n-1 and n-2: Should we really trust in you?

The talk examines Apple's practice of patching the current and two previous macOS releases and asks whether an older version is really as safe as the newest one. Apple rarely publishes which versions each fix reaches, so the speaker had to infer coverage from public advisories and from the researchers who reported the bugs.

Using data from every macOS security advisory since Big Sur shipped, the speaker counted 468 patched vulnerabilities and sorted them by which supported releases received each fix. Many were patched everywhere, but a notable group reached only some versions, and a few appeared in the oldest supported release without the middle one. Of 15 bugs Apple flagged as possibly exploited in the wild, several were fixed only for Big Sur. A WebKit flaw used by the Pegasus spyware was patched for Big Sur and Catalina but remained open on Mojave, a gap an outside researcher confirmed. Earlier examples such as the High Sierra root login bug and the Go to Fail SSL flaw showed that new releases can also ship serious mistakes. iOS patch coverage was compared as well.

The main takeaway is that the newest macOS is generally the safest, since it receives the most fixes and the most important ones. Users who must stay on an older release should avoid using it as their primary or internet-facing machine, and consider keeping it offline for legacy apps. The speaker promised a white paper with fuller details.