>Bad news: Dell is posting unsigned update executables to their website labeled “critical” which then fail to install due to the good news
If I were a hacker with no access to the signing keys, I'd probably label my updates as critical too, so you would try to find a way around the update signing.
So basically you're targeting a tiny fraction of power users who are capable and motivated to find and exploit a vulnerability on their own machine which bypasses update signing.
I think you'll find more bang for your malicious buck elsewhere.
So wouldn't this logic also apply to updates that are signed with an invalid signature? And at that point, it sounds like you're saying that once something is signed and distributed, no one will ever try to compromise that and you're free and clear for the rest of time, which seems...dubious.
I'll probably be tarred and feathered for this opinion, but "everything works out of the box" Mac feels like wishful thinking
Every time Apple pushes an update that causes some bizarre issue, people talk about it at length
On the one hand, software is written by humans. Humans make mistakes
On the other hand, Apple by design supports such a tiny set of hardware (that they largely build themselves and tightly couple to their software) that it's strange they're unable to iron out the issues in test before pushing the updates and ending making the tech news cycle when something goes wrong
I can't help but wonder if this requirement if secrecy for a big bang marketing event that is called wwdc is to blame as well. At least the different teams working in the same product should have access to the complete product, right?
I don’t really share your experience, but otoh I rarely have problems with MacOS. Although to be fair, I also do my best to wait the better part of a year before updating. So I’m always ~1 year behind, but then I also avoid a lot of the teething problems.
I don't use a Mac so I can't exactly cite specific issues I've had. But I've definitely seen a lot of them posted and reported on HN, ArsTechnica, Reddit and other places
Due to how small Apple's hardware list is, issues directly impact a much larger percentage of their userbase
Another was Finder copy to SMB wouldn't error but file would be corrupted (copying from any other computer to the same SMB no problem. Copying by rsync from the same mac, no problem, just finder)
My Airpods often don't connect. Solution, reboot Mac (after trying several other things)
Network starts failing. Solution, reboot (after trying several other things)
I can catalog many many more. I also have a Windows 10 (now 11) machine. It's had no more (nor less) problems.
What kind of router are you using? I had a bunch of network issue when I turned on RSTP on my network for some reason. They’re all fixed since I turned that off and ICMP snooping (I have Ubiquiti equipment). Can’t say much about your SMB issue, we have a mount drive at work and been solid since I’ve been here.
I've tried gnome-firmware (same backend) on literally every linux system I've ever owned and have never seen an available update for any of my hardware.
The Berkeley Software Distribution (BSD) part of the kernel provides the Portable Operating System Interface (POSIX) application programming interface (API, BSD system calls), the Unix process model atop Mach tasks, basic security policies, user and group ids, permissions, the network protocol stack (protocols), the virtual file system code (including a file system independent journaling layer), several local file systems such as Hierarchical File System (HFS, HFS Plus (HFS+)) and Apple File System (APFS), the Network File System (NFS) client and server, cryptographic framework, UNIX System V inter-process communication (IPC), audit subsystem, mandatory access control, and some of the locking primitives.[7] The BSD code present in XNU has been most recently synchronised with that from the FreeBSD kernel. Although much of it has been significantly modified, code sharing still occurs between Apple and the FreeBSD Project as of 2009.[8]
> Darwin - which consists of the XNU kernel, IOkit (a driver model), and POSIX compatibility via a BSD compatibility layer - makes up part of macOS (as well as iOS, tvOS, and others) includes a few subsystems (such as the VFS, process model, and network implementation) from (older versions of) FreeBSD, but is mostly an independent implementation.
> This firmware update has been periodically failing since I got this laptop from work several weeks ago, and only today did I put in the effort to track down where it was hiding the logs with the real reason
If they haven't pulled the "corrupt" firmware after it's been up and broken for weeks, I don't think anyone needs to rescind the "incompetent" label.
I paid Dell a bunch of money for a laptop. They pushed a bios update, that ubuntu kindly relayed to me that meant when I closed the lid and put the laptop in my bag as I sat beside my daughter's ICU bed, it fried the motherboard. No really. That was the /purpose/ of the bios "upgrade." Warranty after they remotely fried my machine? No, because it worked as designed.
So yeah going bayesian given none of us can be 100% sure about anything, my prior on Dell is they suck donkeys' gonads on all levels. Competence, honesty, service, everything - until evidence shows otherwise and I've just told you why.
Why is your prior that Dell are competent even when evidence suggests otherwise?
Can you give more information about what the stated purpose of the upgrade was? Surely they didn't actually tell you they wanted to brick your laptop remotely?
"Dell is posting unsigned update executables" is a loaded statement that implies this was intentional. Dell has been signing updates since before most infosec engineers were in middle school ogling cheerleaders. It's alarmist and highly unlikely this was intentional.
That still wouldn’t excuse that someone clearly didn’t verify their work. No matter what the reason, ownership of this task was released before it should have been.
You're right.
A headline of "Dell's website is serving up unsigned updates" would be correct. But to garner more clicks and hype that's not how they've worded their tweet, instead it's worded to make it sound like Dell are doing this on purpose.
https://hacks.mozilla.org/2019/05/technical-details-on-the-r...
reply