Hacker News Reader

Comment by metric10 | Hacker News Reader

Consider that this fix doesn't just remove the goto, it enables code that previously wasn't being run or tested. They need to verify that it works and doesn't segfault, otherwise important services (like the update system itself) could end up being broken. This includes testing on all Macs that can run Mavericks, which is a larger and more complex set of hardware then iOS.

View on HN

This. Apple caters to millions and millions of people, acting rash and pushing out a fix that's not thoroughly tested could cause a lot of damage to their brand. The sad fact is the majority of people wont/don't care about this issue so it's not in apple's best interest to push out a fix that isn't thoroughly tested.

Please, stop it with the strawmans. Microsoft can push an update like this in a day, and Windows runs on .. well every hardware ever made to run anything.

Umm...they can? Do you have any examples of this? All this time, has it just been that Windows security vulnerabilities have been found on the second Monday of every month?

He can't. There were more than one "How to" on MS homepage as to how to work around an issue until a fix was ready.

Even for trivial stuff. Why? Cause in a a giant corporation, even a hotfix takes ages to get through all QA.

> Consider that this fix doesn't just remove the goto, it enables code that previously wasn't being run or tested.

Good point. Still the update will likely come as part of a large blob.

Finally, I'm just disagreeing with the "tech savvy" crowd going en-masse for Apple products. OSX is a huge step fwd to Windoze in terms of internal software architecture -- yet it carries the same risk as it is proprietary and closed in parts that are critical to its security.

Yes Mr IT-geek; your MBP is probably rooted from the moment you opened the box.

Again: call me paranoid :)

Macs are certainly full of proprietary and closed-source software, but not in this specific case. [1]

[1]: http://opensource.apple.com/source/Security/Security-55471/l...

I still don't see how that's an excuse. Better to break everyone's TLS connections than leave them vulnerable.

The risk isn't that high either, anyway.

Better to break everyone's TLS connections than leave them vulnerable.

wat

I'm not 100% sure, but I think that the Mac update system actually uses this code - if it starts failing they can't send out any more signed updates to people. Far better to wait one or two days more to make sure that you're not about to break some of the more important functionality in the OS, I would think.

> Better to break everyone's TLS connections than leave them vulnerable.

It's better to leave them vulnerable than to leave them vulnerable?

Reply on news.ycombinator.com