Hacker News Reader

Comment by _pmf_ | Hacker News Reader

> I'm not sure who makes me more cranky: Apple for apparently sitting on the fix, or Stefan Esser for flinging the vulnerability into the breeze for anyone to catch.

One party makes billions off their users, and will most likely continue their practice of not supporting 3 year old systems even if they are still in wide use for the next time. This should pretty much clear up who is worse.

> Esser has his reasons - "Short reminder: Europeans are not allowed to disclose vulns privately to a foreign company like Apple without registering dual-use export"[1] - but it's hard to believe he couldn't have told them anonymously.

You're suggesting that he should feel ethically obliged to break the law for helping out a company that takes part in the usual tax and labor law evasion tactics (not to mention customer protection evasion in the US)?

View on HN

>> I'm not sure who makes me more cranky: Apple for apparently sitting on the fix, or Stefan Esser for flinging the vulnerability into the breeze for anyone to catch.

> One party makes billions off their users, and will most likely continue their practice of not supporting 3 year old systems even if they are still in wide use for the next time. This should pretty much clear up who is worse.

I don't agree. I have a six year old Macbook. In those six years I've updated to a new OS about three or four times. One time it has cost me 20 euros, the others were free. Not only that, but updating is a breeze, it's painless and never was a problem. I never had to do a complete reinstall. My mother could have done this. It's clicking a few buttons and that's it.

On top of that, there is no serious degradation in speed. They claim it's even faster, but that probably isn't true for the older hardware. So even if they don't support their three year old OS, you can update your six year old system to the most current one without problem. They could have served these updates as minor ones, but that wouldn't be fun, nothing to show, no new names, no big shows.

Now tell me - what is it that they don't support?

> helping out a company that takes part in the usual tax and labor law evasion tactics

Irrelevant. The moral question being raised here is about potentially hurting Apple users via irresponsible behaviour, not about helping Apple itself. Just because Apple does it (by sitting on the problem) does not make it right for other people to put the public at risk as well.

Both parties can be in the wrong at the same time, the behaviour of neither of them is not valid defence for the other.

You do have to be very careful in these cases because of the way the law is set out and how easily companies turn to litigious defence instead of actually fixing problems. In this case I would recommend anonymously informing the controlling party. Of course if he had already done that then things are different and public disclosure is probably the only other thing he could have done.

> The moral question being raised here is about potentially hurting Apple users via irresponsible behaviour

The logical next step is that Apple have been intermittently flippant about security (of late they have improved but their approach is still wholesale unacceptable). Why do users knowingly use an OS with this track record?

> anonymously informing the controlling party

With government surveillance could he have had any guarantee that his disclosure wouldn't have been snooped?

Either way this discussion can be argued ad infinitum. The real villain here is the European Commission for such a brain-dead policy.

> Why do users knowingly use an OS with this track record?

Knowingly might be a stretch there. Many don't know any better either through lack of education on such matters or deliberate ignorance.

> The real villain here is the European Commission for such a brain-dead policy.

I'd argue that this means there are three villains, rather than the bad law being the one and only problem!

> I'd argue that this means there are three villains

Good point. Specifically regarding Apple and EU: something really needs to change.

>The logical next step is that Apple have been intermittently flippant about security (of late they have improved but their approach is still wholesale unacceptable). Why do users knowingly use an OS with this track record?

Perhaps because ever since 2001 there are 5-6 new stories like this with huge scaremongering headlines and "sky is falling" implications, and then NOTHING absolutely happens, at worse a tiny miniscule of OS X boxes are ever affected, and there are absolutely no implications for 99.9% of users. In the meantime, Apple, even if slow to respond to stuff like this, does improve OS X security infrastructure steadily.

Meanwhile, in the same real world, people have to constantly fight viruses off of Windows boxes (slightly better after 8, but still a real concern).

Btw, no it's not just about "small market share" either. Mac OS had even smaller market share in the late 90s (even 1/10 as small as OSX), but it still had lots of malware and viruses people caught.

> "sky is falling" implications, and then NOTHING absolutely happens

Sure, just brush off a sudo vulnerability.

