MacOS Update Accidentally Undoes Apple's “root” Bug Patch

https://www.wired.com/story/macos-update-undoes-apple-root-bug-patch/

by platinumrad • 9 years ago

426 162 9 years ago

JadeNB2• 9 years ago

Wow, so now they have this massive security bug, screwed up file sharing when they fixed it, and now are apparently inadvertently rolling back the fix to the initial massive security bug.

pmarreck2• 9 years ago

Classic "rushing to fix problem causing more problems" programmer error

twinkletwinkle• 9 years ago

Now is better than never. Although never is often better than right now.

contingencies• 9 years ago

Prescription: additional sleep for security team, and non-negotiable vulnerability regression tests for all releases.

pmarreck2• 9 years ago

Seems to be a horrible week for Apple devs... I just got bit by this bug, which was infuriating as hell:

https://twitter.com/jeremybank/status/936775452097626113

aphextron• 9 years ago

Looks like someone screwed up their cherry-pick

allenz• 9 years ago

Summary: the root bug reappears when you upgrade your Mac. You need to manually reinstall Apple's security patch and reboot. There's no warning that a reboot is necessary.

wasyl• 9 years ago

Huh, and how do I reinstall the patch? Can't find a downloading link and app store doesn't let me do anything with the update

Funny thing is that on the update site section steps in `To confirm that your Mac has Security Update 2017-001` confirm that I have the update, but am still vulnerable to the issue.

Do I understand correctly that setting root password is also valid workaround for the issue?

jacquesm2• 9 years ago

Not a good week for Apple. They were doing pretty good reputation wise when it concerned security so far but this whole saga has been less than stellar. Amazing that regression testing didn't catch this.

em3rgent0rdr• 9 years ago

maybe there wasn't any regression testing...

segmondy• 9 years ago

There was no regression testing.

tabs_masterrace• 9 years ago

Looks like Apple is having trouble hitting deadlines this year. iOS 11, Xcode9, OS X all came out rushed. Maybe because they're moving to the new building. Or maybe they're trying to do to much stuff on a yearly release cycle now.

dfischer• 9 years ago

As serious as this is, it kind of makes me feel humbled in a way knowing I’ve been through these exact situations and it happens to Apple too.

ryanlol6• 9 years ago

As serious as this is

... So, not at all? It’s a LPE for gods sake. EDIT: Apparently it affects remote desktop too, so not just a LPE.

Can this even be exploited from within the sandbox?

fra• 9 years ago

Not just local. VNC and other remote protocols are vulnerable.

benwilber02• 9 years ago

LPE's are very serious for the countless college campuses, public libraries, and design print shops like Kinkos that offer public access to Mac computers.

platinumrad6• 9 years ago

LPE matters a lot for enterprise and educational customers.

What do you mean by exploited from within the sandbox? This is exploitable from any login prompt where the user has the ability to enter a username, including ones in the shell.

Groxx• 9 years ago

I'd imagine it makes device theft rather more serious.

dbcooper• 9 years ago

That isn’t what humbled means.

humble ˈhʌmb(ə)l verb past tense: humbled; past participle: humbled

cause (someone) to feel less important or proud. "he was humbled by his many ordeals"

decisively defeat (a sporting opponent previously thought to be superior). "Wales were humbled at Cardiff Arms Park by Romania

_xzdq• 9 years ago

Maybe they now feel less important or proud. Whatever the case, it's not up to you to police this commenter's thoughts. Why did you decide to take time and energy to post a dictionary definition in attempt to do so? This just feels almost completely patronizing.

kzahel• 9 years ago

I am still confused. I was prompted again today to install the security update I installed yesterday. Did they silently release another improved security update?

glhaynes• 9 years ago

Yeah, the day after they put out the initial update (17B1002), they put out a second update (17B1003) that fixed the file sharing issue caused by the first one.

halayli• 9 years ago

They’re playing Whac-a-mole

trhway3• 9 years ago

Mac-a-mole

pfarnsworth• 9 years ago

This is turning into a comedy of errors. They don't add regression tests to their test suite? I'm a bit shocked that they're having so much trouble releasing a patch properly.

mephitix2• 9 years ago

For something as serious as the initial bug (especially given it was all over the press) there should have been regression tests for this.

