Hacker News Reader

Comment by platinumrad | Hacker News Reader

I've been struggling for a long time to convince some of my less technical friends that keeping all of the software on their devices up to date is an important best practice from a security perspective. I'm afraid that the recent muck ups in High Sierra and iOS 11 are going to make sure that some of them never listen to me ever again.

View on HN

I have a hard time believing that your less technical friends are even following Apple news. The average person that walks into an Apple store and buys a Mac probably has no idea about the original vulnerability, let alone the multiple patches for it.

You don't need to be following "Apple news" to hear about this. It has been all over the news.

Indeed. You never need to follow Apple news to get Apple news, Apple is perhaps the one company that all MSM loves to talk about.

And i attribute that to themselves being largely Apple users by force of habit.

Maybe they won't be aware of this particular vulnerability but issues like the the iOS autocorrect bugs[1][2] get memed to death on all sorts of mainstream social media platforms. Even the original "root" tweet got 10k+ retweets.

[1] https://www.theverge.com/2017/11/6/16611756/ios-11-bug-lette... [2] http://bgr.com/2017/11/27/ios-11-problems-keyboard-autocorre...

Sure but that's still a far cry from saying that even a significant percentage of the Mac user base is aware of it. Social media moves so fast that there's almost no chance it penetrated the zeitgeist. A big well known flaw was the iOS 8.0.1 update that bricked iPhones. That was pulled within a few hours of it being released but the scale of the iPhone meant that it impacted a large number of people. This is too invisible for anyone to notice.

The average person that updated their iOS to 11 during the first two weeks has definitely noticed how bug-ridden it is with power issues, 3D touch issues, and the autocorrect bug.

We've trained people to update ASAP for security reasons, but when Apple drops the ball and seriously fucks up iOS 11 for a month until 11.1.1 was released, this will keep users update-shy.

I hope 2018 emphasises rock-solid releases for both macOS & iOS. Or Apple should move to a two-year release cycle (wishful thinking).

There is still unfixed IOS 11 introduced bug [1] that kills notification screen which requires powercycle to fix. Some users hit it multiple times a day.

[1] https://discussions.apple.com/message/32638979?ac_cid=tw1234...

I hear you, and I have the same problem (hi, Dad) but it is worth noting that this latest re-occurrence of the bug happens only to machines that were not up-to-date when they downloaded (or rather, when Apple remotely installed) the security patch.

If a machine had 10.13.1 (the latest version of macOS) installed when that happened, it is OK.

If the machine had 10.13.0 installed when Apple installed the patch, however, then the update to 10.13.1 will bring the bug back, and necessitate both re-installation of the security patch and a reboot before the machine is again safe from the "root access for anybody who can spell 'root'" bug.

Unfortunately, this is probably not going to convince non-stop technical people who already are hesitant to listen to sound advice about updating; at least the people like this who I know will just hear "the update broke things" and take that as confirmation of what they already believed.

I never upgrade immediately. Still on Sierra. I need my machine for work. I can't justify being an Apple beta testing guinea-pig. Once i know it's stable and /or all the major problems that could affect me are at least known if not fixed then i will upgrade. Anything else is reckless. Nothing wrong with applying security patches on the old os as needed.

One problem is that Apple did NOT release a security update for older systems along with 10.12.0 and 10.13.0. Only when 10.12.1 and 10.13.1 came out did they publish patches for earlier revisions. That gives everyone a choice between using a .0 release (ouch) and running an unpatched OS for about a month.

So you would recommend staying no more than one annual release behind?

See my answer to the sibling post. I'm not sure what to recommend. When 10.14 comes out, we'll probably have to read the KB article to evaluate whether the security fixes are so important that we should install 10.14.0 immediately (no matter how buggy it may be).

I'm never that far behind with my strategy. After a while you get diminishing returns by not upgrading.

Sorry, I think my post was not very clear.

macOS High Sierra 10.13.0 was released on 2017-09-25. Sierra (10.12 and El Capitan (10.11) were not patched on that day. So if you didn't upgrade to 10.13.0 _on the first day of its availability_, you were missing out on these security fixes: https://support.apple.com/de-de/HT208144

Apple only released patches for 10.12 and 10.11 along with 10.13.1, more than a month later (2017-10-31): https://support.apple.com/de-de/HT208221

The same pattern happened when 10.12.0 was released - older systems only started receiving security fixes on the day 10.12.1 was released.

So it is generally true that Apple keeps the three most recent versions of macOS secure, but there's always this awkward gap around September where they don't.

This doesn't apply to iOS. If new iOS version come out, you should update immediately so you can test if it fit your comfort. If not, you have very limited window to come back to previous major (and hopefully still secure) version of iOS.

If you miss this window, you have two options - stay on older version waiting till new version get fixed all annoying bugs (hello iOS 11), or if you already on newer version, you're screwed - no coming back.

