you switch platforms you have to sort out the enterprise and gaming displays, which have totally different selling points (price and responsiveness, respectively). Getting a good display and accurate color on a Windows machine requires a lot more knowledge and effort.…

I own my own calibrator. I calibrate every monitor I use for Video. I have never seen a accurate monitor in the wild yet. The funny thing is I can get a horrible cheap monitor to be calibrated in a dark room and it is better than anything not calibrated.

People need to buy calibrators. I use the open source ColorHug it runs on Linux so I actually use a live cd and do the calibration. http://www.hughski.com/

Re: macOS High Sierra: Anyone can login as “root” with empty password

#923

Post by thedarkproject »

delfinom wrote: post #917
angrygoat wrote: post #880

Earlier quoted context omitted.

These days, where is the lock-in? The core applications that I use (Firefox, Docker, VSCode, vim, ...) all work just as well on Linux, MacOS and Windows. I have a Mac, because it's (at least previously) been pretty secure by default, doesn't require me to invest a lot of time sysadmining my own box, and lets me dip into a healthy ecosystem of commercial software useful to my hobbies (like photography.) The software h…

iMessage is a huge lock-in for non-technical users. They are just obsessed with it on iOS. You can find tons of forum posts with people throwing fits that XYZ Android phone doesn't have iMessage.

This might me valid for the US. Anecdotally, where I live (Switzerland/central Europe) almost nobody uses iMessage, and WhatsApp is the big dominator.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#924

Post by qudat »

angrygoat wrote: post #880
teddyh wrote: post #838

I see a lot of comments here wondering why Apple seems to not care about software quality anymore. I don’t know if that’s true, but there’s a perfectly obvious answer: They don’t have to. Software quality in macOS was important back when they were trying to get people to switch from Windows-based PCs to Macs. Nowadays, most people who were going to switch have already switched, so Apple has no incentive to keep up th…

These days, where is the lock-in? The core applications that I use (Firefox, Docker, VSCode, vim, ...) all work just as well on Linux, MacOS and Windows. I have a Mac, because it's (at least previously) been pretty secure by default, doesn't require me to invest a lot of time sysadmining my own box, and lets me dip into a healthy ecosystem of commercial software useful to my hobbies (like photography.) The software h…

iMessages is the lock-in. It is the primary reason why I switched to the iPhone.

I have the macbook pro, iphone, watch, airpods, and they all work pretty great together. It's a cohesive experience that is going to be really hard for me to break out of it.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#925

Post by Humdeee »

nathanvanfleet wrote: post #907
teddyh wrote: post #838

I see a lot of comments here wondering why Apple seems to not care about software quality anymore. I don’t know if that’s true, but there’s a perfectly obvious answer: They don’t have to. Software quality in macOS was important back when they were trying to get people to switch from Windows-based PCs to Macs. Nowadays, most people who were going to switch have already switched, so Apple has no incentive to keep up th…

I kind of love how you frame it as "everyone who has switched has switched" as if the job is done. As if there would be no market to capture. Which isn't true. And doesn't even consider the reality that there are young computer buyers who they need to capture because existing users don't buy new machines or won't last in the long run (people die).

I was going to comment the same thing. Most people are always open to switching if the evidence is there to support a better workflow or experience. The realm of endless marketing to all the demographics will never stop.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#926

Post by TheOtherHobbes »

kakarot wrote: post #869
teddyh wrote: post #854

Earlier quoted context omitted.

Some years ago, I was hearing about people switching from PCs to Macs all the time. Later, not so much, but macOS was still getting praise. Maybe Apple looked at the conversion numbers at that time and decided that the cost of keeping up the quality of macOS wasn’t worth the few PC converts they were still getting, and they figured that not enough people would switch back to PCs since the iOS system lock-in effects,…

This goes against basically every corporate strategy ever, which is to always increase growth. At this state in the company's life there is a disconnect between those who make the software and those who make the business decisions. I don't think it's likely that Apple's board just decided to give up attracting new customers, and any apparent decline in quality is likely attributed to bad management; ineptitude, rathe…

Old school corps - DEC, HP, even IBM to an extent - weren't about increasing growth irrespective of consequences.

The DEC Employee Handbook made a big deal out of Doing the Right Thing. Obviously that was subjective, frequently debatable, and sometimes just a pain in the ass - but it was a guiding principle for engineers of that generation, and for engineers who became managers.

And it produced some outstanding engineering and innovation.

