Some sympathy for the devil: operating systems are just so…big.
Like, there’s an arbitrary code execution issue fixed here in ColorSync. ColorSync! Who thinks to attack the color management system, and then how do you set up your org structure to protect from attacks on that? Because…assuming they have much of a team on it at all, as it’s probably a bit of a solved problem…your core team is probably going to be focused on color, and not buffer overflows.
macOS has a lot of old components now, and just getting a grasp of where you could possibly have security issues must be nigh impossible.
I think you prevent these "corrupt file corrupts important memory" bugs in two ways: 1) use a memory safe language 2) write fuzz tests just like you'd write unit tests.
1 is becoming extremely viable, infrastructure for 2 is starting to be included with modern programming languages and so will soon become the norm.
Which is exactly why we need to use safe languages. People can't even prevent vulnerabilities in the code they are scrutinizing, much less the other 90% they aren't.
(Beating a dead horse, I know, and not blaming the devs because this utility has been around forever, but regardless)
Since you pick on that example, yes I am unsurprised about an exploit in ColorSync. The bugs in ColorSync in combination with Photoshop are legend: for example, there was a "black crush" bug doing the rounds of photo blogs and forums which persisted for months. More recently, it was not possible to disable ColorSync when printing, which made it impossible to calibrate printers (that is, measure the printed result with a spectrophotometer in order to derive new ColorSync tables). And furthermore, I don't think it is actually the first colour profile exploit I've heard of, although I forget whether it was Apple's or someone else's.
However much of a team they have on ColorSync, it needs to be bigger. If they don't have code fixes to make, there's plenty of other things for them to get on with. I didn't think much of the API documentation, and multiple people who seemed credible to me claimed there wasn't enough detail for the kind of implementation Adobe and others need, as several calls have been deprecated. And, since Apple no longer offer their own competing product it would make sense to assist Adobe in getting it reliably right.
More than that, the calibration software for monitors is third party and, at least for the photo monitor I have... could be better. These monitors use onboard hardware LUTs instead of doing it in the GPU, so the software is hardware-specific. Fortunately, there are only a couple of brands who offer these high-end monitors, maybe 3 if you count LG, so there isn't all that much hardware to support. It's another case where the overall experience could be improved for a segment of Apple's customers if they put the effort in. There may even be money to be made.
ColorSync shouldn't have been an "old" component, if Apple had kept their eyes on what their users needed. Instead they went and changed Music again, which has apparently not pleased its users. It's a company whose management seems obsessed with a fairly narrow range of applications like home automation and instant messaging, the kinds of things shown in 1970s TV programs about the "future". If they widened their horizons more they would end up cycling through more of the many components of macOS more often, so things got timely refreshes.
Though the Monterey update fixes 13 CVEs and the Big Sur and
Catalina updates only address 7 and 5 CVEs respectively.
It seems unlikely that Big Sur just isn't vulnerable to so many of the Monterey CVEs and instead this is just Apple prioritizing fixes for the latest macOS version. Officially Apple of course only provides security updates for the latest version.
Big Sur is the latest supported version on some Retina MacBook Pros, so it's not such a bad idea for Apple to still provide updates for critical issues
I finally upgraded to Monterey from Mojave this past weekend. I somehow didn’t get the memo that it was no longer getting security updates until my head security engineer said it last week
I'm 99% sure it's the AMD graphics driver, yes. I did see someone link the "amd-osx.com" website, but it seems unlikely that Apple would be issuing security fixes for that.
This was long requested from the security community, so hopefully they keep it up going forward! This would probably go a long way in terms of rebuilding their developer trust.
Thank you for posting this! Definitely had some concern about the IndexedDB leak, so good to know the new release is out (and has a fix for the issue) so I can update ASAP.
It's easy to stress over the number of things here, but remember: every org probably has a huge list of these, known-and-sitting on the backlog, so if there's this many in the changelog it means that someone actually cares enough to bring them forward vs. yet another UX refresh or something like that.
You're given this warning when you fire up the interpreter (at least in Monterey):
> WARNING: Python 2.7 is not recommended.
This version is included in macOS for compatibility with legacy software.
Future versions of macOS will not include Python 2.7.
Instead, it is recommended that you transition to using 'python3' from within Terminal.
I don't know, I already find Catalina way too buggy for my taste. I expect this to only get worse with later OSs, as it happened time and again in the past several years. I'll hold off on upgrading until it's absolutely unavoidable.
This issue was killing my battery, but I don't use bluetooth on this laptop at all, so going to Settings > Bluetooth and turning it off completely fixed the issue for me. Haven't seen a bluetoothd process in ~2 weeks now.
[+] [-] perardi|4 years ago|reply
Like, there’s an arbitrary code execution issue fixed here in ColorSync. ColorSync! Who thinks to attack the color management system, and then how do you set up your org structure to protect from attacks on that? Because…assuming they have much of a team on it at all, as it’s probably a bit of a solved problem…your core team is probably going to be focused on color, and not buffer overflows.
macOS has a lot of old components now, and just getting a grasp of where you could possibly have security issues must be nigh impossible.