For this reasons I stared upgrading to newer iOS versions as soon as they are available.

I'm always up to date on ios. I rarely use my ipad for programming related tasks

And this is the real long lasting problem with Apple’s shoddy software quality of late. Nobody I know updates their software anymore because they don’t trust that the update won’t ruin something. I personally have always updated my software religiously but even I won’t do that on my iPhone anymore. And now the only option they have to close security vulnerabilities is to force updates...and when you force it, brand loyalty is gonna take a hit.

I always install security updates as soon as they are released but I do not and I advise my friends not to upgrade to the latest major release right when it's been released.

I still remember the update to el capitan destroying my filevault with all my files (luckily I had backup). Recent major releases from OS X introduce regressions and are bug ridden for the first 6 months.

I generally stay 1 release behind (kept patched) for this reason, plus ensuring my workflow is not broken for a few months of the year.

The latest version isn't always the most stable or secure, either.

Someone had mentioned in a different post that Apple may not apply all security patches to Sierra. If I can find some support to this I think it will be picking the lesser of two evils.

Judging by Apple's security updates page[1], they're still releasing standalone security updates for older versions of macOS. Unfortunately, the same is not true for iOS where security updates are rolled into OS updates.

[1] https://support.apple.com/en-us/HT201222

Do you have any clue how to subscribe to security updates only on OS X? Looking for OS updates simply suggests downloading High Sierra, but my work laptop has to stay on El Capitan for dependency reasons.

It suggests downloading High Sierra because you've presumably already installed this update a month ago:

https://support.apple.com/de-de/HT208221

The App Store "Updates" list is the right place to look (and refresh).

Apparently not all patches are back-ported to older versions of MacOS.

Haven't had a chance to look into this further on how Sierra may be impacted.

https://news.ycombinator.com/item?id=15386319

Apple used to release a security update for revision N-1 and N-2 every time the current release got a point upgrade. However, 10.12.0 and 10.13.0 were both released on their own. Only when 10.12.1 and 10.13.1 were released did older systems get patched.

So every time a new macOS release comes out, everyone has the choice between running a .0 release, or running an insecure OS for about a month.

I haven't checked Apple's "security content" KB articles recently, but I remember that the fix for this bug was not backported at the time:

https://truesecdev.wordpress.com/2015/04/09/hidden-backdoor-...

I hear you! I have resorted to "wait for a month or two, and then update". Usually a few point updates are available by then. Explaining security to my family and friends doesn't work (most think passowrd managers and autofill are a bigger security hole than using same password everywhere).

>most think passowrd managers and autofill are a bigger security hole than using same password everywhere

Argh. My thanksgiving dinner in a nutshell.

Updates do two things. They repair old bugs, and they introduce new bugs, often called features. It would be great if you could subscribe to just the former, but the idea that it is uniformly better to update seems absurd to me.

From a user perspective, I never want my experience to change without my express consent. Sometimes I don't have the power to prevent it, but for my OS, I definitely have that power, and exercise it regularly.

As the memorable quote goes, "Updates are like vaccinations that have a large chance of making you grow an extra 3 ears, lose one eye, and turn your skin bright green."

Updates to fix specific and very important bugs are good. Updates that do more are not. Unfortunately, I have often pondered how to solve this problem, and come to the conclusion that it's not easy --- but perhaps if almost all the users take a stand and just do not update whenever it's not for the specific and sole purpose of fixing some important bug, even if it means leaving security behind, maybe companies will finally listen and stop making security an excuse to bundle in other unwanted changes; because then they'll know that any attempts to do so will be met with high resistance, and if their goal was to secure, they would only fix these security issues and leave everything else alone.

Although it's not Apple, the sentiment around Windows Vista and 8.x show that companies do care about their customers to some extent; but they're not going to care if the majority of users just slavishly accept whatever they get.

And they typically replace working systems that you're used to with broken systems with a lot of new eye candy thrown in for no other reason than to be more modern looking totally throwing off any kind of muscle memory and familiarity.

Best advice you can give to less technical friends is to just use a ChromeBook / Windows 10S device / or iPad.

General purpose computers are no longer necessary for a significant chunk of consumers.

iPad ⇆ iOS :(

I meant more as a replacement to laptops and desktop computers.

> ChromeBook / Windows 10S device

"Hey sumitgt, how do I get $software to work? I bought it for $79 on sale but it won't open."

> iPad

"Hey sumitgt, can you help me get $university's site to work? I need to turn in my homework before midnight, but the page says something about Internet Explorer and Adobe Flash."

I guess that is the case in a lot of places. But things are changing and quickly as well. These devices are fashionable so adoption of them comes from edicts up top to IT.

Microsoft has been pushing the office online suite a lot in universities and businesses.

Also went to university a number of years ago and they used simple HTML file upload stuff for turnins of coursework.

Reply on news.ycombinator.com