An RCE in GNU's telnetd has no relationship to the sunsetting of telnet. Something could equally likely happen with SSH (but not really because the OpenBSD folks are paranoid by nature).

Apple removing the telnet client from OS X was a stupid move. How can you call yourself UNIX and not have a telnet client? It's like removing grep or ed.

Thats what the mystery exceptions for the Open Group macOS UNIX certification was for!

Henry Winkler (the Fonz) went on to become a big-name Hollywood producer—he executive produced the original MacGyver—so he was probably one of the easiest to contact.

This totally won't be abused in some way by the drama-free open source community.

Have they shared the lists of developers they want prophylactically blackballed from the community yet?

What does that even mean? NTFS file access permissions (35 years old at this point) are far more powerful than 1970s-era Unix permissions model.

It's referring to the fact that Terminal doesn't have free access to all your files and folders, despite what the traditional file access perms say.

Windows has this too, but it's off by default. I forgot what it's called, that's how often it gets used.

He’s talking about sandboxing and permissions prompts

Are we still pushing the myth that anti-malware on Mac isn't necessary?

I support quite a few Mac users and never recommend it myself. Also own a couple Mac’s and don’t use it.

I do occasionally use an app to clean somebody’s Mac of an irritating browser search hijack. I’ve never seen anything else.

Why should I change my mind?

How does antivirus software protect users who paste malicious commands they find online into the terminal?

By scanning downloaded binaries for known viruses?

A text command pasted into the terminal isn't a binary.

Convincing a Linux user to paste rm -rf / into the terminal is not malware. It's social engineering.

Scanning binaries for known malware is already built into the OS.

Endpoint security software on the Mac, if it's worth the hit to system resources that is, inspect every call to exec and fork that occur in the kernel and also inspect those for known attack vectors, malicious scripts, etc. The one I have installed on my work Mac will kill reverse shell attempts before they are run. Will stop keychain attacks. Infostealing (as they can also get every file system op as they are happening in the kernel).

Gatekeeper and Xprotect are good, but there's only so much they can do.

Which do you use/recommend?

Antivirus programs will run on PowerShell scripts, VBScript files, JScript files, and all other kinds of automation on Windows.

The screenshots from the article clearly show a permission prompt for a program. Whether that's a binary or a shell script or something else doesn't matter, the infection stage should've been caught by anti malware rather than permission prompts.

Windows Defender does this already. If Apple's AV can't catch this, I think they may be relying on their DRM-as-a-security-measure (signatures, notarisation, etc.) a bit too much.

> Scanning binaries for known malware is already built into the OS.

Clearly it isn't. XProtect is a joke. It's 2004-era ClamAV level of protection.

The article specifically mentions that the methodology here is to trick users into running an obfuscated CLI command…that downloads and runs a binary

Terminal commands have the ability to do dangerous things, like deleting all the user's files.

In this case, the user is warned that the command wants to do something dangerous and must manually allow or deny the action.

XProtect (Apple's built-in antimalware) is usually all you need, as long as you're at least somewhat savvy (and sometimes even if you aren't). I believe installing any additional antimalware on a Mac is a waste of resources.

No, that narrative died around 2010. The existence of malware targeting Macs has driven many macOS security improvements since, many of which are taken personally by HN readers.

It is necessary. That’s why Apple ships a free invisible one bundled into the OS that you never have to think about, see, or update.

a docs entry point - https://support.apple.com/en-mide/guide/security/sec469d47bd...

As of today you don't need to install one on Windows also. Both OS have inbuilt s/w for this purpose.

No, we're using the built-in mac anti-malware app

What anti-malware would have stopped this, exactly?

It seems most anti-malware is the equivalent of the TSA - security theatre that wastes your time and attention, catching plenty of water bottles but not the real stuff.

How are they not on every blacklist by now?

Oh no next you're going to tell me they're coming after the gas station dick pills.

We already have trad-gas.

It's called ethanol-free and people gladly pay a premium for it.

It's far better for your engine, it's what the car manufacturers use to determine the gas mileage, and Californians can only dream of having it.

Ethanol free fuel in an engine designed for ethanol blend can result in incomplete combustion, leaving deposits in fuel injectors and valves. The car companies don’t care about this for the purposes of determining gas mileage.

Californians I think still remember the smog of the 90s in LA that kicked us to make our air pollution standards the highest in the nation. Going away from that I think sounds more like a nightmare than a dream for most Californians.

Sorry but this is complete horseshit. Ethanol is corrosive to engine and fuel system components. It is also hygroscopic and will suck water in which is bad news for your fuel system. The less the better. There is a reason modern cars will tolerate up to 15%. With modern DI engines you are getting buildup no matter what and it is completely unrelated to the presence of ethanol in the fuel. Ask any BMW owner and the fuckin' spa treatments they need to take their engines to.

Flex-fuel vehicles run on E85 are required to run a tank of regular gas every few months per the manufacturer. Which is literally the opposite of what you are suggesting.

I grew up in Brazil, where we had a very successful program for cars running on ethanol fuel with a little gasoline added. It was common to have certain models of car be offered as gasoline or ethanol (back then engines needed to be tuned for one) powered.

