> There's no way to tell for sure if something like this is intentional or not.
> There's no way to tell for sure if something like this is intentional or not. Right, so the simplest explanation is that it's an unintentional bug. The absence of evidence that it was unintentional isn't evidence that it was intentional. If there were some magic string or default password or something, that'd be an obvious backdoor, but to me this looks like a pretty typical privesc bug, albeit in an undocumented api. It was found through a chain of events that started with looking at the patch related to another privilege escalation vulnerability, one which no one seems to be claiming was a backdoor. > Also, waiting to fix it until a researcher makes it public may have been intentional. I'm guessing it's more likely the the researcher waiting to go public until it was fixed. This is evidenced both by the fact that it was patched alongside other vulns (ie. not a rushed out one-off patch) and from the article's disclosure timeline, which shows 'Full disclosure' occurring 04/09, while the 'Release of OS X 10.10.3' occurred 04/08. This is a pretty typical disclosure timeline; they couldn't begin to fix it until it was tracked as a bug, after all.
Posted by jjarmoc on Apr 9, 2015, 7:37 PM
Tags
Related issues
- The biggest problem with having an LLM do this, from what I've observed of at least frontier models, is that the way they are trained...
- The biggest problem with MOND is that it was hand-crafted with additional parameters simply to fit the data.
- (My comment is about detached houses).
- The biggest problem with this is that I can't run my company's own internal benchmarks against this API, because they will be trained int...
- > steer Claude away from over-engineering parts of the system in response to hypothetical concerns.
- Why is there no comparison with FLUX 3 Image?
Raise real-world problems, find people facing the same issue, and discuss solutions.7,000 issues0 comments
hackernews (Other)
The biggest problem with having an LLM do this, from what I've observed of at least frontier models, is that the way they are trained...
The biggest problem with MOND is that it was hand-crafted with additional parameters simply to fit the data.
(My comment is about detached houses).
The biggest problem with this is that I can't run my company's own internal benchmarks against this API, because they will be trained int...
> steer Claude away from over-engineering parts of the system in response to hypothetical concerns.
Why is there no comparison with FLUX 3 Image?
> our Git monorepo was developing an annoying problem Sentences like this are so common from people using monorepos that I am convinced ...
Why is there no contact form?
> There's no way to tell for sure if something like this is intentional or not.
> There's no way to tell for sure if something like this is intentional or not. Right, so the simplest explanation is that it's an unintentional bug. The absence of evidence that it was unintentional isn't evidence that it was intentional. If there were some magic string or default password or something, that'd be an obvious backdoor, but to me this looks like a pretty typical privesc bug, albeit in an undocumented api. It was found through a chain of events that started with looking at the patch related to another privilege escalation vulnerability, one which no one seems to be claiming was a backdoor. > Also, waiting to fix it until a researcher makes it public may have been intentional. I'm guessing it's more likely the the researcher waiting to go public until it was fixed. This is evidenced both by the fact that it was patched alongside other vulns (ie. not a rushed out one-off patch) and from the article's disclosure timeline, which shows 'Full disclosure' occurring 04/09, while the 'Release of OS X 10.10.3' occurred 04/08. This is a pretty typical disclosure timeline; they couldn't begin to fix it until it was tracked as a bug, after all.
Comments (0)
No comments yet. Start the discussion.