Slashdot Mirror

That is bullshit. Just, absolute, poppycock. I recently attended Ruxcon - the Australian equivalent of Defcon only without the money - and there was a presentation on MacOS X "security". One of the highlights was when one of the presenters showed a snippet of source code to dsidentity, which is a setuid tool, and it had getenv("USER"). I shit you not. The entire audience cracked up laughing. http://www.drunkenbatman.com/cgi-bin/mt/mt-comment s.cgi?entry_id=684 They also had a short session showing you how to find and exploit buffer overflows in the kernel and user space. It was a real eye-opener. They've got some brain-damaged shit in MacOS X that even the Linux folks had fixed more than a decade ago. Heap smashing, stack smashing, lack of bounds checking, it was all there. The presenter reckoned it was less secure than Windows; he cracks both for a living. Secure? Not by my reckoning.

Wait, according to the link you referred us to, that bug was fixed as of the post date of Oct. 6th, over a month ago:

from the link: We reported this to apple before they removed the dsidentity suid.

Now granted, I'm not an app developer and have no idea why such terms as 'Heap Stashing' and 'Lack of Bounds Checking' have a negative connotation, but I have never seen credible evidence of a perfectly written app or OS with no possibility of exploits. No matter how well written any code is, all it takes is a different set of eyes to see the potential for creating an exploit to get the code to do something it wasn't intended to do.

The key here is that OS X is more secure because of more than just the underlying code. You also have to consider the default settings the OS is installed with and Apple's response to potential security problems.

As far as viruses on OS X and those who make the claim that they will become more prevalent with market growth or Mac would suffer the same attacks as Windows if market share were switched, that claim is completely ridiculous. Here's why:

First, Apple is much more responsive to addressing and fixing reported security holes in their software. Second, there are such things as 'Proof-of-Concept' viruses that never/seldom get released into the wild but are documented and often reported to Antivirus companies and app/os developers. These illustrate that an exploit is possible and easily distributable and and one would think that even if viruses had trouble propagating, at least there would be evidence of these 'Proof-of-Concept' viruses existing. I only personally know of one that was written about 2 years ago and publicly reported that took advantage of a potential exploit in Finder. That exploit was promptly fixed by Apple within a week after the exploit was reported. While other such viruses could and probably do exist, we never hear of them. Hearing of them would at least provided some sort of credibility to otherwise empty claims.

Now, going by prior examples, how long would it take Microsoft to patch a similar exploit in Windows? How long before a similar exploit was fixed in Linux or KDE or Gnome? How effective is the method either use to push updates to users and how easy is it to get and install the updates?

I'll stick with Apple because at least I know they are concerned with and respond promptly to potential security issues. Until I see evidence of at least 'Proof-of-Concept' viruses or other malware existing for OS X, then such potential threats are non-existent.

I have seen people saying that for years, and it's starting to grow extremely stale. Macs are inherently more secure machines. They are not susceptible to viruses. Until proven otherwise, this remains a truism.

That is bullshit. Just, absolute, poppycock. I recently attended Ruxcon - the Australian equivalent of Defcon only without the money - and there was a presentation on MacOS X "security". One of the highlights was when one of the presenters showed a snippet of source code to dsidentity, which is a setuid tool, and it had getenv("USER"). I shit you not. The entire audience cracked up laughing.

http://www.drunkenbatman.com/cgi-bin/mt/mt-comment s.cgi?entry_id=684

They also had a short session showing you how to find and exploit buffer overflows in the kernel and user space. It was a real eye-opener. They've got some brain-damaged shit in MacOS X that even the Linux folks had fixed more than a decade ago. Heap smashing, stack smashing, lack of bounds checking, it was all there. The presenter reckoned it was less secure than Windows; he cracks both for a living.

Secure? Not by my reckoning.

DBM has really hit a new low with this "article". It is almost painful to read through with the gaping holes in logic and diction that would make a SMS junkie teenager blush.

