Major bug in Snow Leopard deletes all user data | Hacker News Reader

Major bug in Snow Leopard deletes all user data

neowin.net

141 pointslupin_sansei75 comments

Interesting. You really have to go out of your way to delete directories in UNIX, so this must be some sort of intentional behavior that is misbehaving. (It deletes your user's data, not the guest's data, right? Seems like the opposite of what you would want to happen.)

Anyway, this is why I prefer operating systems whose source code I can view and modify. It is nicer to find bugs by reading the source code instead of logging into your account and finding all your data gone.

Not to mention the fact that open source system allows other people to view and modify (improve) the source code, even if you personally don't know anything about programming. This problem would be solved instantly in a Linux OS (If it even got through to launch) which is the beauty when compared to proprietary software.

This is a thread about a bug in the operating system. Please let's not start the whole proprietary vs free thing again.

Because you've read the source code of user account logins of the OS you're running right now?

I don't know if he has, but I've read the source code used for user logins in the OS I'm running.

Depending on exactly where you draw the line between "code used for user logins" and the rest of the OS, I may have fixed bugs in it, too.

you are often the exception rather than the rule, cperciva.

It's the exceptional hackers that generally catch these problems early and patch them before they become a big problem, that is true.

And make the patch widely available, rather than remaining silent.

Yes, but knowledge about code is very transmittable. The fact that someone like cpercival can examine the code, and has, means that I can just freeride on his analysis, along with everybody else who has also read it. Only a fraction of users need to verify the code for all of use to benefit. And "only a fraction of users" for an open source project can still be a lot more users than Microsoft can bring to bear, and a higher caliber of users, too.

Of course, Microsoft could do most of the same thing if they opened their source. People would read that too. But that's another issue, of course.

There's a slight problem with the "google the problem, find a patch and apply it": if you can't read and understand the patch, you're in no better (and probably worse) shape than you were before, security-wise.

In some ways having a late patch from a trusted source is better than a quick one from some random place on the net. The best would be quick, trusted patches, of course. A GPG-style web of trust validation of patches, maybe?

Typically, the guy who found the flaw and fixed it will submit it to the upstream developers which hopefully will be able to tell if the patch can be trusted or not, apply it to the development repository, eventually release a patched version, and warn vendors(mostly, Linux distributions) to upgrade. The user only has to keep up to date.

Sure, but then you're back to having to wait for the vendor to supply a patch.

So you're (you being the who downvoted my comment) saying that you're NOT waiting for a vendor to approve and distribute a patch if it's been propesed by an outside developer? Please elaborate.

I think he means that if the bug was in some open-source system, we could expect a patch to be ready from someone a few hours after such announcement, instead of "as of yet, Apple has been silent."

More coders should be reading source code. Thanks for the idea, gonna spent a few hours reading the user account logins shit for GNU/Linux now ;p

Surely these two things aren't exclusive? One could log into one's account on a (Linux|BSD|etc.) installation and find all one's data gone, then read the source code to find out what went wrong. I presume you don't check the complete source code for your operating system before installing it, just to see if there are any bugs there.

Besides, checking all "OS" source code won't save you. You'll also need to read all source code for the compiler etc. as proven by Ken Thompson:

http://cm.bell-labs.com/who/ken/trust.html

I don't think anyone is suggesting that this is malicious, and any compiler-only bug that didn't affect only compiling would almost have to be.

Yes, the deletion of data is intentional:

"When guest user logs out, all information and files in the guest account's home folder are deleted."

However, it deletes user's data instead of guest's.

Perhaps Snow Leopard marks all users as guests during install (with extended attribute or something), then when you have used Guest account starts to delete all guest files/folders.

BTW, I would expect it to be in some shell/Apple script anyway, so Open/Closed Source argument doesn't really stand here.

yes, but you don't know which program calls this script and what for.

But you can find out! http://opensource.apple.com/release/mac-os-x-1061/

Remember you don't have a right to modify a script simple because you can. Usually modification of a copyright work is forbidden and I'll bet Apple strictly disclaim any ability to modify which would otherwise be fair use.

Have you heard of a little something called Fair Use? If you were to modify one of Apple's system utilities and then distribute it, you could easily run afoul of copyright. Simply making a local modification in-place, however, is no more illegal than installing a new hardware driver, changing your shell prompt, or downloading and using Firefox in place of Safari.

Now, if you changed some piece of the system in order to circumvent FairPlay, or some other DRM component, then you might be running afoul of the DMCA. Not the same thing as copyright violation, however.

Apple might dispute this given their position on iPhone jailbreaking.

(I'm not saying you're incorrect, but being right doesn't make it any cheaper to defend yourself against a dedicated opponent with deep pockets.)

One name. Jon Lech Johansen.

