JustSomeGuy1
About
- Banned
- Username
- JustSomeGuy1
- Joined
- Visits
- 60
- Last Active
- Roles
- member
- Points
- 1,172
- Badges
- 1
- Posts
- 330
Reactions
-
macOS Sudo vulnerability could give root privileges to any local user
tronald said:
Why wouldn't they keep things up-to-date? The kernel is the primary thing that was forked, and at this point the macOS kernel (which is also used in all their other operating systems) is basically an Apple one-off. But, it produces a more-or-less standard Unix system call framework, threading and process model, and network stack. So, Unix and most Linux stuff can be compiled just fine. And, that stuff isn't Apple's differentiator. It is the graphical application layers that are Apple's differentiator.DAalseth said:I am surprised that Apple would keep current with the OS packages. I figured once they split, they would keep things in house and proprietary.
That said, Apple doesn't do that great of a job of keeping their open source Unix/Linux utilities all that up-to-date. They don't view them as a competitive differentiator, so they don't go out of their way to keep them forked and modified for their own purposes. But, they also don't seem to go out of their way to keep them up-to-date either. But that seems more of an attention issue than anything related to ideological or business motives.Good explanation, and it's true, they get lazy about keeping up-to-date, which can be really aggravating. However, I am often pleasantly surprised by what they do update when I install a new release. So while they're lazy, they're not terminally lazy. Stuff does get synced. Sometimes their changes even get merged upstream.auxio said:Yup, and I work with those languages because they're the only way to create native, cross-platform applications (core is C++ code, UI layer is native Swift/Kotlin/language du jour). Memory management isn't hard once you come up with a model of ownership. And modern C++ has reference counted pointers as part of the standard library, which is essentially what Objective-C (and, by proxy, Swift) has.
But anyways, strategies for dealing with memory management is a bit of a digression here. The point is that, for smaller apps, auditing all sources of input data for buffer overflow/invalid data attacks, any external tools used for validity, etc, isn't a massive undertaking. But yeah, it seems like this was something missed in a recent change/addition to sudo, not a security hole which has been in the tool for ages.Not so. The faulty change is about a decade old. It just required a lot of trickiness to exploit, and nobody noticed it until now.
-
macOS Sudo vulnerability could give root privileges to any local user
True. Though the problem in sudo is considerably more tricky than just a typical use-after-free or similar. Read the original post about the exploit.asdasd said:
They aren’t that simple. That’s the problem. They are written in unsafe languages like C and C++ where memory management was up to the code writer.auxio said:Given how long these tools have been around (40+ years in some cases), how relatively simple the code is compared to modern software, and the fact that they're used in server environments, I'm very surprised they haven't been fully security audited by now.
-
macOS Sudo vulnerability could give root privileges to any local user
glennh said:Is not this like saying someone can burglarized your house once they are physically inside your house? /sNot at all. It's a bit like saying someone can burglarize your house with ease if they manage to get into your gated community. It's definitely a Bad Thing. For example, it means that if you download and run malware, the malware wouldn't have to go through an authentication dialog to get administrative access.
No, about 10 years.DAalseth said:I’m very surprised that Macs would be impacted. OS-X/macOS forked off from BSD a very long time ago. This exploit must really go back into the dark ages.Just because OS X forked off FreeBSD (and NetBSD, which for some reason most people don't realize was a big part of the code base too) a long time ago doesn't mean it doesn't inherit bugs that are much much newer. It keeps up-to-date (or at least not more than a year or three old, sigh) versions of almost all the open-source code it uses, which is a huge part of the OS. And that's good! Older-version bugs are usually more dangerous than newer-version ones.It may be that Apple hasn't patched it already because some genius there said to himself "hey, we don't even ship sudoedit, so we're not vulnerable!" That of course misses the point that an unprivileged attacker can just create a sudoedit link to sudo. I expect they'll get this fixed soon. It's egregious and easily corrected.
-
Bug in macOS Fast User Switching logs out M1 Mac users
This article, like the one on MacRumors, is way behind, and quite inaccurate.The problem is with Big Sur (and possibly earlier OSes), not the M1 macs. It can occur on Intel too. It's possible that it's more common on M1s because 3rd-party software is a little more unstable on M1s. (This would have to do with CrashReporter coming up more often; see the comments on MacRumors for details.)This bug is also reported as fixed in 11.2 beta, though I can't confirm that as I'm not running it.
-
Journalist and educator Monica Lozano joins Apple's board of directors
sdw2001 said:"Journalist" and "Educator." Give me a break. She edited a journal called "La Opinion." You can't make this stuff up. And an educator? Why, because she served on the Board of Regents and at Disney? She's a social justice/progressive advocate who, according to Tim Cook, fights for a "more equitable future." What a load of garbage. Apple isn't thinking about a more "equitable" future when they are making phones in Chinese factory-cities, selling them for $1000. Or when they are selling $10,000+ Mac Pros. Or just about any other premium product. They are the world's most valuable company by market cap. They didn't get that way with their progressive PR bullshit.That is literally exactly what they did. They got that way, along with their progressive PR. Bet that hurts, doesn't it?What a triggered whiner. You're having a really bad month, aren't you?
