News for hackers. Stuff that matters.
Re:About the security content of Security Update 2017-001 by cptskippy on Wednesday November 29, 2017 @02:07PM (#15809777)
> it will be automatically installed on all systems running the latest version (10.13.1) of macOS High Sierra

So uh... where are all those people who lost their mind about Windows 10 forcing updates?

http://i2.kym-cdn.com/photos/images/newsfeed/001/042/619/4ea...

Re:About the security content of Security Update 2017-001 by benchaney on Wednesday November 29, 2017 @02:16PM (#15809875)
People weren't upset about windows installing security updates. If this update adds nagware to OSX or forces people to restart their computer in the middle of whatever they are working on, your comment will be a fair point. Until then, it is an stupid comparison.
Re:About the security content of Security Update 2017-001 by arachnophobe on Wednesday November 29, 2017 @03:24PM (#15810506)
As of the latest update macOS has started to nag me to allow automatic updates, so I think the comparison is probably valid.

FWIW I told it No, for the same reason my Win10 laptop has been nagging me to update but I've not let it install for a month - until I've finished whatever work I'm doing I'm not going to let a possibly badly written patch stack the OS and leave me rebuilding the machine from scratch (yes - I'm looking at you Windows - TWICE) or dealing with whatever beta-level release macOS is going to throw out that breaks remote access etc. that I need on my build server.

Re:About the security content of Security Update 2017-001 by cptskippy on Wednesday November 29, 2017 @06:59PM (#15812088)
Oh geez. Have you ever tried to skip iCloud setup? Or Cloud Keychain? Or two factor authentication?

It's like trying to leave a time share presentation.

Re:About the security content of Security Update 2017-001 by cptskippy on Wednesday November 29, 2017 @03:11PM (#15810392)
People were upset with Windows 10 for it's update policies for a number of different reasons but those very different reasons have all been lumped together into a singular general objection so that addressing one of those reasons will never solve the objection thus making the only possible solution disabling Windows Update. It's silly.

Feature updates and quality updates are handled differently in Windows 10. You can delay feature updates for a year, quality updates (security) can only be delayed for a month.

I'm not sure what specific thing you're referring to when you say "nagware", seem my first paragraph, but there's no persistent nagging in Windows 10.

Re:About the security content of Security Update 2017-001 by Macha on Wednesday November 29, 2017 @07:59PM (#15812420)
Really? How do you do that? My windows machine informed me it was going to install the fall creators update when I shut it down for the night with no option not to (only to choose a different 8 your max active period)
Re:About the security content of Security Update 2017-001 by cptskippy on Wednesday November 29, 2017 @11:51PM (#15813558)
Argh! It looks like it's only an option on Pro, my Home machine doesn't have it. That's lame...

It's under Settings -> Updates & Security -> Advanced Options on Pro.

Re:About the security content of Security Update 2017-001 by digi_owl on Thursday November 30, 2017 @11:36AM (#15817079)
That is the really worrying trend in personal computing as of late. Treat consumers like dumb sheep, and "professionals" are barely competent children (only devs are "responsible adults", according to themselves)...
Re:About the security content of Security Update 2017-001 by SG- on Wednesday November 29, 2017 @03:00PM (#15810307)
It's only automatic if you have the option enabled which is the default behaviour, it isn't 'forced'. This update doesn't even need a restart.
Re:About the security content of Security Update 2017-001 by votepaunchy on Wednesday November 29, 2017 @03:10PM (#15810383)
That's not what is being reported on daringfireball (emphasis added):

"This morning, as of 8:00 a.m., the update is available for download, and starting later today it will be automatically installed on all systems running the latest version (10.13.1) of macOS High Sierra."

Re:About the security content of Security Update 2017-001 by GeekyBear on Wednesday November 29, 2017 @04:12PM (#15810904)
By default, all systems have the "Install system data files and security updates" setting in the App Store Control Panel enabled, so they will indeed automatically install it.
Re:About the security content of Security Update 2017-001 by SG- on Wednesday November 29, 2017 @03:16PM (#15810439)
I'm telling you how it is because I just did it myself, in App Store -> Software Update the update was there asking me to install it. There are options in App Store system prefs panel that let you change the default behaviour.

That being said, there's no reason why this shouldn't be applied automatically.

Re:About the security content of Security Update 2017-001 by qubex on Wednesday November 29, 2017 @02:11PM (#15809818)
I realise that this is a facile topic for engendering scandal amongst our geek demographic (and rightly so), but given the gravity of the underlying issue it’s actually entirely reasonable and indeed preferable to the alternative scenario of N hundred million insouciant users lagging behind with a gaping security hole.
Re:About the security content of Security Update 2017-001 by cptskippy on Wednesday November 29, 2017 @02:27PM (#15810003)
I don't disagree about the necessity of being able to force updates for bugs of this severity. I'm simply pointing out that, when Microsoft does forced updates, people lose their minds with outrage.

You could argue that severity plays a role in the level opposition to such a feature however severity is an arbitrary assessment applied by the person issuing the update.

> the alternative scenario of N hundred million insouciant users lagging behind with a gaping security hole.

Last I checked macOS hadn't crossed the 50 million user mark. The combined iOS/macOS user base only just surpasses Windows.

Re:About the security content of Security Update 2017-001 by GeekyBear on Wednesday November 29, 2017 @04:09PM (#15810874)
Apple still allows users to control their system's update behavior.

"Install system data files and security updates" is turned on by default in the App Store Control panel, but the user can turn it off if they (unwisely) wish to.

In Windows XP, for example, Windows Update had a similar option, but that was removed in Windows 10.

Re:About the security content of Security Update 2017-001 by eridius on Wednesday November 29, 2017 @04:56PM (#15811248)
AIUI the expectation is that Apple is going to force all 10.13.1 machines to automatically upgrade themselves regardless of settings. This is something they've apparently done once before, with an ntpd remote vulnerability. Given the nature of this bug, forcing all machines to automatically apply this patch seems like the right move.

(BTW the patch doesn't require restarting the machine, so it's not going to interrupt anyone's workflow)

Re:About the security content of Security Update 2017-001 by GeekyBear on Wednesday November 29, 2017 @05:34PM (#15811537)
Not regardless of settings, but critical security updates will be installed without user intervention with the default settings in the App Store Control Panel.

Here's an article discussing their first use of this mechanism.

https://www.computerworld.com/article/2862976/apple-deploys-...

Re:About the security content of Security Update 2017-001 by xenadu02 on Wednesday November 29, 2017 @06:32PM (#15811907)
No, the poster you replied to is correct. If you turn that setting off you will not automatically get this update.