Live data from Hacker News

macOS High Sierra: Anyone can login as “root” with empty password

twitter.com

941–950 of 1001 posts

Re: macOS High Sierra: Anyone can login as “root” with empty password

#941

Earlier quoted context omitted.

You can get undetectble remote access on most machines given "physical access once", so I don't think this qualifies as "remotely exploitable".

Not according to this video: https://www.youtube.com/watch?v=FpOH0lxEGBE They seem to be remotely accessing the machine to both set and then use the root account.

The system needs to have some sort of remote access, like screen sharing, turned on first, then you can remotely use the root account.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#942
post #899

Earlier quoted context omitted.

I'd wager the number of people using Messages on macOS is really not that high. Most people are content to message using their phone. iMessage absolutely is a lock-in for iOS, though.

Why's iMessage a lock-in? I have an iPhone but I wasn't aware I'd lose anything (significant) by switching to Android (or whatever).

The biggest thing I lost in a similar switch was ANY old conversation with somebody who was an iMessage user. Where they reply to a conversation and think they are just texting you, but actually they are sending iMessages that you just aren’t receiving. Especially on, for example, family group texts, people just find the old conversation and continue it from the previous year or whatever. Lots of times when I was on windows phone or had iMessage switched off, I’d only get the parts of the conversation coming from non-iMessage users. A good example is random family members who use android texting me reactions to an original text or picture I didn’t get. It’s really dumb. Maybe there’s something I could have done about it in my own settings, but instead I ended up switching back to iPhone recently. Not just for that reason but it sure was nice to get messages properly again. But also more sensitive stuff like somebody sharing pictures of items related to planning a funeral.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#943
post #300

I've been a developer for a long time. I understand bugs happen, even bugs with terrible consequences. A lot of bugs seem understandable, like I can see the chain of ifs/thens required to end up at some hilarious broken state. But I'm breaking my brain trying to figure out how in the hell a login attempt for "root" will enable it if it's disabled. Why is this is a possibility, to just enable root, no questions asked?

This seems to be why: https://objective-see.com/blog/blog_0x24.html

Re: macOS High Sierra: Anyone can login as “root” with empty password

#944

Earlier quoted context omitted.

These days, where is the lock-in? The core applications that I use (Firefox, Docker, VSCode, vim, ...) all work just as well on Linux, MacOS and Windows. I have a Mac, because it's (at least previously) been pretty secure by default, doesn't require me to invest a lot of time sysadmining my own box, and lets me dip into a healthy ecosystem of commercial software useful to my hobbies (like photography.) The software h…

There are a few "quality of life" tools on OSX that I use, like Alfred that I haven't seen a Linux equivalent. But you're right, I could probably switch to Linux and be fairly happy.

As for Alfred replacement... How about [Albert](https://github.com/albertlauncher/albert)?

Re: macOS High Sierra: Anyone can login as “root” with empty password

#945
post #787

Earlier quoted context omitted.

Seems to be something related to a backwards-compatibility code path for upgraded systems. According to multiple posts on this thread it only affects systems upgraded to High Sierra, not fresh installs. See https://news.ycombinator.com/item?id=15802622 for example. Adding extra layers for compatibility complicates testing and debugging. With this many eyes on it hopefully someone will be able to deduce exactly what's…

My upgraded high sierra doesn't have this problem. The theory could be backwards. Anyways, this is stunning.

Try guest account.

I could do it on guest account, by first pressing enter after entering "root". And after a fail, clicking the unlock button.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#946
post #838

I see a lot of comments here wondering why Apple seems to not care about software quality anymore. I don’t know if that’s true, but there’s a perfectly obvious answer: They don’t have to. Software quality in macOS was important back when they were trying to get people to switch from Windows-based PCs to Macs. Nowadays, most people who were going to switch have already switched, so Apple has no incentive to keep up th…

These days, where is the lock-in? The core applications that I use (Firefox, Docker, VSCode, vim, ...) all work just as well on Linux, MacOS and Windows. I have a Mac, because it's (at least previously) been pretty secure by default, doesn't require me to invest a lot of time sysadmining my own box, and lets me dip into a healthy ecosystem of commercial software useful to my hobbies (like photography.) The software h…

Mac is also easier to use for non technical users. I bought my mom a Mac and she can plays with the "system preferences." Good luck showing her Control Panel on windows.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#947
post #838

I see a lot of comments here wondering why Apple seems to not care about software quality anymore. I don’t know if that’s true, but there’s a perfectly obvious answer: They don’t have to. Software quality in macOS was important back when they were trying to get people to switch from Windows-based PCs to Macs. Nowadays, most people who were going to switch have already switched, so Apple has no incentive to keep up th…

These days, where is the lock-in? The core applications that I use (Firefox, Docker, VSCode, vim, ...) all work just as well on Linux, MacOS and Windows. I have a Mac, because it's (at least previously) been pretty secure by default, doesn't require me to invest a lot of time sysadmining my own box, and lets me dip into a healthy ecosystem of commercial software useful to my hobbies (like photography.) The software h…

>These days, where is the lock-in?

Photos, apps purchased, and iMessage are overwhelmingly the reasons I don't see people switch. All their kids photos, etc, are stored away and they'd have to figure out how to nicely export them. iMessage is seemless for them across devices while an alternative like Hangouts doesn't have the market penetration—it isn't ubiquitously used even among just Android users. Apps purchased I added to the list because often people don't think about it, but if you mention "re-buying all your apps" you see the frown appear on their face.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#948
post #838

I see a lot of comments here wondering why Apple seems to not care about software quality anymore. I don’t know if that’s true, but there’s a perfectly obvious answer: They don’t have to. Software quality in macOS was important back when they were trying to get people to switch from Windows-based PCs to Macs. Nowadays, most people who were going to switch have already switched, so Apple has no incentive to keep up th…

What? Of course they have to care.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#949

Earlier quoted context omitted.

While I think there's a chance you might be right, I don't think it's logical in the long run. I think changes in perception like this are accumulated over time and will in the end hurt the product. For some examples, look at the impression of Microsoft and Windows when it comes to quality. It is only now starting to improve, with gigantic efforts from Microsofts side. Another example is Linux and usability, which ha…

>It is only now starting to improve, with gigantic efforts from Microsofts side. Is it? They axed their internal QA and definitely aren't catching all the bugs with the "Insiders Program." After the Fall Creator's Update I've had to log in twice (after the first one I just get sent back to the login screen). The workaround is disabling a setting: "Use my sign-in info to automatically finish setting up my device after…

Maybe not quality wise in all areas (I agree with you there) but at least in giving a professional and modern impression compared to let's say Windows XP/7. Maybe operating systems are declining in quality in general, even though organizations sometimes try to improve them. I guess legacy plays a big role here.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#950
post #838

I see a lot of comments here wondering why Apple seems to not care about software quality anymore. I don’t know if that’s true, but there’s a perfectly obvious answer: They don’t have to. Software quality in macOS was important back when they were trying to get people to switch from Windows-based PCs to Macs. Nowadays, most people who were going to switch have already switched, so Apple has no incentive to keep up th…

Maybe. But this particular bug happened precisely because Apple has changed _something_ in macOS. Also this something was probably quite profound since it has impacted a part of software that, at least from the outside, haven't changed much since a long time.

A lot of macOS users would actually prefer Apple to do less with it than what they are currently doing.

Post reply on HN