Why _blank_ Gets You Root
Comments on “Why _blank_ Gets You Root”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
Patrick Wardle's reverse-engineering of the November 2017 macOS High Sierra "root with a blank password" flaw (CVE-2017-13872) traces it to opendirectoryd's PlistFile module. For a disabled account like root, the code calls od_verify_crypt_password but checks only its return value, not the "match" variable holding the verification result. It then saves the attacker's password for the account. Apple's patch adds that check, though the author reports it broke file sharing and was undone by upgrading to 10.13.1. Several details were not independently verified.
Why it ranked
No. 6 of 93 with a score of 0.69. The panel rated it highest on technical depth (0.95) and new information (0.94), lowest on audience breadth (0.59). The judges disagreed most on reader interest (spread 0.57), so the story is marked contested.
Every answer behind this is in the table under Score.
Score
0.69total under rubric v2.2Contestedjudges differ by 0.57 on reader interest
- Significance0.69
- Reader interest0.72
- Audience breadth0.59
- Practical relevance0.65
- Substantiated0.89
- Technical depth0.95
- New information0.94
- Counts against: Promotional0.04
- Counts against: Overclaim0.15
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| Significance | 0.62 | 0.60 | 0.86 | 0.69 | 0.26 | +0.24 | +0.166 |
| Reader interest | 0.39 | 0.80 | 0.96 | 0.72 | 0.57 , above the contested threshold | +0.26 | +0.186 |
| Audience breadth | 0.45 | 0.60 | 0.72 | 0.59 | 0.27 | +0.13 | +0.077 |
| Practical relevance | 0.55 | 0.55 | 0.86 | 0.65 | 0.31 | +0.22 | +0.144 |
| Substantiated | 0.87 | 0.85 | 0.94 | 0.89 | 0.09 | +0.05 | +0.044 |
| Technical depth | 0.99 | 0.90 | 0.96 | 0.95 | 0.09 | +0.05 | +0.048 |
| New information | 0.94 | 0.90 | 0.98 | 0.94 | 0.08 | +0.05 | +0.047 |
| Promotional | 0.05 | 0.05 | 0.03 | 0.04 | 0.02 | −0.19 | −0.008 |
| Overclaim | 0.26 | 0.10 | 0.08 | 0.15 | 0.18 | −0.11 | −0.016 |
| Sum of contributions | +0.688 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.688 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-10-25/6/"><img src="https://rubric.hrih.si/badge/2026-10-25/6.svg" alt="Ranked #6 on Rubric, 25 Oct 2026" width="238" height="28"></a>Claim check
Claim check: 2 matches source · 1 no source given · 5 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Matches sourceDate
The macOS High Sierra flaw was first posted to Apple's Developer Forums, in a thread helping a user with account access issues.
The cited source says the same thing.
The article says “this vulnerability was first posted, rather innocuously, to Apple's very own Developer Forums”
The source says “Note: This solution might be specific to High Sierra Try this: Solution 1: On startup, click on "Other" Enter username: root and leave the password empty”
Source cited by the article: forums.developer.apple.com/thread/79235
Couldn’t checkCausal conclusion
The flaw gained wider public attention when Lemi Orhan Ergin tweeted about a huge security issue in macOS High Sierra.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “the flaw only gained wider public attention, when Lemi Orhan Ergin (@lemiorhan) posted a tweet stating that, "we noticed a *HUGE* security issue at MacOS High Sierra”
The source says No passage could be compared.
Source cited by the article: twitter.com/lemiorhan/status/935578694541770752
No source givenCausal conclusion
The bug exists because the code in opendirectoryd's PlistFile module checks only the return value of od_verify_crypt_password and not the 'match' variable holding the verification result, so it upgrades the account with the attacker-supplied password.
The article gives no link or citation for it.
The article says “We determined that Apple forgot to check the value of an essential variable that held the result of an account verification”
The source says No source to compare with.
Couldn’t checkNumber
The value 0x1388 (5000 decimal) corresponds to 'kODErrorCredentialsInvalid'.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “Looking up 0x1388 (5000 decimal) on osstatus.com, reveals this value corresponds to 'kODErrorCredentialsInvalid”
The source says No passage could be compared.
Source cited by the article: osstatus.com
Couldn’t checkDate
Apple released a patch for both macOS 10.13 and 10.13.1 shortly after the blog post was published.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “Shortly after posting this blog, Apple released a patch for both macOS 10.13 and 10.13.1”
The source says No passage could be compared.
Source cited by the article: support.apple.com/downloads/macos
Matches sourceQuote
The bug was assigned CVE-2017-13872, and Apple's release notes describe it as a logic error in the validation of credentials that the patch fixed with improved credential validation.
The cited source says the same thing.
The article says “a logic error [that] existed in the validation of credentials." Their patch, they note, "improved credential validation”
The source says “Description: A logic error existed in the validation of credentials. This was addressed with improved credential validation”
Source cited by the article: support.apple.com/en-us/HT208315
Couldn’t checkNumber
Apple's first patch broke file sharing for various users, which was fixed by a new patch bringing the build to 17C1003.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “it broke file sharing for various users”
The source says No passage could be compared.
Source cited by the article: 9to5mac.com/2017/11/29/how-to-fix-macos-file-share
Couldn’t checkCausal conclusion
Per Wired, if a user on macOS 10.13 applied the patch and then upgraded to macOS 10.13.1, the bug was reintroduced.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “if a user on macOS 10.13 applied the patch, then later upgraded to macOS 10.13.1, the bug would be reintroduced”
The source says No passage could be compared.
Source cited by the article: wired.com/story/macos-update-undoes-apple-root-bug-patch
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN —
Recorded for context only, checked 25 Oct 2026, 05:46 UTC. It played no part in the ranking.