Apple Releases macOS Ventura 13.4.1 With Security Fixes

I still don't understand why they're not using the "Rapid Security Responses" option for these types of updates.

Are they urgent?

* Yes: then use the "Rapid Security Responses".
* No: Wait for another time and add these things on the 13.5, deploying a single update (which will be probably relieve within 2 weeks).

Apparently patches for kernel issues can't be done via RSR, which is why today it is a full OS update.

I still don't understand why they're not using the "Rapid Security Responses" option for these types of updates.

Are they urgent?

* Yes: then use the "Rapid Security Responses".
* No: Wait for another time and add these things on the 13.5, deploying a single update (which will be probably relieve within 2 weeks).

I still don't understand why they're not using the "Rapid Security Responses" option for these types of updates.

Apparently patches for kernel issues can't be done via RSR, which is why today it is a full OS update.

Yep.

This update fixes a vulnerability in the kernel itself ('https://support.apple.com/en-us/HT213813').

Rapid Security Responses rely on what Apple calls Cryptexes, which are basically small volumes that contain newer versions of files, replacing old versions on your main system disk. That approach avoids modifying, then once again cryptographically sealing the system disk; instead, it remains as is (already sealed), and the Cryptex (which is much smaller) is sealed separately.

However, while the bootloader could be loading and applying Cryptexes before the kernel runs, this isn't how it's implemented as of macOS Ventura 13.4. Instead, the bootloader runs the kernel, and the kernel then loads Cryptexes. Therefore, this process won't work for patches to the kernel itself.

https://eclecticlight.co/2023/04/05/how-cryptexes-are-changing-macos-ventura/

In practice, the contents of the current standard Cryptexes aren’t loaded until towards the end of the kernel’s early boot phase

As a result, this update is instead "non-rapid". This means the entire system disk gets replaced by a full new, cryptographically sealed one.

All deices updated and here - all is well 😊


It goes usually faster to update my intel MBA, then to update my Mac Studio.
But once Studio is up and running, no complains.

My MacBook Pro M1 was quick. The studio was like 15-20 minutes, don't remember an update being so slow on the Studio. But ya seems to be running a tad bit quicker, 😁.

I wonder if it was pulled or just a slow roll-out?

I've always found it slower to appear on M-series Macs, whereas updates will appear a good 20-30 minutes earlier on Intel machines.

I'm already running Sonoma. It's not actually that buggy.

*That buggy* lol