Either deployment was broken, the tests were broken, there weren't tests, or multiple of the above :\ anyway I'm hypothesizing but would love to see a post-mortem on this. How does a generally reliable company like Apple screw this up twice?

platinumrad6• 9 years ago

I've been struggling for a long time to convince some of my less technical friends that keeping all of the software on their devices up to date is an important best practice from a security perspective. I'm afraid that the recent muck ups in High Sierra and iOS 11 are going to make sure that some of them never listen to me ever again.

IBM2• 9 years ago

I have a hard time believing that your less technical friends are even following Apple news. The average person that walks into an Apple store and buys a Mac probably has no idea about the original vulnerability, let alone the multiple patches for it.

tedivm• 9 years ago

You don't need to be following "Apple news" to hear about this. It has been all over the news.

platinumrad6• 9 years ago

Maybe they won't be aware of this particular vulnerability but issues like the the iOS autocorrect bugs[1][2] get memed to death on all sorts of mainstream social media platforms. Even the original "root" tweet got 10k+ retweets.

[1] https://www.theverge.com/2017/11/6/16611756/ios-11-bug-lette... [2] http://bgr.com/2017/11/27/ios-11-problems-keyboard-autocorre...

et-al• 9 years ago

The average person that updated their iOS to 11 during the first two weeks has definitely noticed how bug-ridden it is with power issues, 3D touch issues, and the autocorrect bug.

We've trained people to update ASAP for security reasons, but when Apple drops the ball and seriously fucks up iOS 11 for a month until 11.1.1 was released, this will keep users update-shy.

I hope 2018 emphasises rock-solid releases for both macOS & iOS. Or Apple should move to a two-year release cycle (wishful thinking).

j452• 9 years ago

I generally stay 1 release behind (kept patched) for this reason, plus ensuring my workflow is not broken for a few months of the year.

The latest version isn't always the most stable or secure, either.

Someone had mentioned in a different post that Apple may not apply all security patches to Sierra. If I can find some support to this I think it will be picking the lesser of two evils.

platinumrad6• 9 years ago

Judging by Apple's security updates page[1], they're still releasing standalone security updates for older versions of macOS. Unfortunately, the same is not true for iOS where security updates are rolled into OS updates.

[1] https://support.apple.com/en-us/HT201222

gurkendoktor6• 9 years ago

I haven't checked Apple's "security content" KB articles recently, but I remember that the fix for this bug was not backported at the time:

https://truesecdev.wordpress.com/2015/04/09/hidden-backdoor-...

veidr• 9 years ago

I hear you, and I have the same problem (hi, Dad) but it is worth noting that this latest re-occurrence of the bug happens only to machines that were not up-to-date when they downloaded (or rather, when Apple remotely installed) the security patch.

If a machine had 10.13.1 (the latest version of macOS) installed when that happened, it is OK.

If the machine had 10.13.0 installed when Apple installed the patch, however, then the update to 10.13.1 will bring the bug back, and necessitate both re-installation of the security patch and a reboot before the machine is again safe from the "root access for anybody who can spell 'root'" bug.

saghm• 9 years ago

Unfortunately, this is probably not going to convince non-stop technical people who already are hesitant to listen to sound advice about updating; at least the people like this who I know will just hear "the update broke things" and take that as confirmation of what they already believed.

ouid• 9 years ago

Updates do two things. They repair old bugs, and they introduce new bugs, often called features. It would be great if you could subscribe to just the former, but the idea that it is uniformly better to update seems absurd to me.

