Hacker News Reader

Hacker News

Comment by drdrey | Hacker News Reader

Full thread

drdrey

I must say I am pleasantly surprised by the straightforward, no BS language

View on HN

Except they forgot to tell us about older versions of macOS which probably 75%[1] of Apple users still use.

[1] http://gs.statcounter.com/macos-version-market-share/desktop...

Hopefully Sierra and El Capitan will get patched soon.

This statement doesn’t make it clear, but they have been patched (same fixes as High Sierra)

How were we meant to figure this out, through necromancy or something. There is no information indicating Sierra has been patched or is due to be patched.

On https://support.apple.com/en-us/HT208331 there is a reference to CVE-2017-5754 with a footnote saying "Entry added January 4, 2018" (interesting to see this "changelog" being revised as the embargo has been lifted). It says the fix is "Available for: macOS High Sierra 10.13.1, macOS Sierra 10.12.6, OS X El Capitan 10.11.6"

They edited the same page to remove those references. Best to assume Sierra and El Capitan are not patched until proven otherwise.

Clear as mud.

Security Updates were released for 10.6 and 10.5 (2017-002 and 2017-005 respectively).

Where do you see updates for 10.6 and 10.5? According to https://support.apple.com/en-us/HT208331 - there was a 2017-002 for 10.12 and a 2017-005 for 10.11.

Yes, I did mean 10.12.6 and 10.11.6.

The patch for Meltdown (CVE-2017-5754) for High Sierra, Sierra and El Capitan was contained in these security updates from December 6: https://support.apple.com/en-us/HT208331

I am as well - this is something I can link to people who do not understand microarchitectures, so they can understand what these bugs are.

> In the coming days we plan to release mitigations in Safari to help defend against Spectre.

If Apple was able to patch macOS in the ~6 month window since the issue was discovered why were they unable to patch Safari?

Same question for Chrome and Firefox. Surely Google knew about it and hopefully they contacted Mozilla. It seems like the scope of the fixes for Chrome and Firefox are the same.

Does it really take six months to do dev & QA for a fix like this? Wasn't the plan to disclose this to the public in January anyways?

It was better. I'm confused how the title says Intel and ARM but the first paragraph says all processors.

> It was better. I'm confused how the title says Intel and ARM but the first paragraph says all processors.

These are the processors found in Apple products.

Yesterday, there were comments [edit: on HN] about the Intel PR announcement that were critical of the fact that Intel name-dropped AMD in what was thought to be an attempt to deflect the issue from the Intel brand.

Reply on news.ycombinator.com