> fight viruses off of Windows boxes

Virus != vulnerability.

Furthermore, while a rootkit is still a virus it's a long-shot from the relatively benign things running around on Windows machines (not that I mentioned Windows at first, but there ya' go - were on to that now). Just to avoid a Windows shitstorm, the same thing could be said of BSD. I am absolutely certain that there is at least one virus for the platform; however, the damage it could possibly do is seriously mitigated by the security of the platform.

"Viruses" (used as a distinct term to "rootkits") can at worst log a few keys up until your next virus scan. After that, poof! They're gone.

A "rootkit" (which requires a sudo/UAC vulnerability) can also at worst log a few keys or something. When you do your virus scan you're going to find nothing. It's going to sit on your machine until kingdom come because the virus is more privileged than you.

Security is like a backup. You only care about it when you have the random bad experience of actually needing it. I'm sure there are a bunch of Windows users who lament turning off UAC now that their files are all encrypted by ransomware. It has nothing to do with "market share" and has everything to do with risk: "UAC is such a stupid feature."

I could leave my keys in my car ignition every night of my life. No matter how much "market share" that car brand has all it takes is the random misfortune of someone on the street noticing that I do that.

Just keep in mind that it was you that bought up all these tangential topics.

Viruses are not going to go poof unless your antivirus knows about them And in the typical case a vulnerability is a prerequisite for a virus.

But local vulns are only a concern if someone already has access to your system. In which case your usually fucked anyway. Which is why Apple introduced developer certs and gatekeeper.

> Which is why Apple introduced developer certs and gatekeeper.

Yeah that is a really neat feature from a security standpoint.

>Sure, just brush off a sudo vulnerability.

If it doesn't impact me, and has never had, I will. Just like I don't feel any need to run antivirus and anti-spyware on my Ubuntu box, whereas I do on any Windows box 1 own (3 of them).

>Virus != vulnerability.*

Well, the vulnerability has to be exploited to matter. Either by some virus, some hackers, some malware, creating a botnet, whatever. If it never does, or its always in the form of some trojan needing a stupid user to install it willingly, I don't care about it.

The mere existance of it is not really important. All systems had, have and will have some vulnerabilities.

I'm not some wide eyed believer in the invulnerability of OS X. I've cut my teeth on Sun OS (pre Solaris) and HP-UX, and I've run Linux since 1997.

I just don't care much for hypotheticals.

As for my data, I back them up. I can go back to a clean system, if anything happens, within 10 minutes with rolling archived bootable backups. And I re-install from scratch + dumb data in around 5 hours (I just did it a few weeks ago to try El Capitan).

>Security is like a backup. You only care about it when you have the random bad experience of actually needing it. I'm sure there are a bunch of Windows users who lament turning off UAC now that their files are all encrypted by ransomware. It has nothing to do with "market share" and has everything to do with risk: "UAC is such a stupid feature."

Well, it's kinda stupid. Even with UAC enabled the same users would just have gone ahead and authorized it to install the malware in the first place, not knowing what it is and just wanting to get it out of the way.

Besides, if they had earlier backups of said files, removing the ramsonware and restoring the original files would be a few minutes affair.

>I could leave my keys in my car ignition every night of my life.

And if you live in certain countries where car theft rarely or never happens, you'll be justified too.

There are countries were people sleep and even leaves their house with the doors unlocked and windows open.

Not because theft is impossible -- just because it's rare enough that barely even registers, and they don't feel any need to be paranoid.

It's a healthy lifestyle, even if 1 in 100.000 has something stolen from time to time.

Heck, it's healthy even if it's you that has had that misfortune.

I believe parent is implying he should feel ethically obliged not to put everyone at risk that has a laptop.

It has nothing to do with what's good for the company. That's not what responsible disclosure is about.

I have a 2011 Macbook Pro. Sure it doesn't get AppNap or a few other small features, even if I've installed an SSD, but OS-wise I've been able to install all updates since I bought it. It's still supported, especially hardware-wise when I had a couple issues with it.

2007 iMac running the most recent OS here.

Reply on news.ycombinator.com