From a user perspective, I never want my experience to change without my express consent. Sometimes I don't have the power to prevent it, but for my OS, I definitely have that power, and exercise it regularly.

userbinator• 9 years ago

As the memorable quote goes, "Updates are like vaccinations that have a large chance of making you grow an extra 3 ears, lose one eye, and turn your skin bright green."

Updates to fix specific and very important bugs are good. Updates that do more are not. Unfortunately, I have often pondered how to solve this problem, and come to the conclusion that it's not easy --- but perhaps if almost all the users take a stand and just do not update whenever it's not for the specific and sole purpose of fixing some important bug, even if it means leaving security behind, maybe companies will finally listen and stop making security an excuse to bundle in other unwanted changes; because then they'll know that any attempts to do so will be met with high resistance, and if their goal was to secure, they would only fix these security issues and leave everything else alone.

Although it's not Apple, the sentiment around Windows Vista and 8.x show that companies do care about their customers to some extent; but they're not going to care if the majority of users just slavishly accept whatever they get.

jacquesm2• 9 years ago

And they typically replace working systems that you're used to with broken systems with a lot of new eye candy thrown in for no other reason than to be more modern looking totally throwing off any kind of muscle memory and familiarity.

calvinbhai• 9 years ago

I hear you! I have resorted to "wait for a month or two, and then update". Usually a few point updates are available by then. Explaining security to my family and friends doesn't work (most think passowrd managers and autofill are a bigger security hole than using same password everywhere).

platinumrad6• 9 years ago

most think passowrd managers and autofill are a bigger security hole than using same password everywhere

Argh. My thanksgiving dinner in a nutshell.

rorykoehler3• 9 years ago

I never upgrade immediately. Still on Sierra. I need my machine for work. I can't justify being an Apple beta testing guinea-pig. Once i know it's stable and /or all the major problems that could affect me are at least known if not fixed then i will upgrade. Anything else is reckless. Nothing wrong with applying security patches on the old os as needed.

gurkendoktor6• 9 years ago

One problem is that Apple did NOT release a security update for older systems along with 10.12.0 and 10.13.0. Only when 10.12.1 and 10.13.1 came out did they publish patches for earlier revisions. That gives everyone a choice between using a .0 release (ouch) and running an unpatched OS for about a month.

srigi• 9 years ago

This doesn't apply to iOS. If new iOS version come out, you should update immediately so you can test if it fit your comfort. If not, you have very limited window to come back to previous major (and hopefully still secure) version of iOS.

If you miss this window, you have two options - stay on older version waiting till new version get fixed all annoying bugs (hello iOS 11), or if you already on newer version, you're screwed - no coming back.

For this reasons I stared upgrading to newer iOS versions as soon as they are available.

sumitgt2• 9 years ago

Best advice you can give to less technical friends is to just use a ChromeBook / Windows 10S device / or iPad.

General purpose computers are no longer necessary for a significant chunk of consumers.

exikyut2• 9 years ago

iPad ⇆ iOS :(

crx087• 9 years ago

ChromeBook / Windows 10S device

"Hey sumitgt, how do I get $software to work? I bought it for $79 on sale but it won't open."

iPad

"Hey sumitgt, can you help me get $university's site to work? I need to turn in my homework before midnight, but the page says something about Internet Explorer and Adobe Flash."

saosebastiao• 9 years ago

And this is the real long lasting problem with Apple’s shoddy software quality of late. Nobody I know updates their software anymore because they don’t trust that the update won’t ruin something. I personally have always updated my software religiously but even I won’t do that on my iPhone anymore. And now the only option they have to close security vulnerabilities is to force updates...and when you force it, brand loyalty is gonna take a hit.

nicolas_t• 9 years ago

I always install security updates as soon as they are released but I do not and I advise my friends not to upgrade to the latest major release right when it's been released.

