Hacker News

points by cromka 1 day ago | 0 comments

Things like this is why I moved back to Linux after 10 years on macOS.

Not sure what Linux offers that's any better. Didn't Debian ship trivially weak SSH keys for over 2 years because they were trying to silence Valgrind warnings and the random maintainer had no idea what they were doing and there was no oversight or peer review whatsoever?

[–] usef- 1 day ago

That's one issue from one distro 18 years ago. Have there been recent things? This thread is about a today's MacOS, and an issue known publicly for more than a week.

[–] 1718627440 1 day ago

> the random maintainer had no idea what they were doing

Upstream was involved in it as well. Sure it was a communication problem, but it's not like the maintainer just decided to this unilaterally. Also this WAS undefined behaviour, so from a language perspective it was already broken, even if it worked accidentally in practice.

[–] direwolf20 1 day ago

The Debian maintained patched by "fixing" two very similar looking "bugs" on different but identical lines of code:

One that mixed uninitialised data to the entropy pool.

And another one that mixed initialised data to the entropy pool with the exact same function call. Which was, in fact, almost all of the entropy.

[–] bawolff 1 day ago

In 2008.

I don't think its wise to make current security decisions based on screw ups from almost 2 decades ago.

[–] petcat 1 day ago

Well that "screw up" was so egregious that it should take at least a decade to regain any trust.

I don't really care one way or another. I use Linux and I use macOS. But I'm not naive to think the security is any better in one or the other.

[–] cromka 1 day ago

> Well that "screw up" was so egregious that it should take at least a decade to regain any trust.

Do you use macOS? Because if you did, then how did you recover from them allowing anyone to straight-up log in as root without password? And then mess up the fix for that bug? That wasn't 2008, that was 8 years ago.

[–] alt227 1 day ago

> it should take at least a decade to regain any trust

Then as it has been 2 decades you should be all good right?

[–] fg137 1 day ago

Security practice was generally very, very bad two decades ago, by today's standards, across the industry.

I don't see the point of being so fixated on that.

[–] petcat 1 day ago

I was responding to the OP saying "stuff like this is why I'm moving back to Linux". It's nonsense.

[–] alt227 1 day ago

No, pulling up a bug from 18 years ago to argue against the fact that linux is secure is nonsense.

[–] cromka 20 hours ago

And yet you never responded to my "login to macOS as root without password" argument.

That's convenient!

[–] simondotau 1 day ago

Somehow I doubt many people will be saying that about eMudhra a decade from now.

[–] baobabKoodaa 1 day ago

Two decades

[–] efficax 1 day ago

i think you mean almost 20 years ago old man

[–] bawolff 1 day ago

I edited my comment

[–] kobalsky 1 day ago

You are going so back that gmail was served over HTTP (not HTTPS) in that era.

If that's the worst you have against Linux then it looks like it has done very well.

[–] cromka 1 day ago

Not really, no. HTTPS was used, except for log-in only. But cookies traveled unencrypted, so you had access to the account anyhow.

And not just GMail, this was virtually every service out there. From a perspective, it's laughable how bad security was back then.

[–] mattstir 1 day ago

Besides singling out a single bug from a single distro two decades ago, Linux offers maintainers who actually care to push security fixes within a few hours of globe-spanning vulnerabilities being disclosed? Not sure how that's confusing or controversial.

[–] boxed 1 day ago

It's funny. When Apple goes in and changes peoples systems deeply without consent then it's Apple being evil. When they don't, it's Apple being evil. Heads I win, tails you lose.

[–] 1970-01-01 1 day ago

Let's pretend there's a night and day difference between pushing some MP3 onto all iPhones and distrusting a chain of certs that hold the value of '4'. At minimum Apple need to revoke everywhere these joke-level certs live and as fast as possible, and on all devices which also means out of support. Breaking is acceptable here as CA trust is fully compromised.

[–] mattstir 1 day ago

Yes, there would be crowds of angry people, furious that Apple... released a critical security patch? Framing removing compromised certs as "changing peoples systems deeply" seems intentionally in bad faith.

[–] 1718627440 1 day ago

It's funny, when I do steal something I get called bad, and when I do nothing and turn the blind eye to others stealing, I get called bad too.

Morality doesn't solely depend on action or inaction, it also matter what you act or don't act to.

[–] simondotau 1 day ago

I've seen this referred to as the "All Roads Lead to Rome" fallacy.

[–] cromka 1 day ago

Eh? Changes systems without consent? Is that the ONLY way to update a fatal flaw in system? Normal update channels don't work?

Besides, how does this relate to my Linux point, where no one installs anything without you knowing it?

[–] boxed 1 day ago

Because in the linux situation, you wouldn't get such an update automatically anyway so it'd be worse?

[–] cromka 1 day ago

How would it be worse? Linux distros patched things almost immediately and you'd get a notification, typically after a daily check.

How is that worse than NOT having any sort of fix from Apple?

[–] kqp 1 day ago

I don’t think you understand what consent means.