Nah. It’s a bug in a critical security system that made it to release. It should have been caught by automated testing—can you grep for the password, or decrypted volume encryption key, in an encrypted filesystem? When you change the password, does anything change other than the encrypted VEK? It shouldn’t!

These are in the first page of tests I’d write. NIST SP 800-111 asks for forensic pre-release testing—can you really believe such happened here?

This isn’t a failure of the engineer who wrote out the wrong buffer. Everyone makes mistakes like that. It’s a failure of the Engineering culture and engineering management that shipped without reasonable testing, or manual pre-release examination. It’s a failure of the culture that accepted bugs like this, rather than asking (appropriately, for an Apple FDE product): let’s assume that it will cost someone $1B or a thousand lives if this fails. What should we do to assure its correctness?

I opened the App Store just now to see if a few lack-of-polish bugs were present. The screen flickered a couple times and then was nothing but white and a loading spinner. Waited 30 seconds, never went away.

Force quit, reopen, loads fine.

Go to the Today tab. Scroll through. Notice that sometimes your scroll doesn't get registered. Why? Because if you try to scroll over an "Open" or "Get" button, it steals the event and breaks your scrolling. Amature mistake, and the kind of detail Apple used to always get right.

Watch OS SDK: When the user performs an action on a notification that arrives on the watch, it calls a callback on the application on the phone. What happens if the user's phone is not reachable? The action just gets dropped on the floor, and to the user the app looks buggy. (Maybe/hopefully this is fixed in the latest version of watchOS; I haven't checked.) Flawed, poorly thought out API design.

Go to the updates tab on the App Store app. Pull down to refresh. No updates, but the "Available" headline disappears and then weirdly reveal-animates back into place, an overall feeling of flicker.

Huge issues? No, but a very real drop-off in quality and polish from what Apple used to put out.

(The password bug is a little different -- obviously bugs can and do happen. But not having a testing procedure in place for the core paths through a piece of software is a huge process failure, especially for something critical like security. Every release of the software should have testers going through a plan like, "enter password hint. attempt to access volume. verify password hint is correctly shown." &c.)

(Also, to be fair, I think after taking a huge dive the quality of Apple software seems to be slowly ticking up again.)

You shouldn't accept mediocrity instead of correct software. They are worlds apart.

There is a significant difference between a bug and a severe security error regarding basics.