News for hackers. Stuff that matters.

A comment on macOS High Sierra: Anyone can login as “root” with empty password. Parent comment

Re:macOS High Sierra: Anyone can login as “root” with empty ... by joshuaturner on Tuesday November 28, 2017 @05:07PM (#15802316)
I would argue that releasing this vulnerability as irresponsibly as he did is showing he cares more about negative publicity than user security.

Yes, it's Apple's fault for poor QA that this was released, but this guy also put users at risk by telling the entire world about it without giving Apple a chance to fix it.

You're right, it's about user security before publicity. So make sure users are safe first.

[ Parent | on HN ]
Re:macOS High Sierra: Anyone can login as “root” with empty ... by jlgaddis on Tuesday November 28, 2017 @06:27PM (#15802992)
"as irresponsibly as he did" is how all vulnerabilities were announced, at one time. I miss those days, personally.

Nowadays, you're "irresponsible" if you don't follow some vendor's own made up procedures.

[ Parent | on HN ]
Re:macOS High Sierra: Anyone can login as “root” with empty ... by Angostura on Tuesday November 28, 2017 @07:04PM (#15803268)
You can follow your own procedures - decide for yourself how long you think it is reasonable for the company to mitigate in private. But give the company some time.
[ Parent | on HN ]
Re:macOS High Sierra: Anyone can login as “root” with empty ... by MatthewWilkes on Tuesday November 28, 2017 @10:10PM (#15804231)
Why? You're not an employee, you're a concerned citizen. You havr no obligations to vendors whatsoever. Now, I think it's nice to do responsible disclosure, and I certainly don't envy the people whose week has been ruined, but the discoverer of this bug did nothing wrong.
[ Parent | on HN ]
Re:macOS High Sierra: Anyone can login as “root” with empty ... by ptlu on Tuesday November 28, 2017 @11:29PM (#15804584)
It is about the increased risk fellow users will have due to this style of disclosure. Who cares about the vendor, but they are best situated to resolve the issue quickly for everyone.
[ Parent | on HN ]