I still remember the update to el capitan destroying my filevault with all my files (luckily I had backup). Recent major releases from OS X introduce regressions and are bug ridden for the first 6 months.

ertemplin• 9 years ago

Does Apple not require engineers to write regression tests? I really hope there is a blog post or press release explaining what happened.

nixpulvis2• 9 years ago

lol, don't hold your breath.

trhway3• 9 years ago

sounds like a typical extra-super-hyper-important-emergency effort under the constant gaze from the very top through the thick E/S/VP/etc. layers of CYA mediocrity eager to report up the successful completion of a glorious effort to the glorious leader in a typical BigCo where engineering culture is faltering while nobody who matters cares (or even able to care) Well, at least it was that way back at Sun :) ... Or may be it was just a one bad day at Apple. Though many people like to argue that engineering culture is exactly to prevent the "bad" days from happening...

christophilus2• 9 years ago

Yup. That paired with what appears to be the lack of a decent test process.

Maybe 2018 is the year of the Linux desktop? ... one can dream...

trhway3• 9 years ago

after i first time last year (our BigCo like any other BigCo likes SUSE and that one isn't fast on bringing in new changes) faced GNOME 3, i was wonderstruck at the engineering feat what it is ( no joking, great engineering achievement, just for different world, and it took some effort to downgrade back to GNOME 2). Seeing GNOME 3 made me completely sure that Linux desktop of our dreams just isn't coming.

_arvin• 9 years ago

Linux desktop user here, I'm pretty happy so far to end 2017.

https://i.imgur.com/yG3ep3M.jpg

chx• 9 years ago

2017 and on is the year when you run Linux on the desktop, the Windows desktop it is.

My setup tips https://github.com/chx/chx.github.io/wiki/How-I-set-up-my-Wi...

exabrial• 9 years ago

With all the pressure to produce novelty gimmicks, it's a little unsurprising :/ and unfortunate, I'm a huge fan of osx. It's nice to have a commercially supported unix system that also has a decent UI.

bsaul3• 9 years ago

I feel weird reading comments here ranging from excusing the developer to blaming him, for its lack of unit testing or anything. Let’s make this clear : management fcked up badly. Human process. Not code, not unit testing, not a single line of code is responsible. And you know why ? Because when you’ve had the greatest security failure in a decade publicly shaming your company and your team, you personaly make sure it doesn’t happen again in the next release.

And it’s not just one manager. The whole management is screwed, it’s a disaster. I think now is really time to say : would you imagine this happening under steve jobs ?

make32• 9 years ago

this doesn't even come close to being the greatest security failure in the decade. Equifax and intel ME are both much worse

Larrikin• 9 years ago

Those have nothing to do with Apple. They are massive failures from other companies.

bsaul3• 9 years ago

In case that wasn’t clear, i’m talking about Apple.

nikanj• 9 years ago

It didn't happen again in the /next release/, it happened when upgrading from an older release to the current one.

givinguflac• 9 years ago

Seriously. It’s shitty, but rebooting isn’t the end of the world. The problem is they don’t force a reboot with the fix. Now they just need to roll a new 10.13.1 with the fix and force a reboot with the standalone patch, problem solved.

revelation• 9 years ago

It probably was this great idea of merging the iOS and MacOS teams. That just screams management.

dsacco2• 9 years ago

Because when you’ve had the greatest security failure in a decade

It's nowhere close to the greatest security failure in a decade. It's not even a contender in the far off distance. It's a well publicized vulnerability, and it's quite silly, but in the scheme of things it's just a Tuesday for CVE writers. We even had a vulnerability functionally identical to this, and similar in both severity and silliness, hit Linux within the past year.

If you're talking about Apple specifically, it's still not that bad. The vulnerability couldn't be arbitrarily executed remotely with default OS settings, and it didn't grant kernel access. The Trident flaws were significantly worse than this, and that's just the first that comes to mind.

