Hacker News Reader

Comment by m6g6a | Hacker News Reader

Kinda aggressive. I don't even clicked on update and they already did that for me.

Apple has used the force-upgrade path which you cannot opt out of (at least not easily) and which is permitted by their TOU, exactly twice, both to address serious security vulnerabilities.

Once for this problem, and once for the NTP security bug in 2014. That is it.

https://support.apple.com/en-us/HT204425

Is it possible that "Automatically check for updates" and "Install system data files and security updates" are set in your system preferences?

I have that enabled because this is exactly the kind of thing I want patched ASAP.

Yes, you right. I checked them.

They force-pushed code to your box without you agreeing to this? Can anyone else confirm?

It's a massive global security vulnerability with huge amounts of public exposure (so any malicious user is well aware they can take advantage). If they did, wouldn't be surprised and I'd be glad they did.

If they did for this, great. But the fact that they could for any other update, too, is what's scary.

They do this all the time with invisible updates.

Click AppleMenu > About this mac > System Report, and scroll down to Software > Installations, and click on the "Install Date" column header twice to sort by install date descending, and you will discover apple pushing updates very frequently for things like "MRTConfigData", "XProtectPlistConfigData", "Voice Update - Samantha", "Gatekeeper Configuration Data", "Chinese word list update" etc etc.

It's not without flaws; at least once they slipped up and pushed a blacklist for their own ethernet adapter driver (cutting off their own patch life-line, I guess, for those affected) : https://www.digitaltrends.com/computing/mac-update-breaks-et...

It's an option that this person enabled. Nothing scary.

I opened App Store, found the package waiting and hit install, waited for a few minutes until it finished. So not automatically for me.

The update didn't auto-install for me. I suppose it only does that when "Install system data files and security updates" is enabled in System Preferences -> App Store.

right, for me neither. I can choose.

There are options in macOS to automatically install various types of updates, labeled as 'app updates', 'macOS updates', 'system data files and security updates'. Maybe m6g6a has the last one checked.

I opened App Store and just had it waiting for me. Where the name would normally be in the Updates tab, it just reads "Install this update as soon as possible." [0]

[0] https://imgur.com/a/bMUKO

Edit: According to Apple's statement, they will automatically start installing the update on systems running 10.3.1 later today.

Not for me, it's waiting for me to click install in the App Store. Its pretty well highlighted though.

It almost shouts at you. Mine says "Install this update as soon as possible"

Whoever installed the OS agreed to it. http://images.apple.com/legal/sla/docs/macOS1013.pdf:

”Q. Automatic Updates. The Apple Software will periodically check with Apple for updates to the Apple Software. If an update is available, the update may automatically download and install onto your computer and, if applicable, your peripheral devices. _By using the Apple Software, you agree that Apple may download and install automatic updates onto your computer and your peripheral devices_. You can turn off automatic updates altogether at any time by changing the automatic updates settings found within System Preferences.”

They do have this capability, and have for years, although they rarely use it. They're force-pushing this update later today. It says so right in their statement:

"the update is available for download, and starting later today it will be automatically installed on all systems running the latest version (10.13.1) of macOS High Sierra"

Reply on news.ycombinator.com