Earlier quoted context omitted.
You can get undetectble remote access on most machines given "physical access once", so I don't think this qualifies as "remotely exploitable".
Not according to this video: https://www.youtube.com/watch?v=FpOH0lxEGBE They seem to be remotely accessing the machine to both set and then use the root account.
macOS High Sierra: Anyone can login as “root” with empty password
941–950 of 1001 posts
Re: macOS High Sierra: Anyone can login as “root” with empty password
#942Earlier quoted context omitted.
I'd wager the number of people using Messages on macOS is really not that high. Most people are content to message using their phone. iMessage absolutely is a lock-in for iOS, though.
Why's iMessage a lock-in? I have an iPhone but I wasn't aware I'd lose anything (significant) by switching to Android (or whatever).
Re: macOS High Sierra: Anyone can login as “root” with empty password
#943I've been a developer for a long time. I understand bugs happen, even bugs with terrible consequences. A lot of bugs seem understandable, like I can see the chain of ifs/thens required to end up at some hilarious broken state. But I'm breaking my brain trying to figure out how in the hell a login attempt for "root" will enable it if it's disabled. Why is this is a possibility, to just enable root, no questions asked?
Re: macOS High Sierra: Anyone can login as “root” with empty password
#944Earlier quoted context omitted.
These days, where is the lock-in? The core applications that I use (Firefox, Docker, VSCode, vim, ...) all work just as well on Linux, MacOS and Windows. I have a Mac, because it's (at least previously) been pretty secure by default, doesn't require me to invest a lot of time sysadmining my own box, and lets me dip into a healthy ecosystem of commercial software useful to my hobbies (like photography.) The software h…
There are a few "quality of life" tools on OSX that I use, like Alfred that I haven't seen a Linux equivalent. But you're right, I could probably switch to Linux and be fairly happy.
Re: macOS High Sierra: Anyone can login as “root” with empty password
#945Earlier quoted context omitted.
Seems to be something related to a backwards-compatibility code path for upgraded systems. According to multiple posts on this thread it only affects systems upgraded to High Sierra, not fresh installs. See https://news.ycombinator.com/item?id=15802622 for example. Adding extra layers for compatibility complicates testing and debugging. With this many eyes on it hopefully someone will be able to deduce exactly what's…
My upgraded high sierra doesn't have this problem. The theory could be backwards. Anyways, this is stunning.
I could do it on guest account, by first pressing enter after entering "root". And after a fail, clicking the unlock button.
Re: macOS High Sierra: Anyone can login as “root” with empty password
#946I see a lot of comments here wondering why Apple seems to not care about software quality anymore. I don’t know if that’s true, but there’s a perfectly obvious answer: They don’t have to. Software quality in macOS was important back when they were trying to get people to switch from Windows-based PCs to Macs. Nowadays, most people who were going to switch have already switched, so Apple has no incentive to keep up th…
These days, where is the lock-in? The core applications that I use (Firefox, Docker, VSCode, vim, ...) all work just as well on Linux, MacOS and Windows. I have a Mac, because it's (at least previously) been pretty secure by default, doesn't require me to invest a lot of time sysadmining my own box, and lets me dip into a healthy ecosystem of commercial software useful to my hobbies (like photography.) The software h…
Re: macOS High Sierra: Anyone can login as “root” with empty password
#947I see a lot of comments here wondering why Apple seems to not care about software quality anymore. I don’t know if that’s true, but there’s a perfectly obvious answer: They don’t have to. Software quality in macOS was important back when they were trying to get people to switch from Windows-based PCs to Macs. Nowadays, most people who were going to switch have already switched, so Apple has no incentive to keep up th…
These days, where is the lock-in? The core applications that I use (Firefox, Docker, VSCode, vim, ...) all work just as well on Linux, MacOS and Windows. I have a Mac, because it's (at least previously) been pretty secure by default, doesn't require me to invest a lot of time sysadmining my own box, and lets me dip into a healthy ecosystem of commercial software useful to my hobbies (like photography.) The software h…
Photos, apps purchased, and iMessage are overwhelmingly the reasons I don't see people switch. All their kids photos, etc, are stored away and they'd have to figure out how to nicely export them. iMessage is seemless for them across devices while an alternative like Hangouts doesn't have the market penetration—it isn't ubiquitously used even among just Android users. Apps purchased I added to the list because often people don't think about it, but if you mention "re-buying all your apps" you see the frown appear on their face.
Re: macOS High Sierra: Anyone can login as “root” with empty password
#948I see a lot of comments here wondering why Apple seems to not care about software quality anymore. I don’t know if that’s true, but there’s a perfectly obvious answer: They don’t have to. Software quality in macOS was important back when they were trying to get people to switch from Windows-based PCs to Macs. Nowadays, most people who were going to switch have already switched, so Apple has no incentive to keep up th…
Re: macOS High Sierra: Anyone can login as “root” with empty password
#949Earlier quoted context omitted.
While I think there's a chance you might be right, I don't think it's logical in the long run. I think changes in perception like this are accumulated over time and will in the end hurt the product. For some examples, look at the impression of Microsoft and Windows when it comes to quality. It is only now starting to improve, with gigantic efforts from Microsofts side. Another example is Linux and usability, which ha…
>It is only now starting to improve, with gigantic efforts from Microsofts side. Is it? They axed their internal QA and definitely aren't catching all the bugs with the "Insiders Program." After the Fall Creator's Update I've had to log in twice (after the first one I just get sent back to the login screen). The workaround is disabling a setting: "Use my sign-in info to automatically finish setting up my device after…
Re: macOS High Sierra: Anyone can login as “root” with empty password
#950I see a lot of comments here wondering why Apple seems to not care about software quality anymore. I don’t know if that’s true, but there’s a perfectly obvious answer: They don’t have to. Software quality in macOS was important back when they were trying to get people to switch from Windows-based PCs to Macs. Nowadays, most people who were going to switch have already switched, so Apple has no incentive to keep up th…
A lot of macOS users would actually prefer Apple to do less with it than what they are currently doing.