Beware of Geeks bearing software updates! If you're using Mac OS X 10.2.6, by now you may have already noticed Security Update 2003-06-09 popping up in Software Update. And it may have looked pretty innocuous, patching a "potential security issue when the Apple Filing Protocol (AFP) is used to reshare a Network File System (NFS) mount" and addressing "a situation where LDAP bind authentication requests may be improperly sent when using Kerberos authentication." And as you read that, if you're anything like the average Mac user, you probably heard this: "blah blah blah, blah blah, blah blah blah Cinnabon blah." So maybe you went ahead and installed it, figuring that, hey, when has Apple ever steered you wrong?

There's just one problem: according to MacFixIt, after installing the update, a slew of people suddenly found that their login passwords no longer worked-- for any account. If you think about it, this makes perfect sense; what better way to make a system more secure than to prevent everyone from logging in? As far as we can tell, though, this is apparently a pretty minor glitch; anecdotal evidence in Apple's support forums suggests that if you have your Mac set to auto-login to any account on boot, you won't notice the issue unless you actually log out. And if you do use the Login Window, it works just fine provided you have it set to "Name and password." You only get hit with the bug if you've got Login Window set to "List of users."

"But AtAT," you cry, "if I switch my Login Window to 'Name and password' instead of 'List of users,' I won't get to see my super-cool user icon!" "Why, what's your icon?" we ask. "It's a tasteful nude rendition of Lois of 'Hi and Lois' fame," you reply. "Sweet," we add.

Well, as it turns out, even if your Login Window is displaying the "List of users," valid passwords are only rejected if you click the "Login" button. After typing your password, press Return or Enter instead and you're in business. Given the circumstances in which the bug appears, we're actually kind of surprised that anyone noticed it at all; we figured that nobody's actually clicked a "Login" button instead of just pressing Return since maybe 1936.

Still, this must be something of an embarrassment for Apple, who's had some fairly ugly press following poorly-tested software updates in the past. (Specifically, we're thinking of that other Security Update that effectively nuked Classic on certain PowerBooks, and the iTunes installer that on occasion would blithely chew through gigabytes of user data without so much as a "pardon me boy.") Mostly we're just relieved that this login bug is so minor and easily worked around-- although, you know, had this Security Update instead caused some users' heads to burst into green flame, that probably would have been a little more dramatic. Hey, you can't win 'em all.