State of MacOS in light of the root password bug

[hevaKmaI]

True. But you have to have Remote Desktop and root logon enabled, right? How many people have both enabled? I wouldn’t think most, but I could be wrong. But considering your point I should revise my assessment. It was very bad.

No, part of the whole issue was that it enables the root account even when you had it disabled.

 

[neliason]

No, part of the whole issue was that it enables the root account even when you had it disabled.

On, well then yes, that is awful.

 

[simonsi]

So the status is one dangerous exploit discovered that was patched before any known wild exploits occurred. Individual issues will always come to light, you would have to take the number of issues arising over a period to compare it with anything else and in that regard Mac OS comes out very well. Not perfect but very well IMHO.

 

[whooleytoo]

Well it wasn’t a test case. It is now! QA tests are often created in response to a past failure.

Hah, perhaps. But this is an edge case, it would never be part of the QA teams normal test matrix. The odds of this exact bug happening again are very slim, so it makes little sense to add this (and all similar edge cases) as a standard test. It's something that really needs to be caught in code reviews and/or unit tests by the dev team.

 

[macrem]

Finally Tim gets to test the Spaceship’s Eject button. He enters an employee ID and destination, which immediately beams the target either to the most shark infested corner of the bay, or to Redmond, WA if the employee’s transgression was egregious enough.

 

[rayward]

So the status is one dangerous exploit discovered that was patched before any known wild exploits occurred. Individual issues will always come to light, you would have to take the number of issues arising over a period to compare it with anything else and in that regard Mac OS comes out very well. Not perfect but very well IMHO.

This misses the point that Apple's sales pitch - and price point - is based partly on their claim that it's more secure than competitors. So when they leave a back door wide open like this, it's properly news.

If they were selling products that were priced equivalently to their Windows counterparts (i.e. half the price), then they'd have the luxury of claiming that "stuff happens". We pay extra so that stuff like this doesn't happen.