macOS lock screen: “I just sent my session pass to my whole team”

Re:macOS lock screen: “I just sent my session pass to my who... by CodeWriter23 on Friday December 08, 2017 @04:56PM (#15882413)

So, security through obscurity. No thanks. I'd rather know about the exploit ASAP so I can implement a workaround, rather than wait months for the vendor to get off their ass while my systems are getting hacked by the hundreds if not thousands of hackers that have 0-day knowledge.

Calling what you describe as "Responsible" is intellectually dishonest.

[ Parent | on HN ]

Re:macOS lock screen: “I just sent my session pass to my who... by will_hughes on Friday December 08, 2017 @07:49PM (#15883449)

Perhaps you can write a patch or mitigate effects of (say) an OpenSSL bug. I can't. Certainly not for the myriad of devices that embed well known libraries in firmware images that I don't get to modify myself.

I'd much rather that those things which are remotely exploitable across millions of devices to be kept quite for a small period of time (30-90 days depending on the complexity of the fix required) so that I can get patches from our vendors and schedule an update at the first available opportunity.

You might call it security through obscurity, I call it keeping shit from burning down.

[ Parent | on HN ]

Re:macOS lock screen: “I just sent my session pass to my who... by CodeWriter23 on Saturday December 09, 2017 @02:19PM (#15887505)

There are numerous potential workarounds besides authoring a patch. And they can be distributed in a user-accessible fashion, like the workaround for the macOS blank root password was.

Not telling the world about it does not keep shit from burning down. Eliminating vulnerable targets is the only thing that does that. And that is more expediently served by full and prompt disclosure.

[ Parent | on HN ]

Re:macOS lock screen: “I just sent my session pass to my who... by daveFNbuck on Saturday December 09, 2017 @02:10AM (#15884674)

What do you think it is that I'm calling responsible? I'm in favor of the public disclosure for this particular bug, and that seems to be your position too.

[ Parent | on HN ]

Re:macOS lock screen: “I just sent my session pass to my who... by CodeWriter23 on Saturday December 09, 2017 @02:14PM (#15887472)

Sorry, I man-read your first sentence then hit reply. Please accept my apology.

[ Parent | on HN ]