Well, considering you're talking about me... as I'm the author of that "article", mind filling me in on what my past lows were? I'd say that's only fair... You're saying a lot, but you don't seem to be backing it up with much. And we're not going to even go into diction.

I'd really encourage you to read the redux I've put up here, as I'm not sure you really absorbed much of what I was really saying, nor why.

I own the poor blog thats linked in the article... you might be interested in knowing there's a redux article here that should probably clear up a lot of these posts & questions.

DragonflyBSD.

Here is a mirror to the movies & screenshots... HIH

It's a cool project, but the poor guy's server is getting killed. :(

Here is a mirror to the movies & screenshots.

also here... fast connection, should hold up. Enjoy.

Mirror: Waste-source [asiala.info] Please mirror it.

Mirrored here.

This is actually an important development, considering that OS X has a BSD core. MS is developing products that will interface with that operating system. Maybe this could be a step in the direction of developing applications for the OSS community. Mod this down as a troll if you'd like, but despite the heavy anti-MS rhetoric here on slashdot, MS does employ some of the best coders around. Having such a heavy player develop applications for free OS's could only help them become more accepted and mainstream.

MS might be thinking about developing for open-source, but releasing MSN for OSX isn't a hint of things to come. It's a common misperception that OSX=freebsd. OSX is based on Darwin, and Darwin is essentially Mach running a freeBSD layer for filesystem, threading, etc- along with quartz for GUI and carbon and cocoa for API's.

The big hitch is carbon and cocoa- neither API's exist on linux, although there is an open source group trying to make one for x86. The code is built on those API's... so without those API's, you don't have much.

IE, if the mac didn't have a ported xwindows environment, they're not going to be able to run stuff written with xwindows API's. They could run apache... but not the xwindows apps. Linux couldn't run Cocoa or Carbon apps as they don't have the Cocoa and Carbon API's and I doubt they'll see them any time soon.

Michael Bryan Bell

That 20" CRT you just bought isn't 20", it's 19.2" inches of viewable area. A 333 MHZ FSB isn't 333 MHZ, it's 332-point-something mhz, and even then it isn't really 333 MHZ because it's really like 166 mhz and doubled because DDR memory allows you to read and write on the high and low side of the clock.

lmfao. Something that cracks me up is my "mark of the beast" powerbook- it's marketed as 667MHz, but if you check (even from the command line system profile) it's really 666MHz... I could understand it in this instance, but it does make me look at it shiftily whenever it acts up.

drunkenbatman

In the US alone, or, more exactly, in the U.S. only. (well, it happened in Europe. Once.) The problem is NOT Quake, Doom, violent video games, or even Marilyn Manson. Consider this: ONLY in the U.S. are guns so easily available. If there is a problem here, I'd argue that it is NOT John Carmack; the problem here is N.R.A., and the fact that anybody out there can arm himself/herself to its teeth.

The fact that anyone can arm themselves isn't the problem- it's the fact that not everybody is armed. When you heavily regulate who gets to have a gun, all you do is setup a situation where only law enforcement and criminals have a gun. Johnny-crackhead isn't buying his guns at Walmart, and he isn't going through a background check.

Your post assumes that if everyone has a knife, they're going to stab everyone... Gun ownership per capita is much less than the days of future past, when we were much more decentralized and every house had a gun. If you took away every gun right now from everyone, all that would mean is that stabbing deaths would go up 1000%, which points to a societal issue, not an issue of means.

Maybe there is something inherent in the American social makeup that makes us all want to shoot each other as soon as look at them. But if that was true, I'd have to imagine the french would have negative population growth for the past few decades...

drunkenbatman

(C) The other option is to just crack those 128 bit instructions down, just like everything else. But if you're gonna make the chip bigger and uglier to do this, why not just add altivec? The only argument I can think of is that this would get rid of the altivec's extra long pipeline and possibly allow lower clocks/operation for some things.

