Apple Releases macOS High Sierra 10.13.2 Supplemental Update With Spectre Fix

[petsounds]

Mine only took about 10 minutes. This made me curious, so I read through the install log /var/log/install.log - to see yours just open Terminal set it to full screen and hit cmd + a few times until the font is large enough for you to read and then type in a command like: tail -n 2000 /var/log/system.log | more

Reading carefully through that I learn things that will make me do things differently next time. For example, I don't usually use my normal userid to do upgrades as I have a separate admin account for that kind of thing. Well today I found out that it hadn't upgraded my photos or mail libraries because it thought they hadn't been used for a long time, oops.

Anyway, this upgrade updates many app sandboxing configurations, the EFI stuff, the boot and recovery partitions, base system caches and registers some hidden opendirectory nodes, amongst other things. Have a look at the install.log if you're interested.

The upgrading of photos and mail libraries could explain why it's taking so long for some people.

Thanks for the information; so this update is definitely modifying things well outside of Safari.

It's alarming that Apple seem to not be interested in patching El Cap and Sierra for Meltdown, and what I assume in the changes you noted are other mitigations against Spectre at the system level.

Neither of my main machines are on High Sierra due to the the issues I've read about, but now it is feeling like a forced upgrade. I can at least do that on my MBP, but my old El Cap Mac Pro I still use for audio work is now in a state of questionable security without even the Meltdown fix.

 

[GrumpyCat]

Leave it alone..the progress bar will finally give you a countdown during the last 18 minutes. Seems like it took 25 minutes or so to complete here.

6-core MacPro (2013) beat the 18 minute estimate but it seems like it must have been a heck of a "patch" to take that long.

 

[conifer]

Mine only took about 10 minutes. This made me curious, so I read through the install log /var/log/install.log - to see yours just open Terminal set it to full screen and hit cmd + a few times until the font is large enough for you to read and then type in a command like: tail -n 2000 /var/log/system.log | more

Reading carefully through that I learn things that will make me do things differently next time. For example, I don't usually use my normal userid to do upgrades as I have a separate admin account for that kind of thing. Well today I found out that it hadn't upgraded my photos or mail libraries because it thought they hadn't been used for a long time, oops.

Anyway, this upgrade updates many app sandboxing configurations, the EFI stuff, the boot and recovery partitions, base system caches and registers some hidden opendirectory nodes, amongst other things. Have a look at the install.log if you're interested.

The upgrading of photos and mail libraries could explain why it's taking so long for some people.

I wonder if this could explain why they took back the note that Sierra and El Capitan were patched. Namely, they now realize it is complicated to patch, they had to do it with several updates to High Sierra as they learned more. So they will then apply their knowledge to Sierra and El Capitan. I thought I read somewhere on these forums that those patches were in beta? I'm not running to High Sierra yet--I will wait a few weeks until we see what is up.

As for IOS, I thought I read that if you disable javascript you would be OK? If so, I will keep at least one of my devices on a lower version as it will run faster.

 

[bernuli]

Geekbench results for
iMac (27-inch Retina Late 2015)
Pre update:
Single-Core Score 5302 Multi-Core Score 17899
Geekbench 4.2.0 Tryout for Mac OS X x86 (64-bit)
Upload Date November 10 2017 07:52 AM

Post update is better!
Single-Core Score 5310 Multi-Core Score 18162
Geekbench 4.2.0 Tryout for Mac OS X x86 (64-bit)
Upload Date January 08 2018 06:47 PM

Perhaps the CPU is spending more time doing what you tell it to do vs. speculating as to what you might want it to be doing.

 

[organisum]

delete

 

[camelia]

There is a reason why the iMac Pro gets a different build number 17C2205 instead of 17C205 which most other macs get.

There are actually 2 different versions of the supplemental update. 1 for most macs except the iMac Pro, and another specifically for the iMac Pro.

Strangely there is no firmware update except for the iMac Pro. Not since 10.10.1 has there been a macos update without an associated firmware update (including other supplementals, security updates and all betas).

There is also no embedded os firmware either for most macs except the iMac Pro.

