Hacker News Reader

Comment by Canada | Hacker News Reader

I wonder how many of those bugs will be fixed in previous versions.

Apple normally continues issuing security updates (but not necessarily fixing other bugs) for around 2 years after a new version of macOS has been released, though I don't believe they've ever formally specified that in writing. Monterey was released on October 25, 2021, so Big Sur should keep getting security updates until October 2023 or so. More than one version back is generally considered unsupported, I believe.

I see a Big Sur update dated December 13, so it's definitely still being supported. While I haven't done an exhaustive check, it looks like it patches many of the same security holes.

https://support.apple.com/en-us/HT212979

This is what Apple wants you to believe. In reality, Apple routinely skips security patches on older versions: https://www.vice.com/en/article/93bw8y/google-caught-hackers...

The only way to be safe on Apple's computers (and phones) is to update to the latest version the day it comes out.

You can jailbreak and get user patches too.

>The only way to be safe on Apple's computers (and phones) is to update to the latest version the day it comes out.

That has not been the case with 14 and 15, its a heuristic but unknown backdoors are a constant threat. Realistically we should state that they are never, ever safe.

Err... that article explicitly says that the hole was in fact patched on Catalina, and it even has a link to the notice.

https://support.apple.com/en-us/HT212825

It was patched on Catalina months after being patched on Big Sur, and after being exploited by the CCP against dissidents in Hong Kong (therefore it was a zero-day).

Errr....

CVE-2021-30869 was patched in Big Sur on September 23, 2021

https://support.apple.com/en-us/HT212147

and was patched in Catalina on...September 23, 2021

https://support.apple.com/en-us/HT212825

The article says that the Chinese team said it was on Big Sur, and that the Google team then discovered it was also on Catalina. It doesn't say that Apple didn't patch it on Catalina, or that they patched it "months later".

I would recommend against using vice.com as any kind of authoritative source. On anything.

Looks like you're correct in this instance, thanks! But my general point is still true: Apple routinely skips patches on older versions. I'm aware of a fair bit of proprietary evidence for this.

This page shows the latest updates:

https://support.apple.com/en-us/HT201222

Big Sur and Catalina got corresponding updates today too.

I wonder how many bugs they are aware and decide not to report.

You can DIY http://dosdude1.com/mojave/

Reply on news.ycombinator.com