Apple (and most other people benefitting from altievec aren't exactly using it for 128bit or 64bit instructions most of the time... more as an SIMD engine (simple instruction, multiple data). Altivec doesn't have double precision I don't believe (you can hack around it but its often not worth it) so it often isn't suited for a lot of high-precision instructions... but the dual FPU's of the 970 would be, lord.

In other words, if you have a Photoshop document with 10,000 pixels and wanted to run a fairly simple single precision instruction on all of those pixels (ie, a filter) a G3 would take the same instruction and apply it to each pixel. If you had a G4, and the code was made to use altivec, Altivec could take its 128bit engine, and assuming each pixel was 8bits worth of data could run 16 pixels through the engine at once and output the answer. Obviously in most cases (due to architecture, data needs, etc) it most often isn't going to be 16x faster, or even 2x faster...

So a case could be made that if you can do the above instruction in 30 seconds on a 1GHz G3, and 15 seconds on a 1GHz G4, having a 2GHz G3 would run it just as fast as the G4 but would run EVERYTHING else that altivec can't be used for or isn't appropriate for or people just haven't taken the time to code for twice as fast too.

That's always been the old IBM argument- that adding altivec added complexity to the design helping to keep it from scaling, and they would have rather either used the space for other things (cache, more units, etc) or decreased the die size altogether allowing for cheaper and faster chips.

drunkenbatman

They had a Mac with a DSP built-in back in the day. The Quadra A/V! It blasted the shit out of most any other computer when it came to Photoshop - rivaling modern computers for some tasks.

They actually made two: the Quadra 660AV and the Quadra 840av (there was also a centris line without the fancy stuff). The 660 used a 25MHz 68040, and the 840 used a 40MHz 68040, and had a seperate DSP that you had to write specifically for.

Apple's thought was kinda ahead of the curve at the time, in that they were introducing speech recognition, were going to ditch the modem in favor of the geopod (just a jack, cost about half as much as a modem and you'd do the same stuff in software using the DSP). After it died (ver quickly) there were rumors that they'd be adding a phillips trimedia card later on, but that was dropped as they learned their lesson hopefully from the AV fiasco.

At no tasks could those computers hold their own with any "modern computer". The 840 held its own for awhile, but that was due to the fact that it had the fastest released 040 chip, there wasn't much PPC software for awhile and the fastest powermac (80MHz) released later on emulated 68K code at about the same speed as the 840 ran natively.

But honestly- and I did own one and loved it- they were a bad buy. Since you had to code specifically for the DSP, only a few photoshop filters and one or two 3D programs wrote any code for it... maybe a few things here and there, but nothing really of note. The telephony aspect of it sucked bad and never really worked well, so the DSP just sat there hanging out 99.9999999999% of the time as Apple themselves said they wouldn't be included in future machines a bit later as they weren't needed due to the speed of the PPC when using native code.

Sorry, just at no time did they rival modern computers- they were cool for what they were, and allowed voice recognition and playback at a time when it was unthinkable... but that's about it.

drunkenbatman

I'm intrigued. What do you do that makes a 1.25GHz G4 feel slow? I'm still using a 1.33GHz Athlon and it feels quite fast. I keeps thinking about upgrading the CPU, but really can't see the point. I rarely use more than 20% of it as it is...

One thing to remember about Apple's machines is that while the G4 processor, if the code is really tuned can hold it's own with processors at a much higher clock speed on OSX not very much is very tuned and the overhead associated with running OSX demands a lot more horsepower for the same tasks compared to X86.

