Comment by wildmusings | Hacker News Reader

Comment by wildmusings | Hacker News Reader

Parent Full thread

10.9 hasn’t received security updates for three years and a half years. https://support.apple.com/en-us/HT201222

Running an old version of an operating system that’s not actively getting security updates, let alone gotten any at all for over three years, is crazy. It’s one thing to run it offline or heavily firewalled for a limited purpose, like running some important application that doesn’t work on current versions. But to actually use it day to day is absolute madness.

I hope you’re not handling any information that you have a duty to someone else to keep safe. Putting it on such an old OS release, through intentional and tedious effort on your part, would be outrageously negligent. Even logging into work email through that setup would be irresponsible. Or accessing any email account to which someone has sent private information (so just about any email account you actually use). It’s negligent with regards to your own data too of course, but at least that’s just your problem.

I hear this a lot but never with any actual quantification of the risk. The population still running 10.9 has to be so low its just not worth attacking.

The burden of using the current version is so low (op is in fact expending significant effort to not make the safe choice), that imposing any additional risk on others is unjustified. That kind of analysis—the burden of caution vs. the risk of not taking it—is how the law measures negligence. I’m not giving legal advice of course. But the law tracks the morality of negligence pretty closely in my opinion.

My 2011 macbook is already not supported by new versions and Mac hardware are not backwards compatible with older OS versions. It's extremely likely that they can't even run newer versions even if they wanted to. If not now then in the near future.

I think trying to make any moral argument in this situation is pointless as the risks are so minuscule. But should we go down that road the environmental benefits of keeping older hardware in use for longer far outweighs any security risks they may impose on others.

> op is in fact expending significant effort

And the reason I'm expending effort is because this is important to me. My computer isn't just a tool, it's where I spend a significant portion of my life.

I want Mavericks's beautiful interface in my life. That has inherent value.

Is that a justification you'll be comfortable giving after the fact? "I know a took a risk with your private and sensitive [business/intimate] data that you trusted me with, and now it has been compromised, but you have to understand, the interface was so beautiful. It was worth it."

Small part of me agrees with you, but then again I see fortune 100 companies, banks and government getting away with similar or worse on regular.

A few weeks ago, I pointed out to one of our clients that they are using vulnerable TLS library (with know exploits) on internet facing service.

They scheduled upgrade for service in august next year.

So honestly op running obsolete version of osx is really drop in the bucket.

If he's using an up-to-date browser and a firewall it feels like the practical risk is relatively low.

What remote exploits are you concerned about in that scenario? Where it would affect 10.9, but not 10.16.

I'm not doubting they exist, but I'm really curious the threat scenario that would apply here, and how likely you think that might be.

Can you please provide more detail as to what attack vectors you forsee being a problem? I want to be conscientious of security concerns, but I legitimately can't think of a scenario that would make what I'm doing genuinely unsafe.

This machine:

• Is connected to the internet.

• Is behind a router. All incoming ports are closed, except one for ssh. (An updated SSH binary has been installed via Macports.)

• Runs Little Snitch, so I can monitor what data gets sent out of my machine.

• Is running an up-to-date copy of Firefox.

• Has all important data backed up to cold storage regularly.

I consider any application I install locally to be trusted code, so the only source of untrusted code is the Javascript that I run inside of Firefox, which is up to date.

Some attack scenarios I can imagine:

1. There's a Firefox zero day. My vulnerable OS does not offer the extra layers of protection that a newer one might.

2. Someone exploits Spectre/Meltdown/etc via Javascript. My attacker is incredibly lucky, and the tiny portion of memory they retrieve just so happens to be the bit that contains something vital, like my master password.

3. Someone emails me a malicious image, which isn't caught by Gmail (personal accounts) or Microsoft Exchange (work account), and infects my machine when it's rendered by Apple Mail.

4. A person I know/trust is tricked into sending me an infected document, likely a PDF or MS Office file. Even though I don't have Acrobat or Microsoft Office installed, the vulnerability is compatible with Preview or iWork '09.

I'm not a particularly important person, so I think I'm more likely to die in a plane crash than get hit by 1 or 2. The latter two scenarios are maybe a bit more concerning, but not to the point where I consider them real threats. Particularly given that I also have cold data backups and Little Snitch.

For one, a large number of native applications use the OS's webview widget, so you remain exposed to the outdated Safari engine even if you don't use Safari.

You're also going to have to use outdated versions of various software packages, as you describe in your post. That's another security hole.

As you note, bugs are often found in video and image decoders. The one in your OS isn't being updated anymore.

And consider that not every fix for a segfault or other bug gets labeled as a "security patch", but that doesn't mean that they don't present security issues. I imagine most engineers fix the buggy code and move on, and never really consider if there was a security hole there. In other words, it's common for vulnerabilities to be discovered long after they were fixed. And there are probably many more that remain undiscovered despite being present in old versions.

Yeah, the chances I'd run into those things just seems incredibly low.

Separately:

> And consider that not every fix for a segfault or other bug gets labeled as a "security patch", but that doesn't mean that they don't present security issues.

But this would imply that the newer version is inherently less buggy, wouldn't it? At least in terms of user-visible bugs, Mavericks is actually a lot more solid in my experience. That's a part of why I want to do this. Apple keeps adding new features and breaking old ones in the process.

There is no question Mavericks has more known vulnerabilities, and that's significant. But as an academic question, I'm not at all convinced that Mavericks has more unknown vulnerabilities. If nothing else, it almost certainly has a smaller attack surface.

Reply on news.ycombinator.com