News for hackers. Stuff that matters.
Re:AppStore Preferences can be unlocked by a local admin wit... by btown on Wednesday January 10, 2018 @01:48PM (#16117686)
While it's tolerable to have engineers jumping between projects in, say, web frontend, I'd imagine that operating system security work is incredibly sensitive to programmer context-switching - you can't dive deep into the security model of a desktop system in your 20% time when you're working with an entirely different system (with a different CPU architecture) in your 80% time. Of course there will be some specialization on this team, but it doesn't seem to be nearly enough. Unfortunately, it will take something like a botched release (not just a security problem) and heads rolling to reverse this trend.
Re:AppStore Preferences can be unlocked by a local admin wit... by threeseed on Wednesday January 10, 2018 @02:36PM (#16118184)
Not sure if you're familiar with how iOS/OSX works.

For the Darwin team which is the actual core OS they would have to deal a lot with CPU architectures. But they again they have always dealt with this since back in the NeXT days. ARM and x86 isn't a big deal to manage and there isn't much evidence that something is wrong in that area.

For the UI teams i.e. System Frameworks, Cocoa, WindowServer etc. They are abstracted away from worrying about CPU architectures and they are the ones responsible for all the bugs we are seeing today. You can argue context switching is an issue here but again we don't have much visibility that iOS/OSX engineers are jumping back and forth every day.

Re:AppStore Preferences can be unlocked by a local admin wit... by djsumdog on Wednesday January 10, 2018 @04:51PM (#16119460)
So which team might have screwed up here? Is this a UI issue or a backend/system library issue? What about the previous root account unlock issue?
Re:AppStore Preferences can be unlocked by a local admin wit... by threeseed on Wednesday January 10, 2018 @05:55PM (#16119928)
I actually put the blame on Agile.

A few years ago there was a noticeable increase in the frequency of point updates at the expense of quality. In agile, testing either (a) relies heavily on automation or (b) only tests that particular story. In highly complex systems that's often not sufficient and rarely do security teams for example involve themselves on a per story basis.

Personally I think the industry as a whole needs to sit back and realise that Agile wasn't the panacea it was made out to be.

Re:AppStore Preferences can be unlocked by a local admin wit... by tebura on Thursday January 11, 2018 @01:04AM (#16121732)
I am absolutely agree with you. Agile is not silver bullet and people just don't get it. Also many times it is executed very wrongly.
Re:AppStore Preferences can be unlocked by a local admin wit... by ams6110 on Wednesday January 10, 2018 @06:37PM (#16120167)
Well, more specifically the issue is that unit-testing alone is not enough. At some point you have to test the entire system as a whole.
Re:AppStore Preferences can be unlocked by a local admin wit... by h_r on Wednesday January 10, 2018 @10:57PM (#16121299)
I don't think agile practices preclude running regression suites throughout the development cycle.
Re:AppStore Preferences can be unlocked by a local admin wit... by raverbashing on Thursday January 11, 2018 @03:03AM (#16122172)
No, a lot of Agile teams do have integration tests and higher level tests

But the TDD cargo-culters and UncleBob fans forget that inconvenient fact and think TDD solves ALL problems

Re:AppStore Preferences can be unlocked by a local admin wit... by derefr on Wednesday January 10, 2018 @02:17PM (#16117971)
Most of the codebases of both iOS and macOS are fundamentally the same kind of (low-level but architecture-independent C and Objective-C) code, and encouraging team unification will make that even more true—if the same people are working on both AppKit and UIKit, for example, it's a no-brainer to unify them rather than maintaining that duplication.

The exception is the kernels and drivers of each OS, which have to consider things like architecture, but I would expect that it'll still be the same individual engineers working on these who always have, no matter what their team structure looks like now. Whether or not Apple has a formal "macOS kernel team" or "iOS kernel team", those groups definitely exist and have rather static membership.

(In fact, one main benefit you might see from this is that Apple has hardware hires—many from Intel[1]—who have stepped up to apply their knowledge of formal verification methods to the iOS kernel and drivers, but haven't necessarily had the flexibility to spread that love to macOS. That can change now.)

[1] https://danluu.com/cpu-bugs/ (search for "Apple")

Re:AppStore Preferences can be unlocked by a local admin wit... by msie on Wednesday January 10, 2018 @06:19PM (#16120071)
Duplication of effort is something that a small company may worry about but Apple has boatloads of money.
Re:AppStore Preferences can be unlocked by a local admin wit... by saurik on Wednesday January 10, 2018 @06:54PM (#16120256)
It isn't just "we coded it twice" (which I would still argue is bad from a security perspective with respect to making sure both are actually correct), but "we both designed an API to solve the same kind of problem... different... so now the world has two APIs to learn on these weirdly different platforms when, by all rights, we should have just designed one".