Re:macOS High Sierra: Anyone can login as “root” with empty ...
by azernik on Tuesday November 28, 2017 @09:04PM
(#15803860)
This is kind of a weird corner case; OSX tries really hard to hide the UNIXiness of its system, including the special nature of the username "root". So I can easily someone not thinking to test it out super thoroughly
A lot of security vulnerabilities are of this type: "let's do crazy shit X that the system was not built for and see what breaks." I'm sure this will be in their test suite now though.
Re:macOS High Sierra: Anyone can login as “root” with empty ...
by ridgeguy on Tuesday November 28, 2017 @09:31PM
(#15804039)
Thanks, appreciate your reply.
Maybe Apple should spin up a group of 7 - 14 year-olds to add to their test suite input. They might be better at coming up with crazy shit X that might break things.
It seems to me (somebody who has no chops in this domain) that this is such a basic bug. Like something a child would have found just messing around.
And it came from a corporation that has around $200B of cash and cash equivalents. Apple has the resources to test and find bugs like this.
That Apple didn't find it is down to leadership and priorities more than some inherent limits of producing reliable code. One spends on what one thinks important.
But who knows, I've got no domain expertise here. Maybe a fifth of a trillion dollars C&CE really isn't enough to fund production of more robust code. But really?