Um, those last two words in my sentence ... plus you could have at least got me on "it's probably APSL actually".

The point of an OS is that it abstracts away these details, so that I don't have to bother about them. I just want my OS to work, regardless of whether it's open source or not.

>It is nicer to find bugs by reading the source code instead of logging into your account and finding all your data gone.

And yet, having the source open did nothing to prevent the Debian SSL-cert bug from happening.

Perhaps it got patched faster because the source was open, but the bug was in there for quite some time before it got caught.

There is a difference in detectability of "all my files get erased" and "a number isn't random enough". The second one is easily missed by a lot of people. If Windows or OS X has a similar bug, my guess is that it will never be found.

... outside of black hat circles.

There's also a subtle point that lots of people have looked at OpenSSL and trusted it, but not everyone knew that Debian-SSL was just a little different.

Lots of people have looked at the Windows number generator (or its results) to see if it's wrong. Lots of people have looked at OpenSSL too. But the place they are likely to look is the official releases, not the distro forks.

Being open source allows many small variations to exist. It's not enough to know you're using open source and that a million eyeballs have looked at it. Have the million eyeballs actually looked at the exact source you are running?

If I had to guess, I would say that user accounts are part of Darwin, not Aqua. If that is the case, you can still view (and modify) the source code.

I upgraded from Leopard to Snow Leopard, didn't use the Guest account under SL until yesterday... thankfully I did not experience this bug.

I upgraded from Leopard to Snow Leopard, and my computer got slower and slower as time went on. Opening a file in Vim started to take about 10 seconds. Literally "everything" was slow. Had to reformat and start over. Random, but it adds to my personal statement of "I've never had a smooth OSX upgrade, even after 5 years".

On the other hand, I've always erased and installed fresh, with Snow Leopard being my first upgrade - and it has been good, with the exception of a corrupt font cache (2500~ fonts).

Just to give a counter point, I read about people having problems with the Leopard => Snow Leopard upgrade so I was very cautious when it came time for me to upgrade. I upgraded from Leopard to Snow Leopard on my early 2009 Mac Pro and have not experienced any issues yet.

I do however suspect that perhaps the reason I had such a smooth upgrade was because my Mac Pro was quite new and my installation of Leopard at the time it was upgraded to Snow Leopard was pretty much a pristine factory install, with very little if any cruft hanging around.

Still these kinds of things make me happy that I keep an up to date bootable backup of my system drive and I'll be purchasing a separate external drive to use with Time Machine some time soon.

Since this story has been around for a while I'm a bit skeptical of a Windows news site making a big deal out of it the day after the Microsoft SideKick incident. Luckily it's a rarely used feature in OSX which is how a bug like this can exist without much fanfare. I'm more concerned about the Finder file-copy-no-merge issue which is dangerous design by choice; not a bug. At least once a week I almost get burnt by it so I imagine normal users who aren't so careful are constantly destroying data due to badly worded dialog boxes.

It seems to affect upgrades only, at least that's what the article implies.

This is one of the reasons why I prefer to do a clean install between major releases of any operating system. It has lower chances of hitting some untested or poorly tested config combination that ends up causing strange issues.

And after hitting this bug, doing a clean install becomes much less of a hassle. Silver lining!

I'm amused by the number of commenters who are jubilously vindicated that OS X has a nasty bug, as if that somehow makes Windows better.

I'm not surprised. Just yesterday, everybody was Bashing Microsoft/Danger for something very similar.

[Nitpicker's corner: Dispute "very."]

Hence why this weeks-old news is suddenly being pushed by decidedly pro-microsoft sites like neowin today.

If it's weeks-old news, doesn't that only make it worse that Apple still hasn't bothered to fix it?

Whether it does or not doesn't change the fact that pro-microsoft sites and, apparently, microsoft employees are trying to deflect attention from the sidekick incident by digging up and publicizing an obscure bug in OS X. Crying "b..b..b..but Apple!" when faced with bad press rather than owning what happened might make microsoft fans feel better, but at the price of further alienating developers who see through the transparent charade.

While it's easy and fun to assume malice behind everything Microsoft does, sometimes a cigar is just a cigar.

Saying that this news (which should be spread since it can lead to quite unpleasant problems) is being promoted by Microsoft fans doesn't take away from the severity of the bug. And the fact that this news is out certainly doesn't take away from the disaster that is the Sidekick story.

Take a step back and try to avoid looking at it from a "Microsoft is a bunch of evil jerks" perspective.

I've said this many times to many people, but I'm going to say it again. Don't upgrade to Snow Leopard! Install it from fresh!

When I upgraded from Leopard I had a smorgasbord of bizarre problems and bugs - with a fresh install, perfection. And I've seen the same pattern over and over. Stop being lazy and install it from fresh - it's worth it.

