10 thoughts on “The truth about a new vulnerability on OS X Yosemite”

1. Richie and his entire team at iMore really have become the team to take head on the “apple is doomed / insecure” headlines and actually put some fact back into the argument. Well done Ritchie.

2. C’mon this is bullshit. A one-liner to get root access is a catastrophic security fail. No matter if you’re Microsoft, Google or Apple… The analogy would not be that they broke into your house and can break into a locked drawer but can observe every freaking move you make without you knowing. You know, like e-banking and stuff.

3. I’d agree it’s a catastrophic failure on Apple’s part. But for me, do I care? No.[*] Because nobody is ever going to get a chance to run that one liner on my computer.

   [*]-Well, not much. I’ll certainly install the official fix when it becomes available.

4. The real issue is probably not this specific bug but that there is obviously at least one complete moron on the OSX kernel team that was able to add ridiculous insecure code to a critical component without anyone noticing it…

5. Eh. I dunno. Bugs are pretty easy to introduce. I think better fundamental protection systems are probably a better answer than trying to catch every imperfection, and Apple’s been adding those.

   Would it be better if they’d caught this? Yes, of course. Is it embarrassing it got through? Also yes. Is it an especially unreasonable introduction? Meh. Probably not. More’s the pity.

6. As a developer I’ve created my portion of bugs. The problem here is that this “bug” was not in some casual application or framework but at the heart of the OS, the dynamic linker. Even for a beginning C programmer it is apparent that the added code is not without risk. To say the least. It is really scary to see something like this making it into the core OSX code base. If you read the details on this vulnerability, you’ll notice that fundamental protection systems where present but the coder simply ignored them and no-one noticed. Not good.

7. Developer here, too. 🙂 I totally agree. And it’s terrible, but arguably it’s always going to happen. In an ideal world, were it possible, it would be better for the system to protect itself against stupidity like that, right?

8. Yes, I agree. I think we’re on the same line here. Protective systems definitely need to be in place and improved to help prevent these type of issues. My only concern would be that the moment people put their faith in a system, it slowly takes out awareness, common sense and personal accountability. Not sure in what way a system could have prevented this error but a bit more awareness of potential security risks on the side of the coder probably wouldn’t have hurt. That’s why I think it’s good that ‘bugs’ like these are not played down and instead get the attention they need so management takes proper action instead of just rolling out the next patch.

9. My point, if any, is under most circumstances I wouldn’t like seeing blame tossed on an individual developer. Mistakes like these happen, and we don’t know how many eyes looked at that code and thought it was fine.

   If this code was reviewed and someone said “No, don’t do that, because massive security problem!” and it was committed anyway we can blame the developer. But if their system is for the code to be reviewed and nobody actually looked Apple needs to figure out what went wrong in the system and fix that.

   It’s not that I find the bug acceptable, I just feel for the dumbass coder who might (MIGHT) have done everything right. 🙂

10. I see that I have difficulties imagining a system where a coder can do everything right and this specific implementation and its consequences come out as a result. But yeah if this was the case, than I fully agree that this poor sole is definitely not to blame and I apologise for calling him or her a moron… Thanks for not giving up on me 🙂