10.13.2 Supplemental Update for most macs except iMac Pro:



http://swcdn.apple.com/content/down...9wyripp4v22ni/macOSUpd10.13.2Supplemental.pkg


http://swcdn.apple.com/content/down...pp4v22ni/macOSUpd10.13.2SupplementalPatch.pkg


http://swcdn.apple.com/content/down...yagdvc2q89229x9wyripp4v22ni/BridgeOSBrain.pkg


http://swcdn.apple.com/content/down...9229x9wyripp4v22ni/BridgeOSUpdateCustomer.pkg


http://swcdn.apple.com/content/down...dvc2q89229x9wyripp4v22ni/FullBundleUpdate.pkg


http://swcdn.apple.com/content/down...OSUpd10.13.2Supplemental.RecoveryHDUpdate.pkg


10.13.2 supplemental update specifically for the iMac Pro:


(note only the iMac Pro gets the macos brain, and this time only the iMac Pro gets the embedded os firmware and firmware update)

http://swcdn.apple.com/content/down...0hawoeewmv1p41dv9579bnsgmn3d9z/macOSBrain.pkg


http://swcdn.apple.com/content/down...mn3d9z/macOSUpd10.13.2iMacProSupplemental.pkg


http://swcdn.apple.com/content/down...z/macOSUpd10.13.2iMacProSupplementalPatch.pkg


http://swcdn.apple.com/content/down...oeewmv1p41dv9579bnsgmn3d9z/FirmwareUpdate.pkg


http://swcdn.apple.com/content/down...mv1p41dv9579bnsgmn3d9z/EmbeddedOSFirmware.pkg


http://swcdn.apple.com/content/down...ewmv1p41dv9579bnsgmn3d9z/FullBundleUpdate.pkg


http://swcdn.apple.com/content/down....13.2iMacProSupplemental.RecoveryHDUpdate.pkg


And here is a funny trick. Replace the file extension pkg with pkm in these links and download the pkm file for macOSUpd10.13.2Supplemental.pkg and macOSUpd10.13.2iMacProSupplemental.pkg, i.e., macOSUpd10.13.2Supplemental.pkm and macOSUpd10.13.2iMacProSupplemental.pkm and open the pkm files with textedit and you can see the new build numbers somewhere near the top - BEFORE applying the update.

So you can get these pkm files here:


http://swcdn.apple.com/content/down...9wyripp4v22ni/macOSUpd10.13.2Supplemental.pkm


and


http://swcdn.apple.com/content/down...mn3d9z/macOSUpd10.13.2iMacProSupplemental.pkm


It is 17C205 for most macs except the iMac Pro and 17C2205 for the iMac Pro.



safari 11.0.2 for sierra:



http://swcdn.apple.com/content/down...kxko4twuee5e2eyglb7wua/Safari11.0.2Sierra.pkg


safari 11.0.2 for el capitan:


http://swcdn.apple.com/content/down...a1cgip0haqgpvsmsyjw/Safari11.0.2ElCapitan.pkg

Are this links safe?
Because I want to download them from my Pc

Thanks
Came

 

[tywebb13]

Are this links safe?
Because I want to download them from my Pc

Thanks
Came

The links are to apple's own servers.

So are they safe? Yeah the links are safe.

But a better question is are the updates themselves safe?

Already some have ended up with bricked macs because of the update.

So whatever you do, backup before updating.

 

[MallardDuck]

Anyone geekbench before and after?

 

[BSoares]

My MBP never finished, I killed it with the power button and it booted backup up just fine. My 2012 iMac was running Sierra so I updated it to High Sierra and after first boot it showed the supplemental update. Installed that in less than a minute.

 

[dogslobber]

Why would Apple not release a Safari update for Yosemite users? I understand Yosemite is no longer supported but for such a dangerous issue could they provide a browser update for older versions of MacOS.

If your system can run Yosemite then it can run El Cap. I think the expected result is to upgrade to be safe.

 

[camelia]

The links are to apple's own servers.

So are they safe? Yeah the links are safe.

But a better question is are the updates themselves safe?

Already some have ended up with bricked macs because of the update.