Yes, yes, I know this wasn't the thrust of your point...but still. People get kind of hyperbolic when it comes to rating security vulnerabilities. It's more silly than it is severe. I expect at least one vulnerability of comparable impact on every major point release of every major operating system and web browser (not that this is a good thing, but it's logistically realistic). I don't think this is particularly bad for Apple's public image or reputation. Headlines about "the sky is falling!" vulnerabilities make the rounds every so often; for better or worse, it never really seems to stick in public consciousness.

bsaul3• 9 years ago

because it doesn’t provide remote access, you’re right. But it’s been released publicly before there was a patch available, on an OS that’s only used as a personal computer, not as a server. And is immediately exploitable by just anyone, with 0 technical background. I think that makes it a very big deal, no matter what CVE usually use for a scale. I also don’t remember any macOS security breach getting that much publicity.

scintill76• 9 years ago

I'm not necessarily doubting, but what is the Linux vulnerability you're referring to?

mk89• 9 years ago

It's more silly than it is severe

So, being able to install spying software on any Mac OSX is something silly for you?

Let's say I just don't agree.

Feniks• 9 years ago

That's because the public doesn't care about security.

How many people read patch notes or are aware what security patch their Android has?

mephitix2• 9 years ago

I agree that management fucked up to allow this to happen again. But saying it's purely management's fault is another extreme.

In big companies there are layers of 'management', including down to dev leads and tech/virtual leads who are devs by title. Knowledge of codebase/systems/deployment increases as you get down to the leaves. There are architects, release managers, product managers, etc. that should have provided multiple checks/balances. It's easy to point at "management" in big companies just as it is easy to point at "developers". But there's a whole bunch of nuances in the middle.

fmihaila• 9 years ago

There are architects, release managers, product managers, etc. that should have provided multiple checks/balances. So to say it's purely "management" isn't quite correct to me.

The fact that all the architects, release managers, and product managers that you mentioned do not function as a coherent structure capable of eliminating the occurrence of critical defects is the definition of management failure. NASA also had plenty of architects and directors when Challenger exploded. Such catastrophic failures, especially on repeat, are indicative of systemic disfunction. That is always the fault of top management.

giobox• 9 years ago

would you imagine this happening under steve jobs?

Of course it could have. Making software is hard, and mistakes get made. The idea that the magical presence of Steve would prevent this is absurd.

There were plenty of terrible MacOS bugs under Steve's reign too. I can't help but feel there is perhaps a new generation of Mac users who don't remember or didn't experience how painful OS X was at times, even many years after the OS 9 to X transition had started.

brians• 9 years ago

Not magical. Fucking terrifying, and uninterested in the management layers designed to insulate any level staff from the consequences of this mistake. Compare Rickover.

mattkevan• 9 years ago

It’s true.

OS X versions 1-3 were pretty bad. 10.3 was the first to be useable. 10.4 was actually good. Then 10.5 Leopard (or Leper as we knew it) was awful on release. From Snow Leopard onwards it’s been much better, with the occasional howler of course.

It seems to be a constant refrain that Apple’s software quality is declining in the same way civilisation is always falling or HN is becoming more like reddit.

In High Sierra they painlessly replaced the filesystem. Quite an achievement. Although everyone involved in this latest problem should be highly embarrassed.

likelynew• 9 years ago

What do you mean when you say management fucked up: they don't think it's worth to invest in quality of apple software? This is a decision, not a fuck up.

asveikau• 9 years ago

This is a decision, not a fuck up.

Can't it be both? I feel like when people talk like this, it abstracts away from the concept of a bad decision. Everything's a tradeoff! Sounds great until you hit actual consequences.

incadenza• 9 years ago

Queue obligatory 'this wouldn't have happened under Jobs' posts.

CamperBob2• 9 years ago

Well, it would only have happened once, that's for damned sure.

pwdisswordfish2• 9 years ago

Would a problem with something as fundamental as this happen with an open source UNIX-like distribution and fail to be discovered or adequately fixed?

