macOS High Sierra: Anyone can login as “root” with empty password

Re:macOS High Sierra: Anyone can login as “root” with empty ... by hw on Tuesday November 28, 2017 @04:58PM (#15802238)

Why does it need to create a lot of negative publicity for Apple? Is there something you don't like about them? Responsible disclosure needs to be valued given the number of macs out there in the wild that could potentially be susceptible to issues like this, and the impact it could have on people (including you) not just directly but indirectly.

How would you feel if someone discovered a 0day at a company that exposes credit card and identity info, published the 0day, then hackers steal all that info (including yours)? I'm sure 'creating a thunderstorm of negative publicity' would be the last thing you would want.

[ Parent | on HN ]

Re:macOS High Sierra: Anyone can login as “root” with empty ... by bambax on Tuesday November 28, 2017 @06:39PM (#15803093)

> Is there something you don't like about them?

You mean, in addition to bad QA and complete disregard for their users' security? And being the richest and most profitable company ever, cutting corners and evading taxes?

Their response on Twitter was amazing: "PM us so we can discuss this privately", not "thank you, we're looking into it NOW".

[ Parent | on HN ]

Re:macOS High Sierra: Anyone can login as “root” with empty ... by macintux on Tuesday November 28, 2017 @11:34PM (#15804601)

I suspect the response on Twitter was a typical reply from a tier 0 support person. No reason to extrapolate from that to the company's internal response.

Apple is a Rorschach test writ large. What people see in it reflects more on the observer than the company in many cases.

[ Parent | on HN ]

Re:macOS High Sierra: Anyone can login as “root” with empty ... by soneil on Tuesday November 28, 2017 @05:07PM (#15802311)

I don’t see it as either/or. You can disclose responsibly, and go for publicity once the fix is in circulation. Responsible disclosure is nothing to do with protecting Apple, it’s about protecting the users.

[ Parent | on HN ]

Re:macOS High Sierra: Anyone can login as “root” with empty ... by 5ilv3r on Tuesday November 28, 2017 @06:32PM (#15803037)

The problem is that this is not a zero day in new technology. They made a jr sysadmin mistake. As a company who wants a reputation for good security, that is not acceptable.

[ Parent | on HN ]

Re:macOS High Sierra: Anyone can login as “root” with empty ... by flywheel on Tuesday November 28, 2017 @05:09PM (#15802330)

Far too many people think of Apple as infallible. I often think even Apple thinks of themselves as infallible. The more people that are aware of the inherent risk involved with using computers - any computer - the better.

[ Parent | on HN ]