News for hackers. Stuff that matters.

A comment on macOS High Sierra: Anyone can login as “root” with empty password. Parent comment

Re:macOS High Sierra: Anyone can login as “root” with empty ... by simplify on Tuesday November 28, 2017 @06:37PM (#15803076)
If there was a vulnerability that allowed anyone to open your car and drive off with it, you wouldn't care if he was the first to find it or not. You'd only care about it getting fixed before anyone else knows about it.

I'm not sure what length grace period is appropriate, though.

[ Parent | on HN ]
Re:macOS High Sierra: Anyone can login as “root” with empty ... by cwkoss on Tuesday November 28, 2017 @07:39PM (#15803455)
If there was a vulnerability that allowed anyone to open my car, I'd want to known ASAP, because I wouldn't trust the manufacturer to provide a remedy quickly enough that eliminates my risk.

Same applies for Apple. No reason to believe this guy was the first one to find this exploit, we only know he was the first one to publicize it.

[ Parent | on HN ]
Re:macOS High Sierra: Anyone can login as “root” with empty ... by simplify on Wednesday November 29, 2017 @12:22PM (#15808702)
> I wouldn't trust the manufacturer to provide a remedy quickly enough that eliminates my risk.

True, and this is where the analogy breaks down, since they would not be able to remotely send over a fix. But Apple would, and apparently now has.

[ Parent | on HN ]