Would anyone feel compelled to apologize for mentioning a mistake by an open source project on Twitter?

The gentleman who tweeted about Apple's mistake actually apologized for it on Medium. Crazy.

https://medium.com/@lemiorhan/the-story-behind-anyone-can-lo...

Apple can claim it is "certified" as UNIX(TM). And publish the source for userland code it copied from open source projects.

Microsoft is trying again to subsume "UNIX" into Windows allowing users to run Linux binaries without running a Linux kernel.

But neither is a substitute for the original open source UNIX-like projects.

This blunder by Apple proves that even the wealthiest company on Earth does not necessarily produce better "UNIX" than a group of unpaid volunteers. At least if the user cares about the basics.

bartvk2• 9 years ago

The gentleman who tweeted about Apple's mistake actually apologized for it on Medium

I read his statement but I don't see an apology there. It's a reply to people who are saying he should've practiced responsible disclosure.

ryanpcmcquen• 9 years ago

Apple's security team is nailing this.

zerostar07• 9 years ago

The saga continues

smsm42• 9 years ago

Everybody can have a bug. Even a bad one. In fact, virtually every system does have a doozy now and then. But recently with Apple it looks like they are serving them constantly lately. Shame for this to happen to the company that once could be pointed at as an example of somebody who gets how to make a professional Unix-based desktop.

based2• 9 years ago

http://www.iphonehacks.com/2017/12/macos-10-13-2-beta-6-root...

alphabettsy• 9 years ago

It appears the problem is that the fixes included in the security updated were not backported to 10.13.1 which caused a problem for users coming from 10.13.0 that had done the security update. Certainly a huge issue, but many commenters seem to misunderstand the article.

jarym• 9 years ago

Generally I’ve noticed more bugs on High Sierra than on previous OSX releases. Things ranging from UI glitches to freezing safari to random slowdowns - all across multiple different machines.

Coupled with the security issues it’s clear that whoever is responsible for Q&A these days is asleep at the wheel.

It’s the reliability of the hardware and software that brought me to Apple back in the days of the G4.

Ironic that I may have to switch back to Windows since my work machine seems less buggier than my Mac!

dingo_bat2• 9 years ago

Win 10 has its fair share of bugs, tbf. In fact win 10 feels like a Google product that never leaves beta. There will always be glitches and weird stuff. Some things have become very good over several iterations. But there are a ton of new stuff they keep adding and all of those are half baked until the next big release.

TazeTSchnitzel• 9 years ago

The worst thing about Windows 10 is there’s a mandatory, automatic OS upgrade every few months, which Microsoft pretend is simply an update. This can and will break things every single time.

bfred_it2• 9 years ago

Incredibly my El Capitan -> High Sierra update went smoothly and fixed the abhorrent wifi problems I had had forever—however that was the only reason I wanted to upgrade. macOS has not been evolving for a while. I miss the Leopard days.

iOS 11 on the other hand was more of a downgrade to beta on my 7 Plus.

mclehman• 9 years ago

What WiFi problems would those be? I'm sitting on Sierra for now, but my laptop has been refusing to connect to a network automatically 95% of the time on wake. Now I'm wondering if it's worth braving High Sierra for a fix to it.

ascom• 9 years ago

I recently upgraded to High Sierra on my MacBook, and I had random reboot problems: https://discussions.apple.com/message/32649321

Downgrading to Sierra fixed it... I still don't know what was causing the reboots.

vladimir-y2• 9 years ago

Apple pushes those who have not yet moved to Linux to do so?

feelin_googley• 9 years ago

One hesitates to comment on this sequence of events because it speaks for itself. But here is a stupid user opinion (mine):

I believe users place too much trust in corporations such as Apple, Google or Microsoft to protect them. There is too much debate over which company to choose ("I like ___________'s approach to security") instead of questioning whether delegating security to any of them is truly the wisest course of action.

