top | item 46980047

(no title)

tailnode | 19 days ago

Why couldn't Apple patch the zero-day using their new Background Security Improvements pipeline?

https://support.apple.com/en-us/102657

discuss

order

altairprime|18 days ago

They've been delivering empty-noop test updates through that new pipeline in the past couple weeks to beta users, which suggests that they considered it.

jiehong|19 days ago

Their previous security updates feature was mostly unused.

I suppose it’s not really working, or is the product of a team and no other internal team actually use it.

wpm|18 days ago

It's more the former. I'm assuming though that Background Security updates are basically the same thing as "Rapid Security Responses" was, which on the Mac I can recall being used once, 13.3.1(a) released the same day as 13.4 as an RSR.

Basically, the amount of stuff Apple can realistically change on the fly without restiching an entirely new system volume snapshot into place is quite small, so unless the stars align it can't be used.

See: https://khronokernel.com/macos/2023/04/18/RSR.html

jajuuka|19 days ago

I imagine scheduling lined up for the 26.3 release and it wasn't considered dangerous enough. They did this with 26.2 as well including a fix for a zero day. I wonder if they are leveraging that to get people to update sooner. Imagine some people might be turned off of updating with the bugs and visual changes in 26. It's not like 26.2 or 26.3 have any major changes that are enticing.

altairprime|18 days ago

26.4 is likely to have 9 new emoji, as usual for a late-cycle OS release. That may not particularly appeal to the "7bit ASCII for life" subset here, of course, but it's definitely a driver.

saagarjha|18 days ago

dyld is not covered by them.