Hacker News

points by kryptiskt 1 day ago | 0 comments

I'm not being sarcastic when I say that Apple should copy Windows Update, I have no idea how they have got this far without a method to add small patches outside monolithic OS updates.

[–] tedd4u 1 day ago

They have it. It’s called Xprotect. I’m surprised it hasn’t been used to remove the bad certs.

https://fullmetalmac.com/cybersecurity/macos-security/xprote...

[–] saagarjha 1 day ago

XProtect removes malware, not certificates

[–] tonymet 1 day ago

what are the capabilities? presumably it could a apply a diff, patch or overwrite a file. in this case it's not even in the protected partition.

[–] tonymet 1 day ago

Microsoft even has multiple express channels. For example Windows Defender definitions are practically real-time

[–] acdha 1 day ago

Just like Apple has. The problem here is whoever made the decision not to use that capability:

https://support.apple.com/en-us/102657

[–] tonymet 1 day ago

not quite. this is more similar to Windows Quality Updates. Defender updates are real time (up to multiple times a day, and delivered p2p)

[–] reaperducer 1 day ago

I have no idea how they have got this far without a method to add small patches outside monolithic OS updates.

You're either not an Apple user, or never noticed Settings → General → Software Update → Automatic Updates

[–] xp84 1 day ago

I think they meant that Apple’s updates seem to be the opposite of incremental, and they’re not wrong. If anything, Apple has moved in the exact opposite direction in the past decade, moving towards using enormous cryptographically-signed volumes (“sealed” is the term). This makes Apple really happy because they can make sure the users aren’t allowed to modify any of the “system“ files themselves for any reason, but also means that they can’t incrementally update things as easily as they did before. They ship multi-gigabyte “patches” every time.

[–] acdha 1 day ago

Being able to trust the OS is a huge advantage, though, and they built the rapid response mechanism to handle those updates:

https://support.apple.com/en-us/102657

The big question is why they’re not using it for things like this, where a tiny layered file system update would benefit almost all of their users immediately.

[–] tonymet 1 day ago

but the volume with these certs isn't protected. you can edit the files with vim. i'm curious what the holdup is.