[+] [-] jrockway|4 years ago|reply
1 is becoming extremely viable, infrastructure for 2 is starting to be included with modern programming languages and so will soon become the norm.
[+] [-] brundolf|4 years ago|reply
(Beating a dead horse, I know, and not blaming the devs because this utility has been around forever, but regardless)
[+] [-] SulphurCrested|4 years ago|reply
However much of a team they have on ColorSync, it needs to be bigger. If they don't have code fixes to make, there's plenty of other things for them to get on with. I didn't think much of the API documentation, and multiple people who seemed credible to me claimed there wasn't enough detail for the kind of implementation Adobe and others need, as several calls have been deprecated. And, since Apple no longer offer their own competing product it would make sense to assist Adobe in getting it reliably right.
More than that, the calibration software for monitors is third party and, at least for the photo monitor I have... could be better. These monitors use onboard hardware LUTs instead of doing it in the GPU, so the software is hardware-specific. Fortunately, there are only a couple of brands who offer these high-end monitors, maybe 3 if you count LG, so there isn't all that much hardware to support. It's another case where the overall experience could be improved for a segment of Apple's customers if they put the effort in. There may even be money to be made.
ColorSync shouldn't have been an "old" component, if Apple had kept their eyes on what their users needed. Instead they went and changed Music again, which has apparently not pleased its users. It's a company whose management seems obsessed with a fairly narrow range of applications like home automation and instant messaging, the kinds of things shown in 1970s TV programs about the "future". If they widened their horizons more they would end up cycling through more of the many components of macOS more often, so things got timely refreshes.
[+] [-] the-golden-one|4 years ago|reply
There must be enough security bug fixes out there on GitHub that certain classes of security error become easily detectable.
[+] [-] bumblebritches5|4 years ago|reply
[deleted]
[+] [-] varenc|4 years ago|reply
- Big Sur: https://support.apple.com/en-us/HT213055
- Catalina: https://support.apple.com/en-us/HT213056
Though the Monterey update fixes 13 CVEs and the Big Sur and Catalina updates only address 7 and 5 CVEs respectively.
It seems unlikely that Big Sur just isn't vulnerable to so many of the Monterey CVEs and instead this is just Apple prioritizing fixes for the latest macOS version. Officially Apple of course only provides security updates for the latest version.
Edit: Here's a list of the security issues fixed in the Monterey update that aren't mentioned in the Big Sur update: https://gist.github.com/varenc/7722a0fe198d85a7e49544bcf4066...
[+] [-] gregoriol|4 years ago|reply
[+] [-] yborg|4 years ago|reply
It's like poetry.
[+] [-] bigbizisverywyz|4 years ago|reply
Poetry indeed.
[+] [-] jacobkg|4 years ago|reply
[+] [-] bluedemon|4 years ago|reply
[+] [-] tempodox|4 years ago|reply
[+] [-] drewg123|4 years ago|reply
[+] [-] chipotle_coyote|4 years ago|reply
[+] [-] unknown|4 years ago|reply
[deleted]
[+] [-] clord|4 years ago|reply
[+] [-] kahrl|4 years ago|reply
[+] [-] olliej|4 years ago|reply
[+] [-] vineyardmike|4 years ago|reply
[+] [-] saagarjha|4 years ago|reply
[+] [-] newsclues|4 years ago|reply
[+] [-] akersten|4 years ago|reply
What does this mean? Back in my day that's just what a regular computer program did.
[+] [-] mattl|4 years ago|reply
[+] [-] nyc640|4 years ago|reply
[+] [-] aetherspawn|4 years ago|reply
[+] [-] jonas21|4 years ago|reply
[deleted]
[+] [-] teewuane|4 years ago|reply
[+] [-] CSSer|4 years ago|reply
> WARNING: Python 2.7 is not recommended. This version is included in macOS for compatibility with legacy software. Future versions of macOS will not include Python 2.7. Instead, it is recommended that you transition to using 'python3' from within Terminal.
[+] [-] blitzar|4 years ago|reply
[+] [-] tempodox|4 years ago|reply
[+] [-] smasher164|4 years ago|reply
[+] [-] smarx007|4 years ago|reply
[+] [-] gnatman|4 years ago|reply
[+] [-] landonxjames|4 years ago|reply
[+] [-] crumbits|4 years ago|reply
[+] [-] cudder|4 years ago|reply
[+] [-] kosolam|4 years ago|reply
[+] [-] Canada|4 years ago|reply
[+] [-] samtheprogram|4 years ago|reply
Apple security updates: https://support.apple.com/en-us/HT201222
[+] [-] zozbot234|4 years ago|reply
[+] [-] jtsiskin|4 years ago|reply
[+] [-] vineyardmike|4 years ago|reply
[+] [-] teewuane|4 years ago|reply
[+] [-] hit8run|4 years ago|reply
[+] [-] crumbits|4 years ago|reply