Because it actually means "Do the best work you can, for your own self-respect, and also because you respect your users."

That's light years away from "Screw as much money out of your customers as you can, as many overtime hours out of your developers as you can, and if the product is broken - who cares if the money keeps coming in?"

Re: macOS High Sierra: Anyone can login as “root” with empty password

#927

Post by fergie »

teddyh wrote: post #838

I see a lot of comments here wondering why Apple seems to not care about software quality anymore. I don’t know if that’s true, but there’s a perfectly obvious answer: They don’t have to. Software quality in macOS was important back when they were trying to get people to switch from Windows-based PCs to Macs. Nowadays, most people who were going to switch have already switched, so Apple has no incentive to keep up th…

There are probably a lot of people like me on HN who _need_ a unix box to do their work, and the various Macs are still far and away the best general purpose unix boxes available (best chassis, best peripheral compatibility, best (o|O)ffice software compatibility).

Now that Google Docs and Office 365 are "good enough" for most things, I would probably be happy to go back to Linux if there was a Linux machine that had comparable build quality yet was a bit cheaper than a Mac.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#928

Post by pimeys »

baldfat wrote: post #922
pault wrote: post #903

Earlier quoted context omitted.

It's also display quality. If you're doing design work you can use a MacBook pro and be pretty sure that the color is accurate with no calibration. If you switch platforms you have to sort out the enterprise and gaming displays, which have totally different selling points (price and responsiveness, respectively). Getting a good display and accurate color on a Windows machine requires a lot more knowledge and effort.…

I own my own calibrator. I calibrate every monitor I use for Video. I have never seen a accurate monitor in the wild yet. The funny thing is I can get a horrible cheap monitor to be calibrated in a dark room and it is better than anything not calibrated. People need to buy calibrators. I use the open source ColorHug it runs on Linux so I actually use a live cd and do the calibration. http://www.hughski.com/

My partner does photography and has a Datacolor Spyder 4, which I of course borrow to calibrate all my monitors. At work I have a 30" IPS and next to it vertically an old 24" tn-film. After calibration, they are very close color-wise and they both are very enjoyable for reading code. The tn panel has worse viewing angles and about ~80% of sRGB, but after calibration it is absolutely much nicer even for development.

I calibrate my monitors with DisplayCAL[0] on Linux.

There should be one calibrator in every office, the difference it makes is enormous.

[0] https://displaycal.net/

Re: macOS High Sierra: Anyone can login as “root” with empty password

#929

Post by paprikka »

fergie wrote: post #927
teddyh wrote: post #838

I see a lot of comments here wondering why Apple seems to not care about software quality anymore. I don’t know if that’s true, but there’s a perfectly obvious answer: They don’t have to. Software quality in macOS was important back when they were trying to get people to switch from Windows-based PCs to Macs. Nowadays, most people who were going to switch have already switched, so Apple has no incentive to keep up th…

There are probably a lot of people like me on HN who _need_ a unix box to do their work, and the various Macs are still far and away the best general purpose unix boxes available (best chassis, best peripheral compatibility, best (o|O)ffice software compatibility). Now that Google Docs and Office 365 are "good enough" for most things, I would probably be happy to go back to Linux if there was a Linux machine that had…

Can't agree more. The main thing that keeps me using OSX is Adobe Creative Cloud.

I'd mention aesthetics, but the current Linux distros look quite good, plus they're customisable.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#930

Post by SyneRyder »

sanbor wrote: post #905
TonnyGaric wrote: post #864

Apple released the following statement regarding this bug: "We are working on a software update to address this issue. In the meantime, setting a root password prevents unauthorized access to your Mac. To enable the Root User and set a password, please follow the instructions here: https://support.apple.com/en-us/HT204012 . If a Root User is already enabled, to ensure a blank password is not set, please follow the in…

Thank you! I was looking for a workaround to avoid leaving my system vulnerable until the patch lands in App Store.

That might not be enough. There's a tweet claiming it isn't limited to the root account, and applies to other similar Apple-default accounts on the system, such as the _applepay user account:

https://twitter.com/unsynchronized/status/935656609140711426

That seems to match the technical explanation of the bug here:

https://objective-see.com/blog/blog_0x24.html

The tweet claims they've got Apple Remote Desktop access & screen sharing working via the _applepay user account. Why/how that's possible, I have no idea - I don't have High Sierra to confirm this, and I'm not sure I'd want to mess with the _applepay user account even if I did.

Post reply on HN