Actually, no. For all computers, running macOS High Sierra, a computer with a root password is a whole heck of a lot more secure than one without a root account at all :)

But seriously, a fix is whatever fixes the problem.

It is now. There's going to be a whole lot of people who are going to set a root password because they read an article online recommending it, then install the update that fixes this issue. Now they're stuck with a root password when they could have not had one at all.

> Now they're stuck with a root password when they could have not had one at all.

And many users will create insecure passwords, leaving them with a serious vulnerability after the patch. A password of "root" or "qwerty" is only marginally more secure than a blank one.

Could the patch also handle this case? Can you create a root account in OS X?

If it was previously possible to create a root account then I guess there's no way to tell the difference between those who created the password as a response to the vulnerability and those that knowingly created a root account.

> Can you create a root account in OS X?

Yes, you can. macOS ships with the account disabled by default, but you can re-enable it if you wish. Most of the time there is no reason to do so.

> If it was previously possible to create a root account then I guess there's no way to tell the difference between those who created the password as a response to the vulnerability and those that knowingly created a root account.

Yes, but this difference doesn't matter. By creating a root account you have made your computer less secure anyways, assuming that we didn't have the current issue at hand.

And as a result, they've been safer sooner than other people.

Shouldn't matter as long as the password is strong?

Making it difficult to access something is always worse than not having anything to access. Plus, the average person will set their root password to something like 123456 or qwerty, which is clearly insecure.

> Making it difficult to access something is always worse than not having anything to access.

Not a choice now. If people have physical access to Macs at the moment then it seems to me there are two options right now: either 1) you have changed the root password, hopefully to a strong password or 2) they'll be able to login as root.

Right now you can expect the participants in this thread to be a little smarter than the average computer user.

Someone tell the Linux and UNIX users of the world that having a root account with a password is a "hack."

If they're setting passwords just to prevent a bug, then yes it's a hack.

The same actions can be a hack or not, depending on what they're accomplishing.

Having a root account is a password isn't a hack, it's making one as a workaround for this bug that is.

If setting a root password is a hack, I'm Donald Duck.

Uhg, ok I forgot some people don't know the code. The old adage is "On your first day as the new sysadmin, change all the root passwords". The idea is that a SECURE root is good, possibly better than no root (which is sort of a hack in itself). There are best practices for root passwords. Things like length, composition (no dict words), disabled for remote access, and care in who is allowed to have it.

Simply pretending root does not exist is a rather new idea and is not best practice. It's only for convenience.

> composition (no dict words),

This is an outmoded guideline for password security. String enough dictionary words together and you achieve a high level of entropy. See for example https://en.wikipedia.org/wiki/Diceware

> Simply pretending root does not exist is a rather new idea and is not best practice. It's only for convenience.

Says who? Sure, it's convenient not to have to worry about choosing a secure password for your root account, but why is it "sort of a hack in itself"?

I assume he means that you should always set a password for "root". Though most users don't even knows it exists.. hence it should have been taken care of by apple.

No, not always. I just mean that sudo is a (very very popular) hack.

I really can't respond to you unless you explain your reasoning…

Seems like you are splitting hairs here. Clearly, the point the commenter was making is that people that have now set the root password as a result of the tweet are more secure than they were before the tweet.

In a week they will be less secure, because they will forget to remove their root account and Apple will have push out a fix.

That's a whole week where they can get owned by any kid with physical access to the machine. In some settings (schools, libraries) this might be a huge issue.

Which comes back to another point I made in this thread: there should have been responsible disclosure of the issue.