So whatever you do, backup before updating.

Good point!

Backing up with CC

Ok, my goal for this night, Trying to upgrade to High Sierra or Vista for Mac whatever

If something goes wrong can I format my computer and downgrade using my Sierra bootable USB?



Came

 

[dogslobber]

Indeed. How dare they.

The newest Mac I have is from 2009 .

They don't make Macs like they used to which is yet more testament to the through away society in which we live.

Microsoft has patched Windows 10 to fix these problems on older Macs.

 

[tywebb13]

Good point!

Backing up with CC

Ok, my goal for this night, Trying to upgrade to High Sierra or Vista for Mac whatever

If something goes wrong can I format my computer and downgrade using my Sierra bootable USB?



Came

Yeah. Good that you've got one of those. Or you could restore from the backup.

 

[David G.]

Anyone geekbench before and after?

I did.
My process... I restarted the computer before each run, and let it load the desktop and settle down for 2 minutes before having a go with Geekbench 4...

Mid 2012 15 inch 9,1 MBP (non retina display, but with higher than standard resolution matte display)
2.3 GHz i7, 512 MB GeForce GT650M, 16GB 1600 MHz RAM, 2 TB spinning HDD:
Before today's supplemental update was installed: 3360 Single Core/11510 Multicore.
After today's supplemental update was installed: 3430 Single Core/11527 Multicore.

Mid 2012 13 inch 9,2 MBP (Retina displays didn't exist then for the 13 inch models)
2.5 GHz i5, Intel HD Graphics 4000 w/ 1.5GB shared VRAM, 10GB 1600 MHz RAM, 500 GB spinning HDD.
Before today's supplemental update was installed: 2796 Single Core/5582 Multicore.
After today's supplemental update was installed: 2856 Single Core/5223 Multicore.

So, improvements for 3 out of 4 of the dynamics. The only decrease was for the 13 inch MBP's multicore score, from 5582 to 5223. As always, your mileage may vary.

 

[UL2RA]

Good point!

Backing up with CC

Ok, my goal for this night, Trying to upgrade to High Sierra or Vista for Mac whatever

If something goes wrong can I format my computer and downgrade using my Sierra bootable USB?



Came

Does your Mac use an SSD or an HDD? It's a much bigger PITA if you have an SSD after it's partitioned to APFS. It can take a few wipes of the partition and a few restarts for it to properly go back to HFS+ from APFS.

 

[Skeptical.me]

Apple today released a macOS High Sierra 10.13.2 supplemental update, which comes a little more than a month after the initial release of macOS High Sierra 10.13.2.

macOS High Sierra 10.13.2 is a free update for all customers who have a compatible machine. The update can be downloaded using the Software Update function in the Mac App Store.

macOS High Sierra 10.13.2 addresses the "Spectre" vulnerability that was publicized last week. Spectre, along with its sister vulnerability "Meltdown" are serious hardware-based exploits that take advantage of the speculative execution mechanism of a CPU, allowing hackers to gain access to sensitive information.

While Meltdown was addressed in the initial macOS High Sierra 10.13.2 update, Apple said it would introduce a mitigation for Spectre in macOS and iOS early this week. There is no hardware fix for Spectre, so Apple is addressing the vulnerability using Safari-based software workarounds.

There's also a Safari 11.0.2 update available for macOS Sierra 10.12.6 and OS X El Capitan 10.11.6 that is designed to mitigate the effects of the Spectre vulnerability. Customers running macOS Sierra and OS X El Capitan should download the new version of Safari to make sure their machines are protected.

Article Link: Apple Releases macOS High Sierra 10.13.2 Supplemental Update With Spectre Fix

Is anybody having issue with their Mac after updating? My iMac 27" 5K (late 2015) is really slow (the rainbow wheel of death keeps happening), apps are unresponsive. It was perfectly fine before applying the update. I've restarted the iMac a few time and the issue persists.

 

[camelia]

Does your Mac use an SSD or an HDD? It's a much bigger PITA if you have an SSD after it's partitioned to APFS. It can take a few wipes of the partition and a few restarts for it to properly go back to HFS+ from APFS.