I hope that this incident causes at least one user to question whether users might benefit from adopting a less trusting and more vigilant approach to protecting their data.

And by "vigilant" I do not mean "choosing the right tech companies to trust", diligently installing updates from these corporations and feeling self-satisfied.

I mean questioning the status quo and thinking seriously about the benefits of free, open source operating systems that are potentially reviewable by millions of developers and users. Systems that can be modified, compiled and installed easily by anyone, not only by small groups of people in corporations with special knowledge. Systems that can, e.g., permit and maybe encourage "safer", more conservative usage patterns.

Under the prevailing laws, I believe this pool of open source developers and users will always contain a larger number of people who care more about protecting user data than any groups within the above companies. It is a matter of self-interest.

Apple is a company with seemingly infinite resources at its disposal. But clearly in this case there were more people seriously interested in fixing this vulnerability outside of the company than within it. And as a dumb, naive user, I question anyone who would suggest that no one except a small group of people at Apple would be competent to do this work.

IMO, this mistake had nothing to do with what makes Apple valuable, namely their hardware. A UNIX-like OS running on Apple hardware does not need to be proprietary and, IMO, users have a compelling interest for software, that can expose their data and pose other security issues, to be open.

chrisweekly• 9 years ago

“vigilant” spelling error, not too late to edit a great comment

bsimpson• 9 years ago

I'm always a bit skeptical of this argument as a rationale for FOSS.

Of course, publishing your source code does make it a lot easier for outsiders to audit your software, but how many people actually do? Linux might be an exception because so many organizations build drivers and distributions for it (there are always people digging through the internals and likewise, hackers/security consultants looking for opportunities), but I suspect for most open source projects (even the big ones), there are way fewer people auditing them than comments like this would lead you to believe.

How many people do you think are digging through and critically analyzing Django/Node/Rails/Docker/OpenSSL/network drivers/etc? There's a mindblowing amount of code behind any application, and as developers/users, we tend to trust strength in numbers - people are using it, so it must be fine. But in practice, I wonder how much the bystander effect counteracts this intuition.

Clubber2• 9 years ago

publishing your source code does make it a lot easier for outsiders to audit your software, but how many people actually do?

I would say very, very few people in the world read random source code looking for bugs. Finding hidden bugs requires active use like a QA person would do. This has probably already been done on any major FOSS software, so any remaining bugs would be unbelievably hard to find, and very unlikely by just reading source code.

I mean it sounds good as a theory, but it also sounds like, "If I publish my book online for free, lots of people on the internet will read it."

nixpulvis2• 9 years ago

So my previous comment about how if Apple was smart they'd have a unit test for this seems to be confirmed. Apple is not smart. RIP.

jordache• 9 years ago

Oh! Well that solves the mystery of how Apple allowed their new USB-C MBPs to be so buggy in trivial use cases.

foobar1962• 9 years ago

Who remembers the System 7 Update 1.1.1?

mwcremer• 9 years ago

I do.

Heck, I was responsible for the first crashing bug found in System 7.0. It was found about six hours after GM images were released to manufacturing. It was a crashing bug. It was remotely exploitable. It was one freakin' register, for cryin' in your cornflakes.

yuhong• 9 years ago

How it was remotely exploitable?

Karupan• 9 years ago

Not regretting my decision to always be one major release behind. At this point, I simply don’t trust Apple enough to install updates without breaking my system and interrupting my work.

andy_ppp• 9 years ago

I’ve not seen this mentioned anywhere but Apple installed the security update without my permission which made me feel both sad and unsurprised that they have effectively back doors that can run code on my machine with impunity.

Will try for a Linux dev machine next time I think.

k3a• 9 years ago

It happens. Most people don't care anyway. They will continue buying and stock price will continue rising. ;)

MacOS Update Accidentally Undoes Apple's “root” Bug Patch

Related Stories