News for hackers. Stuff that matters.

A comment on MacOS Update Accidentally Undoes Apple's “root” Bug Patch. Parent comment

Re:MacOS Update Accidentally Undoes Apple's “root” Bug Patch by gurkendoktor on Saturday December 02, 2017 @01:05AM (#15830471)
One problem is that Apple did NOT release a security update for older systems along with 10.12.0 and 10.13.0. Only when 10.12.1 and 10.13.1 came out did they publish patches for earlier revisions. That gives everyone a choice between using a .0 release (ouch) and running an unpatched OS for about a month.
[ Parent | on HN ]
Re:MacOS Update Accidentally Undoes Apple's “root” Bug Patch by rorykoehler on Saturday December 02, 2017 @07:20AM (#15831588)
I'm never that far behind with my strategy. After a while you get diminishing returns by not upgrading.
[ Parent | on HN ]
Re:MacOS Update Accidentally Undoes Apple's “root” Bug Patch by gurkendoktor on Saturday December 02, 2017 @10:51PM (#15835860)
Sorry, I think my post was not very clear.

macOS High Sierra 10.13.0 was released on 2017-09-25. Sierra (10.12 and El Capitan (10.11) were not patched on that day. So if you didn't upgrade to 10.13.0 _on the first day of its availability_, you were missing out on these security fixes: https://support.apple.com/de-de/HT208144

Apple only released patches for 10.12 and 10.11 along with 10.13.1, more than a month later (2017-10-31): https://support.apple.com/de-de/HT208221

The same pattern happened when 10.12.0 was released - older systems only started receiving security fixes on the day 10.12.1 was released.

So it is generally true that Apple keeps the three most recent versions of macOS secure, but there's always this awkward gap around September where they don't.

[ Parent | on HN ]
Re:MacOS Update Accidentally Undoes Apple's “root” Bug Patch by nicky0 on Saturday December 02, 2017 @03:29AM (#15830921)
So you would recommend staying no more than one annual release behind?
[ Parent | on HN ]
Re:MacOS Update Accidentally Undoes Apple's “root” Bug Patch by gurkendoktor on Saturday December 02, 2017 @10:54PM (#15835871)
See my answer to the sibling post. I'm not sure what to recommend. When 10.14 comes out, we'll probably have to read the KB article to evaluate whether the security fixes are so important that we should install 10.14.0 immediately (no matter how buggy it may be).
[ Parent | on HN ]