My Mac uses an SSD, but SSD cant wipe as far as I know.. like the spinning disk or HDD Am I right?

Came

 

[UL2RA]

My Mac uses an SSD, but SSD cant wipe as far as I know.. like the spinning disk or HDD Am I right?

Came

No, you can wipe the SSD with a bootable USB of macOS using Disk Utility .. same with an HDD.

But yeah ... it shouldn't be too much of an issue ... but downgrading does require a full wipe of the drive back to HFS.

 

[Skeptical.me]

Lol I'm not getting High Sierra. PoS full of bugs and performance issues.

But this is patch for for spectre that affects intel processors

 

[camelia]

HIgh Sierra or Windows Vista for Mac, here we go..

Wish me luck

Thanks to all that reply to my questions!

Came

Update 1: I will have more questions, I am sure about it

 

[Skeptical.me]

Apple today released a macOS High Sierra 10.13.2 supplemental update, which comes a little more than a month after the initial release of macOS High Sierra 10.13.2.

macOS High Sierra 10.13.2 is a free update for all customers who have a compatible machine. The update can be downloaded using the Software Update function in the Mac App Store.

macOS High Sierra 10.13.2 addresses the "Spectre" vulnerability that was publicized last week. Spectre, along with its sister vulnerability "Meltdown" are serious hardware-based exploits that take advantage of the speculative execution mechanism of a CPU, allowing hackers to gain access to sensitive information.

While Meltdown was addressed in the initial macOS High Sierra 10.13.2 update, Apple said it would introduce a mitigation for Spectre in macOS and iOS early this week. There is no hardware fix for Spectre, so Apple is addressing the vulnerability using Safari-based software workarounds.

There's also a Safari 11.0.2 update available for macOS Sierra 10.12.6 and OS X El Capitan 10.11.6 that is designed to mitigate the effects of the Spectre vulnerability. Customers running macOS Sierra and OS X El Capitan should download the new version of Safari to make sure their machines are protected.

Article Link: Apple Releases macOS High Sierra 10.13.2 Supplemental Update With Spectre Fix

Thanks Apple. my iMac is useless now. Bloody pisses me off.

 

[UL2RA]

Thanks Apple. my iMac is useless now. Bloody pisses me off.

How is it useless?

 

[Skeptical.me]

How is it useless?

After the update, its freezing, the rainbow wheel of death keeps appearing, as I type it takes 30 seconds or more to appear, apps aren't loading but hanging. Its slow as hell. I've restarted the iMac three time, the problem persists.

 

[UL2RA]

After the update, its freezing, the rainbow wheel of death keeps appearing, as I type it takes 30 seconds or more to appear, apps aren't loading but hanging. Its slow as hell. I've restarted the iMac three time, the problem persists.

Download Onyx and run the full maintenance options: https://www.titanium-software.fr/en/onyx.html

Check everything here under the Maintenance tab:

After it runs its course, restart the computer and see how it is.

You may need to add the app to your accessibility options in the Security settings for it to run the full options:

 

[wagonfixin]

Benchmarking the differences between macOS 10.13.2 (17C88) and (17C205) with Geekbench v4.20 made Supplemental's performance look just fine (less than 1% computing performance difference).

Unfortunately, according to Blackmagic's Disk Speed test, my MacPro-2013's PCI-based SSD device has lost more that half of it's write performance under Supplemental (17C205). This is truly unfortunate, as this poor little cylinder was bought to quickly plow thru data. It no longer can write fast enough to keep up with it's workload output.
View attachment 745963
Hopefully Apple will identify/incorporate some of the more recent KAISER type isolation approaches for Meltdown that might help moderate this unacceptable impact to IO performance.

Alternatively, perhaps the implementation of the software mitigations could be migrated to a configurable boot/run/install option, allowing the user to choose performance over security. Currently, these machines are gonna be kept on 17C88 and moved to an isolated network with no internet support.

If performance cannot be recovered for these MacPro Intel chips under macOS, this workflow will likely need to be migrated to any HW/SW platform that can improve the IO throughput.