At least one car magazine would buy retail cars and fully disassemble them for analysis a year later. The difference between a gas and an ethanol engine was quite shocking - the ethanol engine was always clean and displayed less wear than the gas version of the same engine. Part measurement indicated no significant difference in wear between the engines. There were models only offered with ethanol engines because they offered a little more power because of higher compression rate.

Most of the ethanol stuff about cars isn’t really true anymore.

The place where ethanol sucks is yard equipment where gas sits and pulls in water.

>Ethanol is corrosive to engine and fuel system components.

Caca del toro.

Who needs imaginary horseshit when you can be spreading bull?

The Ethanol on my home planet consists of Ethyl Alcohol. In the chemical, beverage, and fuel world, pure Ethanol is a non-corrosive flammable solvent. More caution is always recommended to those who are least familiar with its properties.

>It is also hygroscopic and will suck water in which is bad news for your fuel system.

Sorry to deliver even worse news, Ethanol is not nearly as hygroscopic as you have been hoping for. A hygroscopic chemicals go, it hardly even qualifies. I can assure you that the water causing your fuel system such anguish did not come out of thin air because of fuel grade alcohol. Not any faster than it would if your fuel were plain conventional hydrocarbons under the same weathering conditions.

As someone who remembers the smog that we used to have here in Southern California, I don't mind leaving the trad-gas in my dreams if I can keep the massively improved air quality in my reality.

This is a myth. While tailpipe emissions are lower, evaporative emissions are higher. At best it's a draw.

You're seeing less smog because people are driving modern cars with modern emission systems because we live in the future, smog-producing vehicles have been taken out of service, and drawing conclusions based on mere correlation of the two. It has nothing to do with ethanol.

>evaporative emissions are higher.

Well, if you put the gasoline in an open bucket there are some blends that have a fraction which would evaporate faster because of the alcohol content.

This was some of the low-hanging fruit that was addressed when ventilated fuel tanks were deprecated, even while leaded gas had not been replaced. You should have seen the amounts of liquid butane that used to be blended before evaporative emissions were regulated.

The problem was, tailpipe emissions only come out when the engine is running, but evaporative emissions from vented fuel tanks were constant 24/7.

With the arrival of non-ventilated fuel systems decades ago, it's actually a draw between plain hydrocarbons and alcohol-enhanced gasoline when it comes to evaporative emissions of the vehicle itself.

>because people are driving modern cars with modern emission systems

Exactly why Ethanol is not the problem that people think when they let rumors or superstition prevail. It's mainly during the time your gas cap is off, when your fuel system is not "sealed" and you are fueling up where the slight differential in evaporative losses would show up if there was careful measurement. You can sometimes even notice more vapors escaping while you are in the process.

Put your gas cap on properly and the remainder of 24/7 there will be no difference in evaporative emissions (VOCs) between conventional hydrocarbons and alcohol-enhanced, until you open the gas cap again to refuel. It does add up but the overall difference is so small when you do the math that's why it would be almost a complete draw.

>because we live in the future

After all, it's all we've got left :)

One thing that can help make the future more futuristic is when physical reality can be better recognized over myths and misconceptions.

Sounds like someone who’s been fed a line and has believed it.

A) why do you think car companies started to need to develop more modern emission systems to begin with? That’s right - California, a huge car market, started creating and enforcing standards through the introduction of CARB. Prior to this car companies had no incentives and weren’t doing this

B) there’s more to smog than just cars. CARB tackled emissions across multiple industries.

C) average cars last too long. The reason cars modernized was because CARB made owning and operating older vehicles impractical/impossible.

D) population and vehicle miles driven kept growing so per unit emissions need to shrink faster than that growth and it did. Thanks to CARB.

Is ethanol the primary reason we don’t have smog now? No, but the problem was so bad that CARB took a comprehensive approach at tackling the problem on many angles. And importantly they succeeded. It’s quite a silly position to take that “this problem would have solved itself”. It’s the twin to the fatalism position of “this problem is too big and complicated to solve”

That’s different. My newish snowblower has to meet California standards to avoid smog in Los Angeles. It’s super sensitive to any gas issues and basically needs a carb cleaning annually.

My previous machine ran for about twenty years with normal ethanol mix.

Putting it in almost any car made this century is just wasting money.

I've seen this account dupe-post twice on a story that was flagged, then later vouched.

Which is a telling bug for a bot to have.

People—especially the squares in this business—tend to mistake his unfamiliar blue-collar New Yorker manner of speech at face value and don't bother to look deeper.

Or they look deeper and note that the folksy bragging about pretty basic and irrelevant misunderstandings continues into the minutes of meetings his base that laps that stuff up doesn't bother paying attention to, where there isn't any strategic value to dissembling or being mildly irritating to the apolitical CEOs he's supposed to be giving bland assurances to, and conclude the emperor actually doesn't have any clothes. There are, of course, smart and well connected people that want someone whose extraordinary talent is being the centre of attention occupying the centre of attention.