News for hackers. Stuff that matters.

A comment on MacOS Update Accidentally Undoes Apple's “root” Bug Patch. Parent comment

Re:MacOS Update Accidentally Undoes Apple's “root” Bug Patch by j45 on Friday December 01, 2017 @07:13PM (#15829025)
I generally stay 1 release behind (kept patched) for this reason, plus ensuring my workflow is not broken for a few months of the year.

The latest version isn't always the most stable or secure, either.

Someone had mentioned in a different post that Apple may not apply all security patches to Sierra. If I can find some support to this I think it will be picking the lesser of two evils.

[ Parent | on HN ]
Re:MacOS Update Accidentally Undoes Apple's “root” Bug Patch by gurkendoktor on Saturday December 02, 2017 @01:13AM (#15830506)
I haven't checked Apple's "security content" KB articles recently, but I remember that the fix for this bug was not backported at the time:

https://truesecdev.wordpress.com/2015/04/09/hidden-backdoor-...

[ Parent | on HN ]
Re:MacOS Update Accidentally Undoes Apple's “root” Bug Patch by platinumrad on Friday December 01, 2017 @07:20PM (#15829071)
Judging by Apple's security updates page[1], they're still releasing standalone security updates for older versions of macOS. Unfortunately, the same is not true for iOS where security updates are rolled into OS updates.

[1] https://support.apple.com/en-us/HT201222

[ Parent | on HN ]
Re:MacOS Update Accidentally Undoes Apple's “root” Bug Patch by gurkendoktor on Saturday December 02, 2017 @01:06AM (#15830479)
Apple used to release a security update for revision N-1 and N-2 every time the current release got a point upgrade. However, 10.12.0 and 10.13.0 were both released on their own. Only when 10.12.1 and 10.13.1 were released did older systems get patched.

So every time a new macOS release comes out, everyone has the choice between running a .0 release, or running an insecure OS for about a month.

[ Parent | on HN ]
Re:MacOS Update Accidentally Undoes Apple's “root” Bug Patch by vanilla_nut on Friday December 01, 2017 @09:56PM (#15829865)
Do you have any clue how to subscribe to security updates only on OS X? Looking for OS updates simply suggests downloading High Sierra, but my work laptop has to stay on El Capitan for dependency reasons.
[ Parent | on HN ]
Re:MacOS Update Accidentally Undoes Apple's “root” Bug Patch by gurkendoktor on Saturday December 02, 2017 @01:16AM (#15830517)
It suggests downloading High Sierra because you've presumably already installed this update a month ago:

https://support.apple.com/de-de/HT208221

The App Store "Updates" list is the right place to look (and refresh).

[ Parent | on HN ]
Re:MacOS Update Accidentally Undoes Apple's “root” Bug Patch by j45 on Saturday December 02, 2017 @01:01AM (#15830457)
Apparently not all patches are back-ported to older versions of MacOS.

Haven't had a chance to look into this further on how Sierra may be impacted.

https://news.ycombinator.com/item?id=15386319

[ Parent | on HN ]