News for hackers. Stuff that matters.
Re:macOS High Sierra: Anyone can login as “root” with empty ... by dtf on Tuesday November 28, 2017 @08:33PM (#15803700)
Amazingly, this was disclosed offhand on the Apple developer forums, two weeks ago (see final comment by chethan177):

https://forums.developer.apple.com/thread/79235

(spotted by https://twitter.com/fristle/status/935670476214378496)

Re:macOS High Sierra: Anyone can login as “root” with empty ... by chmars on Wednesday November 29, 2017 @04:57AM (#15805753)
… as a _workaround_ for an administrator account-related bug.

I should have known that updating to a new MacOS versions before 6 to 9 months have passed is a mistake. High Sierra is in my experience the buggiest MacOS release so far, not only security-wise. The system is not very stable and APFS reduced drive performance … :(

Re:macOS High Sierra: Anyone can login as “root” with empty ... by harryf on Wednesday November 29, 2017 @06:50AM (#15806121)
From one bad upgrade that cost me a bunch of productivity - believe it was Lion - as well as observing the struggles of colleagues, these days always wait 6 months at least before upgrading OSX
Re:macOS High Sierra: Anyone can login as “root” with empty ... by dep_b on Wednesday November 29, 2017 @07:01AM (#15806170)
I basically only update when (a beta of) Xcode tells me it won't run on my current version. Usually that's the point when either all bugs have been fixed or they will not be fixed before the new version.
Re:macOS High Sierra: Anyone can login as “root” with empty ... by nothis on Wednesday November 29, 2017 @08:30AM (#15806556)
Yea, Xcode is so annoying with this. What magical features does it use under the hood to not allow basic functionality and iOS support that seems completely unrelated to the macOS version? I have zero incentive to update macOS except Xcode telling me it needs a new version that only runs on the new one.
Re:macOS High Sierra: Anyone can login as “root” with empty ... by dep_b on Wednesday November 29, 2017 @08:56AM (#15806747)
Xcode still needs to compile for macOS of course. It's not just for iOS development. If you want to compile for the next version of macOS you need to be on the next version.
Re:macOS High Sierra: Anyone can login as “root” with empty ... by skykooler on Wednesday November 29, 2017 @09:58AM (#15807212)
But why? You don't need to be running the latest version of the Linux kernel to compile binaries for it. You don't need to run Windows 10 to compile programs for it. Why does Apple's compiler need to run on the same system its build target is for?
Re:macOS High Sierra: Anyone can login as “root” with empty ... by dep_b on Wednesday November 29, 2017 @10:48AM (#15807670)
Probably also to run the actual application. But a Linux kernel is a different beast than macOS versions. macOS versions are pretty stale in terms of features to change abruptly with a new release.

But I think if you keep compiling for older versions you should be able to stay on an older version for a while without newer versions of the OS refusing to run it.

It's just that sometimes new features are introduced that require you to change something in your application because there's a new or deprecated framework. Apple likes to break things to not drag a lot of legacy around.

Re:macOS High Sierra: Anyone can login as “root” with empty ... by galobtter on Tuesday November 28, 2017 @09:44PM (#15804114)
"If you're able to log in (hurray, you're the admin now)" Personally not very hurray
Re:macOS High Sierra: Anyone can login as “root” with empty ... by dvhh on Wednesday November 29, 2017 @03:41AM (#15805511)
So not so much a 0day vulnerability anymore (+ 13 days ) ?
Re:macOS High Sierra: Anyone can login as “root” with empty ... by pls2halp on Tuesday November 28, 2017 @09:16PM (#15803958)
That’s absolutely terrible. Does Apple not monitor those forums at all?
Re:macOS High Sierra: Anyone can login as “root” with empty ... by neotek on Tuesday November 28, 2017 @10:56PM (#15804444)
Apple's support forums aren't a place where Apple provides their users with support, they're where Apple users seek support from other Apple users, mostly unhelpful and often inaccurate support.

In fact, 99% of the time the only advice you'll get is "restore your iPhone", "restore your MacBook Pro", "restore your Apple TV" and so on into bitter infinity.

Re:macOS High Sierra: Anyone can login as “root” with empty ... by refulgentis on Wednesday November 29, 2017 @03:15AM (#15805420)
Those are the support forums, GP is asking about developer forums.

Yes, Apple monitors them, but apparently not closely enough :/

Re:macOS High Sierra: Anyone can login as “root” with empty ... by sarreph on Wednesday November 29, 2017 @06:49AM (#15806114)
Yeah, I miss the days back at the start of the decade when I would brim with delight over an email notification that a senior engineer / moderator had chimed-in on my thread on the Apple dev forums.

Checking the dev forums was my favourite thing to do in IT class at school :)

These days, I get that (especially now that they're open) the forums are too saturated with content to have engineers on the ball all the time... But the Captain Hindsight in me thinks they could have done with some keyword notifications to nip instances like this in the bud...

Re:macOS High Sierra: Anyone can login as “root” with empty ... by lloeki on Wednesday November 29, 2017 @08:41AM (#15806626)
You forgot about "repair permissions" and "do a SMC+NVRAM reset"
Re:macOS High Sierra: Anyone can login as “root” with empty ... by _pmf_ on Wednesday November 29, 2017 @07:19AM (#15806226)
> mostly unhelpful and often inaccurate support

Sorry that the free support for your expensive device does not match the quality of the non-existing support from your device vendor.

Re:macOS High Sierra: Anyone can login as “root” with empty ... by speleding on Wednesday November 29, 2017 @03:49AM (#15805539)
I ran into a bug with High Sierra, posted in the user forums and was contacted by a friendly Apple Engineer a day later. So they do read them, but apparently not close enough.

I could see how someone would dismiss a posting like that with an "this cannot possibly be true" shrug.