Why would you update to the new OS ?
Got a tip for us?
Let us know
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
PSA: Make Sure to Update, iOS 16.6.1 and macOS 13.5.2 Address Actively Exploited Vulnerability
- Thread starter MacRumors
- Start date
- Sort by reaction score
It seems like nearly every update lately has been patching an actively exploited vulnerability.
But that wasn't the question. There's no reason to install Ventura for Ventura's sake, so the question is whether or not the vuln exists in Monterey.
RSRs patch things like WebKit, that don’t touch the kernel/SSV. While it hasn’t happened yet, theoretically we could eventually see a particular RSR that didn’t even require a restart.It's unclear when Apple decides to issue Rapid Security Response (RSR) updates.
You can read more here:
About Rapid Security Responses for iOS, iPadOS, and macOS - Apple Support (CA)
Rapid Security Responses deliver important security improvements between software updates.support.apple.com
And the list of releases here:
Apple security releases - Apple Support (CA)
This document lists security updates and Rapid Security Responses for Apple software.
The last RSR update was mid-July. Sounds this exploit fix in today's update should have been issued as an RSR, too.
Edit: Howard Oakley, over at Eclecticlight, ventured the guess that, going forward, only Sonoma will get RSRs, as Ventura goes into maintenance mode.
Last edited:
My elderly parents' 2013 iMac stopped getting updates - one thing I did was stop using Safari and making Chrome the default browser, since Chrome continues to get updates. No idea if that helps for this particular security issue. I also removed Administrator privileges from their accounts - they have to log in as another account to do Administrator things.
Eventually, a few months ago M2 mac mini went on sale for $499 on Amazon (I believe it is now) and I replaced their old iMac to stop worrying.
All these problems go away once side loading is enabled....
Because lots of bugs gets worked out during the first few point releases. That applies not just to the OS, but also to the apps that have been updated to run on it. Thus many of us don't like to update until at least X.3 or X.4. in addition, some people rely on software that's not able to run at all on the new OS on day 1.
Apple patches “clickless” 0-day image processing vulnerability in iOS, macOS
“BLASTPASS” bug can install malware without user interaction.
arstechnica.com
Figured I'd post this here. Doesn't give a lot more information but it's something.
If this was reported 16 days ago (mentioned in this thread earlier) - must have been pretty severe for them to update it this quickly, wow.
Here's a posting by Citizen Lab:
citizenlab.ca
According to this they reported the exploit sometime last week. This was an extremely fast turnaround time by Apple, which shows how seriously they took it.
The attack vector used by NSO were iMessages with a malicious Wallet pass. Lockdown mode blocks the attack.
BLASTPASS: NSO Group iPhone Zero-Click, Zero-Day Exploit Captured in the Wild - The Citizen Lab
Citizen Lab found an actively exploited zero-click vulnerability being used to deliver NSO Group’s Pegasus mercenary spyware while checking the device of an individual employed by a Washington DC-based civil society organization with international offices. We refer to the exploit chain as...
citizenlab.ca
According to this they reported the exploit sometime last week. This was an extremely fast turnaround time by Apple, which shows how seriously they took it.
The attack vector used by NSO were iMessages with a malicious Wallet pass. Lockdown mode blocks the attack.
No this is the one that craters battery life. Sorry slow and buggy 16.6.4
I used to get 2-3 years out of a computer. And had to pay for OS and software upgrades.
Don't blame Windows for Dell and/or Lenovo bloatware. Those are the things that take forever to update, not Windows.
If your house is on fire you don’t wait 2 weeks to call 911
What happens with old versions of the OS that people may still be running? Are they vulnerable to all these sort of things? Does Apple just leave people stranded if they are using an old product? Not even providing basic security updates to an old OS.
A few have asked that already about this exploit. I checked Citizen Lab's website, and it doesn't seem an answer is available. It's possible that it does affect earlier OS's, and it's also possible updates to the two earlier OS's that still get security patches (Big Sur and Monterey) will follow. We don't know.
All we know is what Apple's security update policies are, since Apple has announced these itself. Here they are for MacOS:
1) Current OS: Gets maximum attention. This is the only OS that gets RSR's (Rapid Security Responses; see https://support.apple.com/en-us/102657 )
2) Last two OS's: Also get security patches, but these may not be as thorough as those for the current OS.
3) Earlier OS's: No security patches.
Personally, I'm OK with this. I've sometimes deliberately kept Macs on old OS's for various reasons, but I practice careful browsing and email hygiene, and I'm not a journalist who's pissed off a repressive regime. While it's no guarantee, none of the anti-malware programs I run (Malware Bytes, FireEye) has ever detected an intrusion.
Last edited:
No, it doesn’t read like that at all. These exploits are always highly specific, but the language used in the security overview pages is general. See the link to the citizen lab page above for more information (although not much is shared yet).
Software is hard and parts of the codebase are old. These are new exploits each time.
What is it about these seemingly minor security updates that causes the update to be several hundred MB to a GB or more and take 20-30 mins to install? They must be patching more than just the library that has the vulnerability, no?
I wish they’d confirm if this is already patched on the latest 17.0 beta‘s or not...
I can’t find clarification on that anywhere…
I can’t find clarification on that anywhere…
Anyone? Is there any way to test for the presence of the vulnerability at least?
They got their Late 2013 iMac shortly after it was released, to replace a Windows XP Dell that was no longer getting updates to windows XP
.Their late 2013 iMac was slow as hell until I tore it apart and replaced HDD with SSD - I was surprised what a dramatic improvement that made, and it added years to its useful life. They were running the iMac almost 10 years - and would have happily kept doing so, if I didn't recommend m2 mac mini for them as a replacement. Zero chance a PC from 10 years ago would still have been around and usable.
Desktop PCs are surprisingly useful unlike their laptop counterparts. Currently running an old quad core HP prebuilt from 2009 or so as a HTPC with SSD/16gb RAM upgrade and is still supported by security updates to 2025 without any need for OCLP/patchers. It’s fast enough for basic tasks (youtube, streaming, browsing, etc) thanks to GPU-acceleration.
Someone could ask why would you comment with such a question when you could wait 2 weeks.