You're right and you're wrong.

In my experience, you're right to recommend a fresh installation of a significant OSX change, rather than just an in-place upgrade.

However, Apple goes out of their way to say that you should be able to upgrade in-place. And, in general, users want to be able to upgrade in place. It's a reasonable thing to want since it will take at least some time to reimport your data, applications, settings and so on.

So, it's a bit much to call people lazy for doing what the manufacturer promises you can do.

Well, yes, you're right - they say you should be able to do it. In my experience with Leopard and Snow Leopard, however, I don't think Apple's QA is good enough for them to be confidently recommending this course of action.

On the plus side, at least once you're set up, you can stick with it forever and a day. Back in the Windows 98 era, you pretty much had to reinstall the same OS fresh every year or go insane ;-)

See also MobileMe Launch.

Scuttlebutt is that an early developer seed may be the cause of the problem - so if more people had used that seed, this would have been caught sooner. Of course more people would have been hit by the bug.

This happened to me this week, slightly differently: I took my non-booting MacBook, on which Snow Leopard had been installed a few weeks ago, into the local Apple store [Note: the disk problem on the MacBook was made more critical by the fact that while investigating it, using my backup disk to boot from, I managed to drop the backup drive about 3 feet, killing it]. I'm not 100% sure what they did: the "Genius" I was interacting with was a fast typist. When I got home, after buying a new backup disk [3X the capacity, ~same price as the old one], the internal drive was not only unbootable, but my user account directory was empty. Luckily DiskWarrior came through, finding just about everything. Almost back to normal.

It's Apple's attempt to convince people of the wisdom of enabling Time Machine.

Flippant comment, but there’s some serious truth in this. Data you haven’t backed up is data you don’t want. Time Machine makes backing up trivial to the extent that it’s a zero button solution. I plug in my external hard drive, it recognises it as a Time Machine backup and automatically syncs any changes since the previous backup.

Time Machine makes backing up trivial to the extent that you have a sufficiently large HFS volume sitting around, and don't need to back up MySQL databases. And if you're unlucky, it can also automate the process of losing all your data:

http://tomkarpik.com/articles/massive-data-loss-bug-in-leopa... http://rondam.blogspot.com/2009/09/time-machine-time-bomb.ht...

What's the MySQL reference to? I haven't heard of a MySQL-specific issue with Time Machine.

For me, at least, every time I reinstalled Leopard and restored with Time Machine MySQL's data would be gone.

Was your MySQL installation configured to store data in any of the excluded directories? http://shiftedbits.org/2007/10/31/time-machine-exclusions/

If I understand correctly, Time Machine takes a binary snapshot (similar to rsync). With MySQL (and InnoDB specifically) the stuff on disk is not guaranteed to be in a consistent state while the server is running. The safest way to back up mysql is mysqldump.

Great, first the cloud, now local computers. Paper can suffer water damage or be burned. Moral of the stories: your data is never safe.

Redundant backups/distributions is the true way to go.

That's pretty amazing considering that the behaviour that causes the bug is not something unusual or rare.

I doubt that many OS X users even know they can enable a guest account.

isn't it enabled by default? I know that disabling Guest is one of the first things I do to a new Mac/PC/Linux machine.

No, guest login is disabled by default.

No, it's disabled by default - at least in Snow Leopard.

The key question then is what happens if you had enabled it in Leopard and then you install Snow Leopard as an in-place upgrade.

It looks like Apple meant to have the setting revert, so that guest logins had to be reenabled. Instead, you let your friend login to the (still-enabled) guest account and then...

There's some indication that you needed to enable the guest account in Leopard (it's disabled by default) then upgrade to a developer seed, and then to the retail Snow Leopard.

If true, that would explain why is wasn't caught sooner. If true, you could test the final build of Snow Leopard all day (and the upgrade path from Leopard) and not catch it.

I almost feel like it's "lose all user data week".

Anyway hope this kind of situations are well handled by Apple EULA.

I'm not sure what you mean. If you mean you're hoping Apple is well indemnified against civil action because of this flaw, I wonder why you're so concerned for Apple Inc.'s bottom line. Are you an investor or employee of Apple Inc.?

Some degree of liability in cases like this is necessary for companies to have appropriate motivation to avoid it. Yes, there's reputational damage involved, but for situations where the brand / product is less central to the company, the company can't be allowed to just walk away.

Agree that liability is important.

In past "delete all user data" issues (I know there was at least one prior case with Mac OS, but I don't remember details), Apple paid for hard drive recovery service for those affected.

You can't always trust 'em (they're a big company after all), but they've behaved honorably in the past.

This is the reason I NEVER upgrade, always a fresh install.

At least one new feature in that service pack! :-)

Reply on news.ycombinator.com