Slashdot Mirror
Apple Releases Security Update 2003-03-24
skeeter17 writes "Apple updates security again. According the description: 'Security Update 2002-03-24 addresses a Samba vulnerability which could allow unauthorized remote access to the host system. .... OpenSSL is also updated to address an issue in which RSA private keys can be compromised when communicating over LANs, Internet2/Abilene, and interprocess communication on local machine. ... It is recommended that all users install this Security Update.' Well! There you have it folks!" It is available via Software Update.
ALERT: There is still known vulnerabilities with the Cha Cha Cha, the Cabbage Patch, and especially the Boogaloo. You've been warned.
I think it is quite admirable that Apple is so dedicated to these security updates. Certainly there is one other operating system software company in the world that isn't as vigilant. *cough*
I know at work, whenever an exploitation was discovered on the PC, the IT department would wait and wait. After several weeks, when problems started happening, they would issue an advisory, telling the people workarounds and what not to do and such until an update happened.
They never did that for the marketing/communications Macs. The reasons are threefold:
a.) there are fewer exploits in Mac OS X's old age (read: UNIX/FreeBSD/Darwin),
b.) when there are holes, they are patched, almost always very, very promptly.
c.) they were afraid of the Macs, anyway.
I think the latter is the least substantial, but, nonetheless, still relevant.
Anyway. I wanted to make a note of this. I don't see how there's much else that we can regularlly pony up in Software Update discussions...
justen
Microsoft file sharing is the most secure in the world. In fact, you don't even need to use a firewall with Windows.
That's right - all you need to do is leave your box hooked up to the network with no firewall, and in less than 5 minutes, one of a large number of dedicated volunteers will scan your system for any security flaws. If any are found, this tireless worker will log into your box, and install any necessary patches for you.
Don't worry if the disk thrashes from time to time, or if there is a lot of network activity, these are just symptoms of the high level of careful service you are receiving from your unknown friend.
To ensure the best service, be sure to tip him, by putting your credit card number, zip code, expiration date, SSN, and a suggested tip amount in a file called c:\tip.txt. A little gesture like this can go a long way!
Since OS X 10.2.4 came out, I think this is only the second security update. However, for XP there have been countless updates. The Service Pack One update from a few months back was 120MB! They must've had quite a bit of holes to need a upgrade that big.
It seems that almost every week, my IT deartment is running around trying to install security updates on our computers. It's a good thing I only use my PC for e-mail (not for long, since MS Exchange will soon work with Entourage). I use my Mac for real work.
Mr. Bond, they have a saying in Chicago: Once is happenstance. Twice is coincidence. The third time is enemy action.
And let's not forget that these security updates are due to exploits and holes in the software of the OSS community at large (sendmail, samba, openssl, openssh), not due to Apple's own bungling or inattention to security.
because that has already been fixed and is in the 10.2.5 update which will be released within a few weeks.
This patch is for SAMBA...which is a Windows file sharing protocal. Go figure.
I know the parent is a troll. Last one I feed today, I promise.
Huh. Seems in Software Update, it's titled 2003-3-24, but in the description, it's *2002*-3-24.
Weren't they a year off last time, too?
I'm confused! Anyone know what OpenSSL bugs are patched, specifically, by each security update?
Can't you see that everyone is buying station wagons?
Not to rag too much on apple, but they're still slower to release fixes than open source. Both fink and my gentoo linux box are usually patched the same week (and often the same day) that I hear about the problem.
Gentoo is getting a reputation for releasing fixes before slashdot announces, as the smug 1337 gentoo users like to point out.
Does that make me one of them now, too?
I'm not meaning to say that apple is doing a poor job, by any means. I'm just wanting to point out that apple is not the only organization that takes security seriously, and that there are others that beat apple out the door with security fixes.
You say
There went my two weeks of uptime... ;-)
"Common Sense Ain't" -Unknown
Put an other way, you're right, but your confusing Apple's software with the code. Most of the services on OSX are open source and to say that "they are slower to release fixes than open source" rather misses the forest for the trees. (Or vice versa) What Apple does is provide a quick, easy update for regular users who don't want to deal with the complexities of compiling their open source programs. As such Apple reacts very timely and does a lot of checking.
So to differentiate Apple's security and open source's security is a false dichotomy.