>We are withholding CVE-2019-8641 until its deadline because the fix in the advisory did not resolve the vulnerability
Wonder how this happened? rushed patch or perhaps they only tested against a submitted PoC? Only a week left until the defcon talk. Still listed as "fixed" in Apple's release here:
https://support.apple.com/en-us/HT210346
Sometimes it’s basically that the person in charge of fixing it didn’t. A year ago one of the fixes for a widespread remote execution flaw was to see if the user agent was curl.
Other security updates released on the same day last week caused Macs to kernel panic every time they went to sleep [0]. Apple software quality is not what it should be, and hasn't been for quite some time.
> Apple software quality is not what it should be, and hasn't been for quite some time.
Quality is a moving target: I know something about the quality of Safari, and the quality has been getting better over the years (that said, I admit the recent Mobile Safari Betas have been really shit, hopefully the release will be good).
Maybe it is comparitive: for example Safari's quality it is nowhere near as good as the Chrome team's quality (which is unbelievably good: regular updates across thousands of different Android device types, across thousands of versions of Android, with immensely complex software).
Also social media now means that we hear about quality issues - we raise the bar on what we think is acceptable.
Do you think Apple's software quality has not improved over the years?
> Do you think Apple's software quality has not improved over the years?
I think quality has actively declined.
As you know something of the quality of Safari, I'll limit myself to that. Safari over the past several years has made myriad design changes that I heavily disagree with (killing extensions, removing user control over website data, baffling UI decisions), but even though those changes have made my browsing experience worse they may not be objectively considered "software quality." Instead, I'll focus on stability and bugs.
When macOS Sierra launched, I had to deal with weekly lockups and reboots of the OS that I mentioned here: https://news.ycombinator.com/item?id=13159008. I tracked the issue down to Safari 10, which introduced new resource leaks that eventually brought the entire system down after being left open. Even after major releases of the browser eventually stopped forcing restarts, leaving Safari open for extended lengths of time will still cause not just instability and misbehavior in itself (e.g., popover arrows eventually disappearing), but also knock-on problems in completely separate applications, including greyed-out standard menu actions that return immediately once Safari is quit. This resource exhaustion is independent of the number of tabs, but handling of large numbers of tabs has also regressed: tabs now crash or unload regularly, and there is no easy built-in way to see which; this causes data loss and erroneous cookie manipulation when the tabs are reloaded when navigating back to them. Pages often do not add correctly to History, particularly from clicked or OpenSearch search results, with mismatched titles/URLs or entirely missing entries: to this day, searching Wikipedia with Quick Website Search gives a tab title that does not match the page or the history item, and interaction with the back/forward cache is likely to exacerbate this. Worse, pages often disappear entirely from autocompletion, causing mistaken page loads and spurious searches when expected results are missing. A couple of years ago, Safari stopped preventing the Mac from sleeping while a download was in progress, forcing me to copy URLs into Terminal to download with a caffeinated curl command instead to avoid truncated files. A recent release of Safari marked random unvisited links as visited, likely due to some newly introduced hash collision, and was not fixed for many months.
This is just what I can recall off the top of my head, in one limited aspect of a single application. All of these were newly introduced errors; some major, many persistent. I sometimes have call to use older versions of Safari, and while definitely slower and less compliant, in many respects they are remarkably better in terms of feature stability and experience.
> Apple software quality is not what it should be, and hasn't been for quite some time.
It has never been. Been using Apple devices since Tiger if not Panther, their software has always had more teething issues than their hardware, and 10 years back you didn't buy hardware rev1 unless you got every device. Major OS updates usually took a few point release to get solid, and some were just terrible to and through (Lion stands to mind, lots of shiny new stuff, lots of shitty new stuff).
Wonder how this happened? rushed patch or perhaps they only tested against a submitted PoC? Only a week left until the defcon talk. Still listed as "fixed" in Apple's release here: https://support.apple.com/en-us/HT210346