Some examples might be compiling- while the compiler in 10.2 made big strides, it's still no speed demon. Apple did move from 2.95 to 3.1 for 10.2, and while that does have better PPC support it's still *cough* really basic, especially compared to how tuned it is for X86. A ton of apps intensive apps either don't support altivec, or don't support dual-processors, or both. Got lots of windows going on a high-res display? QE helps with the compositing, but everything first has to be generated in software in order to be handed off to be composited... on my tibook it's not uncommon to see the windowmanager taking up 30-35%+ of the CPU to do its thing. Have a few apps open and depending on what they've been coded with (cocoa, carbon, etc) and how tuned they are you can easily see CPU cycles just draining away.

iTunes on a 667 G4 machine I have here hovers between 13-35% CPU, on my 733MHz P3 playing an MP3 in winamp is more like 3%... On my 500MHz iBook it hovers between 17-40%... no it doesn't skip, even while I'm doing semi-intensive stuff but the whole machine sure does slow down... even on my G4: with iTunes playing MP3's, something download in the background, and the sorry state of things like dreamweaverX, golive and photoshop I often feel like I'm using a 250MHz machine. It's getting better- Ie, with 10.2 and some updates to some apps I don't type faster than a stupid processor very much anymore but it still happens.

Then there's iCal, iPhoto... these things, while pretty, take more CPU power than you'd think if you're coming in from the x86 world.

The other thing to keep in mind is the gigantic speed-gaps that occur in Apple's product lines due to the processors not scaling up gracefully. IE, Unreal2003 tech demo was just released for OSX. It barely runs on any Apple machine well, you need a top-of-the-line G4 tower with a Geforce Ti (or close) to run it. I swear, why would they want to port any graphics-intensive games when only the multi-thousand dollar machines Apple sells will run them and even at that only the newest breed?

If you have oh, let's say a G4 867 or 1GHz that shipped with a crappier card Apple charges you $400+ to get the OEM Apple card of choice... Apple only sold 500MHz machines for a long time and there are tons and tons of those out there that people bought for $4k+. For iBooks and Powerbooks, Apple basically announced 10.2 and said "oh yeah, and here are new powerbooks and iBooks that will make QE work... sorry about what we just sold you a few weeks/month ago for a few thousand..."

Since they're so expensive and have a decent resale value, it can be easier to just sell it and use the money to get a decent PC plus a bunch of extras. Hell, get one plus a spare. In many cases it's just more cost-effective to get a PC. Not for a lot of what I do per se, but for the things I used to do... I've watched a ton of content professionals leave the mac due to the speed (either of the processor, or the apps they want not being optimized) even as I've watched a bunch of geeks migrate to it...

drunkenbatman

Eh? Aren't there much larger margins on software than HW? After it's been developed, it's like 95% margin.

Apple has a margin of on average 28%-30+% gross margins on hardware... obviously resellers and VARs don't have anywhere near that, but it's what Apple gets. We won't talk about their RAM where it is more like 400%...

Assuming 30% on average, for every $3k tower you buy, Apple makes $900. Buy that tower with a $700-$2.5 Apple display, Apple pockets $1.1k-$1650 on the deal... not even withstanding the $300 extended warranty which covers less and less. Even selling a mid-range iBook will get them ~550 when you add in AppleCare. Plus Apple can count on probably 2 OS upgrades per system it sells over the years on average, or for another $260... not to mention any other Apple peripherals you might pick up.

So basically (obviously not hard numbers, but you get the idea) depending on the system sold, Apple is looking at $700-$2,600 in gross profit. If they sold MacOS X on X86 hardware for $199 they'd need to sell 25 million copies a year to to equal the gross revenue they pull in from selling ~1 million macs or so per year (bit over 5 billion).

Well, sure you say... they're making a lot of revenue but not a lot of profit. So if they only sold 1 million copies of x86 OSX at $199 for $199 million all they're doing is pressing the discs and distributing, so it's all gravy train... except Apple's development, support and other costs have gone up exponentially due to the nature of the x86 world. Thousands of models to support instead of a score, hundreds of thousands of configurations instead of thousands. And it's still gonna have to develop the tasty iApps, all pulled from that $199 a copy.

