5 ms·

The fact the post was shared on Google Plus speaks volumes.

by ryangripp 12y ago

efraim 12y ago
Would you like to expand on that comment? What does it mean when a post is shared on Google plus?
- fleitz 12y ago
  I think he means it contains a pro-google / anti-apple sentiment. So getting back to shellshock on OSX... Is there a patch available? yes. Does it download via a GUI? no. Is it about the same level of effort to patch a OSX box as a GNU/Linux box? yes. Does the post go wildly offtopic to address issues (iCloud) that are likely wetware hacks? yes. Does it recommend carte blanche to not use apple products because their OS is fully patched? yes.
  - sophacles 12y ago
    Um... the effort I had to take to patch my linux boxes was: Do nothing. (security fixes had been released and installed before I learned of the bug). The effort I'll have to take to patch my Mac is: * Download a new bash. * recompile it * install it by hand. (and this is assuming I already have xcode/developer tools installed). Not quite the same level of effort. Is the article wildy off topic? Not really - its an article about yet another instance of Apple ignoring security issues, why wouldn't a previous example be relevant?
    - fleitz 12y ago
      What is the software vulnerability used for the iCloud hack?
      - sophacles 12y ago
        Is your position that a software vulnerability the only type of security issue? Is your position that ignoring software vulnerabilities is fundamentally a different thing than ignoring other types of security issue? I'm confused by why you are asking.
        deleted 12y ago
        [deleted]
  - bashinator 12y ago
    About the same level of effort? Linux: apt-get install bash OS X: Install xcode, install xcodetools (CLI), download bash source code from a mostly-undocumented URL (need to search through apple support forums), download and manually apply patch from GNU. Build bash, manually copy build output into /bin. Yeah, totally the same level of effort.
    - k-mcgrady 12y ago
      You can install the Xcode CL tools without installing Xcode. The two were separated a couple years ago.
    - fleitz 12y ago
      Did you mean to say 'brew upgrade bash'?
      - sophacles 12y ago
        That doesn't change the version of bash pointed at by /bin/sh which is a hardlink to the OSX supplied bash. Even if you previously relinked /bin/sh to a homebrew bash, it won't change versions by upgrading the installed bash.
        bashinator 12y ago
        I suppose if you're being brave, you can nuke the built-in bash and symlink it back to brew's copy.
RobotCaleb 12y ago
Which volumes are those?
- stock_toaster 12y ago
  Wiesmann's "Treatise on Tinfoil hats", volume one through three.

The fact the post was shared on Google Plus speaks volumes.

efraim 12y ago

Would you like to expand on that comment? What does it mean when a post is shared on Google plus?

fleitz 12y ago
I think he means it contains a pro-google / anti-apple sentiment. So getting back to shellshock on OSX... Is there a patch available? yes. Does it download via a GUI? no. Is it about the same level of effort to patch a OSX box as a GNU/Linux box? yes. Does the post go wildly offtopic to address issues (iCloud) that are likely wetware hacks? yes. Does it recommend carte blanche to not use apple products because their OS is fully patched? yes.
- sophacles 12y ago
  Um... the effort I had to take to patch my linux boxes was: Do nothing. (security fixes had been released and installed before I learned of the bug). The effort I'll have to take to patch my Mac is: * Download a new bash. * recompile it * install it by hand. (and this is assuming I already have xcode/developer tools installed). Not quite the same level of effort. Is the article wildy off topic? Not really - its an article about yet another instance of Apple ignoring security issues, why wouldn't a previous example be relevant?
  - fleitz 12y ago
    What is the software vulnerability used for the iCloud hack?
    - sophacles 12y ago
      Is your position that a software vulnerability the only type of security issue? Is your position that ignoring software vulnerabilities is fundamentally a different thing than ignoring other types of security issue? I'm confused by why you are asking.
      - deleted 12y ago
        [deleted]
- bashinator 12y ago
  About the same level of effort? Linux: apt-get install bash OS X: Install xcode, install xcodetools (CLI), download bash source code from a mostly-undocumented URL (need to search through apple support forums), download and manually apply patch from GNU. Build bash, manually copy build output into /bin. Yeah, totally the same level of effort.
  - k-mcgrady 12y ago
    You can install the Xcode CL tools without installing Xcode. The two were separated a couple years ago.
  - fleitz 12y ago
    Did you mean to say 'brew upgrade bash'?
    - sophacles 12y ago
      That doesn't change the version of bash pointed at by /bin/sh which is a hardlink to the OSX supplied bash. Even if you previously relinked /bin/sh to a homebrew bash, it won't change versions by upgrading the installed bash.
      - bashinator 12y ago
        I suppose if you're being brave, you can nuke the built-in bash and symlink it back to brew's copy.

RobotCaleb 12y ago

Which volumes are those?

stock_toaster 12y ago
Wiesmann's "Treatise on Tinfoil hats", volume one through three.