Apple releases MEGA security patch round for OS X, Server and iTunes

They want three years, between upgrades?

I suspect Apple is working towards a three year hardware upgrade cycle, for its users. Knowing how long the hardware lasts, this is disapointing. I'm sure a lot of users must still be on Tiger, on none Intel systems. My 2008 MacBook still runs reasonably well, on Lion (for writing documents, it's fine - I prefer the keyboard to my MacBook Air).

Nice to see more than one OSX version getting patched

It's nice to see Apple didn't release these only for the latest version of the OS. They have had a bad habit of abandoning previous versions and not fixing issues they were released with. This really is refreshing to see. More of this and I could be persuaded to stop keeping one foot in Linux land.

False Sense of Security

Apple is also expected do something about the vulnerability that their Touch ID brings: Biometrics operated with a password in the OR/disjunction way (as in the case of iPhone) offers a lower security than when only the password is used.

Biometrics can theoretically be operated together with passwords in two ways, (1) by AND/conjunction or (2) by OR/disjunction. I would appreciate to hear if someone knows of a biometric product operated by (1). The users of such products must have been notified that, when falsely rejected by the biometric sensor with the devices finally locked, they would have to see the device reset. It is the same with the biometrics operated without passwords altogether.

Biometric products like Apple's Touch ID are generally operated by (2) so that users can unlock the devices by passwords when falsely rejected by the biometric sensors. This means that the overall vulnerability of the product is the sum of the vulnerability of biometrics (x) and that of a password (y). The sum (x + y - xy) is necessarily larger than the vulnerability of a password (y), say, the devices with Touch ID and other biometric sensors are less secure than the devices protected only by a password.

It is very worrying to see so many ICT people being indifferent to the difference between AND/conjunction and OR/disjunction when talking about “using two factors together”.