When you realize Apple can pretty much count on two OSX upgrades at $130 apiece over the life of every mac sold, or $260, the economics of Apple moving to a purely software model aren't very appetizing unless their new-fangled music thing really takes off and brings in a few billion per quarter.

Oh sure it could happen, but not without wiping out the stock and pairing Apple down to a shell of what it once was. The shareholders would end up making more money just selling everything, putting it in a bank and pulling 4% interest.

drunkenbatman

Quite to the contrary, there is ample evidence that Apple shareholders are positively thrilled.

No, there isn't.

I've made a tidy sum in the past month with my modest number of shares, and there are lots of folks out there who hold way more shares than I have.

You made most of that is less than a month- just a few weeks when Apple's price went from $13.8x to $18 due to the music service buzz. Let's compare that to the last few years...

If you just made a tidy sum, you just bought recently... And you are not the Apple shareholders mentioned or are who unhappy. Individual investors (well, 99.999% of them) move penny stocks. They don't move a stock with a market cap of 5.5+ billion. Any existing Apple shareholders mentioned in the article didn't sell 3.5 years ago at $60-$75/share, or buy at $13 and sell recently at $18. We're talking blocks of tens of thousands of shares... funds, institutions. Not you and I on tdwaterhouse or scottrade.

From 1990 to 2000 Apple stock hovered between the teens and the 20's. In late 1999 and 2000 there was a really fun spike and subsequent split. The stock split at around $50 in mid-2000, a 2-1 split... making each share worth ~$25. The stock jumped back to the very low 60's, then plummeted to the low-to-mid-teens in the span of a month or so. Not a big shock, lots of other stocks had the same thing happen... but many have shown actual recovery of their price and sequential growth. Not all have, but then again gateway shareholders aren't exactly happy either.

Since then it's been able to hit the mid-20's for a few months at a time, but always falls down to the low teens again... or hovers at the $15 mark. It stands to reason then that most who have bought have picked it up in the mid-20's or mid-teens (i'd have to go over transactions looking for large blocks, but that's what I'd guess) and over the last 2.5 years that doesn't translate into much growth. If they bought before the split or right after, they're still waiting for any growth.

So, over the last 2.5 years the stock has hovered in the low $20's twice, and in the low teens for the rest of it... usually with it's market cap at ~5.5 billion. Considering Apple generates 5.5x billion in revenue, and has 4.x billion in cash... basically all the analysts who have followed Apple's financials and make the big-stock-fun purchasing decisions have decided that Apples hardware and software business was worthless as it was usually operating at a loss with interest from its horde of cash making up the bulk (or all) of the profit.

So, don't count your chickens before they hatch- The stock price jump so far has been on the hope that the music store could turn into an actual revenue stream for a company which is seeing all of its others shrinking (except in very select areas, such as the iPod but the money made from them is a drop in the bucket). It could keep going up if there is continued exponential growth of the service, or it could drop right back, or hit the mid-20's again and die again as it seems prone to do.

For you and I (yep I made a bundle by buying at $13.x too... but still waiting on my $24 shares to pay off) that might be fine... for some huge mutual fund where Apple has been the under-performer of their fund quarter after quarter, they aren't happy with Apple's performance.

I mean look. If Apple's Mkt Cap is 5.5 billion, and they have 5 billion in cash, if you bought them chances are you could make a billion selling all their plants, contracts, intellectual property, etc and come out of the deal with half a billion in profit. When a company is in that situation they have to do something and lots of people (yes, large shareholders) feel that whatever Apple's been doing has either been ineffective or they just haven't been doing enough.

drunkenbatman

i'm kind of curious about the size of my pipe... ie, i've put up a 30 meg movie of zooming around in OSX's accessibility features for a friend, how many people would have to hit it to really hurt the server? It's at:

OSX_zoom

If you've got a decent connection and don't mind curling/downloading it, it'll give me a better idea of the load it can handle before i start putting up different .mov tutorials for people over the next month.