Slashdot Mirror
Apple to Fix Security Holes in Jaguar
Simon Cozens writes "Yesterday's unsubstantiated report that Apple is refusing to supply security upgrades to Jaguar turns out to be untrue; Apple told MacCentral they will be fixing the bugs turned up by @stake. Next conspiracy, please!"
I didn't see this comming at all! Who would have thought they would be supporting their own products.
This page was generated by a Barrel of Circus Midgets, and that is the way I like it!!!
Of course Apple is going to fix them, they still support the 10.2 Server, so they have to...
Damn Windows zealota making shit up...
e to the pi i plus one equals zero
Definitely Apple deserves more credit and unlike other companies, the benefit of the doubt until official statements are made.
Apple would have been 100% insane if they were to leave people out in the cold, who bought their operating system just a week ago!!
Conspiracy! And slashdotters believed it? Un-be-lievable!
Yeah well... well... ok I was proved wrong that time... but what about the security problems in System 7 huh huh huh Apple? I don't see THAT coming up as frontpage slashdot news do I?! Where's our fixes? I DEMAND A NEW SYSTEM ENABLER!
:P
it's a joke people
However, the story makes reference to Jaguar specifically, but what about OS X releases before that?
Panther, Apple's latest operating system, was not affected by the security issues outlined by @Stake -- the flaws only affect Mac OS X 10.2.8 and lower.
This PROVES it! Apple has NO INTENTION of fixing these egregious bugs in Panther! How is Apple ever going to be taken seriously in [echo]THE ENTERPRISE[/echo] when all they care about are legacy customers?!?!?!?!
now have no footing to stand on. At least not if their argument was "Apple does it and is praised, if M$ does it they get hammered, whats up?" Anyway, I'm glad to see corporate reliability and responsibility in the industry
And if that were the case, we'd still be waiting on Windows 95 to this day....
Now the real question is whether they told @stake they weren't going to fix them and changed their mind after the because of all the talk about it. It is as wrong to assume they were always going to fix it as it is to assume they weren;t going to fix it. I would tend to believe they told @stake that, and then when word got out and everyone screamed, they changed their minds right quick.
"Information wants to be expensive" - Stewart Brand, the same guy who said "Information wants to be free"
n/t
Geminatron
Duh. Who thought that Apple was forcing upgrades? Idiots! Even if Apple was going to come up with some sort of conspiracy to "force" people to upgrade, they wouldn't use security. This is one of the most important features of the OS--this goes way beyond upgrade money.
They will entice us with OSX.4 being "snappier than ever"!
---gralem
Apple rolled several security updates into that thing called 10.2.8, which has caused many people no end to troubles, especially those with older hardware.
:P)
Yes, I have a beige G3. Yes, I've put a much faster ZIF processor in it. It's a small OS X Server. 10.2.8 screwed up all *kinds* of things.
Can Apple please release the security updates individually so we can apply them as needed instead of bundling them into a dot-whatever release?
That's all I ask, Apple. I'll buy a shiny new G4 (or G5) when I can actually afford it. (No, they're not too expensive, I'm just flat broke.
Get over here.
Now. (smack) Mac (smack) OS (smack) X (smack) supports (smack) multibutton (smack) mice (smack) right (smack) out (smack) of (smack) the (smack) box!
(smack) (smack) (smack) (smack) (smack)
Now pound sand before I officially sanction a hit. Jobs is a made man, and you shall not direspect his product. Capisca?
--- Ban humanity.
At least ZDNet continues their excellent track record of fair, unbiased reporting with regards to apple.
You wouldn't use it
Documentation to back it up (personal experience counts) /.. Flame away all you want, but the folks here want the facts to back it up.
That's the way it works on
Did Microsoft merge with them as well?
Aw, geez, here comes another Offtopic Troll mod. :-\
--- Ban humanity.
Hello. I would like to discuss a neat little command line utility included in Mac OS X that doesn't get enough attention in my humble opinion. Living in /usr/bin/, this simple Open Source tool is something that I just can not live without. What is this wondrous textual utility that I'm talking about? It's none other than machine!
Included since 1991 with the 4.4BSD platform, machine gives you the processor name that your system is based on. I don't know if it works for Intel or any other architectures since when I opened up the binary in TextEdit.app and couldn't find any processor name strings. Here's an incomplete list of machine output that I do know of to help illustrate what I mean:
What I think is the funnest part of machine is bringing up its manual page. I wonder who was clever enough to invent this little pun, but it makes me LOL every time I do it. Sometimes I do it just to laugh, even if I don't want to learn about machine at the moment. In case you can't guess, here is the command to bring up the manual:
omfg LOL!!11! I have been accessing this program since OpenStep 4.2, then in Rhapsody DR2 and continue to use it today under Mac OS X v10.3. Kudos to NeXT and now Apple for including this Wunderwerkzeug for almost 10 years. It sure makes my Power Mac a joy to use. Check it out!
Oh, the one I must have downloaded in my sleep, that allows my MS (I know) wireless mouse to 'Just Work' (tm) with Jagwah, now Panther
Check out your facts next time.
And, they installed perfectly, with no troubles. Although I did think it odd that I had to reboot a couple of times. I always thought that was just a Microsoft thing. Can't complain though; Mac OS/X boots FAST. I'd say about a minute, maybe less. So you don't really notice it that much...
Farewell! It's been a fine buncha years!
Anyone who types in the command in the above post deserves what they get
Heh! It really has - take a look as long as it's still 31Oct otherwise avert those eyes...
--
Reverse outsourcing: it's the future
would they have done it as quickly without @stake first finding these bugs then putting bugtraq and media pressure on apple?
TODO: 753) write sig.
What are you talking about? It was never a question about Microsoft. They have always supported their products. They are still supporting NT which is 8 years old.
Clearly it was feasible, so why wasn't it quick?
AC comments get piped to
i still don't even have a g3 to run mac os x on
I don't want to be forced to upgrade to an Apple ][gs...
Actually, your statement to "bug your upgrade company" may not really be fair either.
Relatively small vendors such as Sonnet have plenty of work to do, just figuring out ways to cram faster G3 and G4 processors into all the older makes and models of Macs. Not only that, but they've already provided all the software tools needed to make them perform 100% in MacOS 9.x. In a few cases, they've sold optional utilities to make them work with OS X 10.2.x -- but ensuring support of the latest Apple OS's was never really anyhing they are "required" to do.
I bought a 550Mhz G3 upgrade card for an old PowerMac 7300 a while ago. Really sped it up and works just as advertised. Will it run Panther? No. Will it ever? Maybe, but who cares. I built this thing for one reason only.... to have a box that runs MacOS 9.1 efficiently - so I can remain compatible with any older software I might wish to run.
Might this have to do with the shares that Mr. Gates happens to own in Apple?
I doubt they told @stake they weren't going to fix them. I doubt they told @stake they were going to fix them. In fact, I doubt they even told @stake that the flaws didn't affect Panther... @stake probably found that out and told Apple.
Apple doesn't talk details in unreleased products.
There's a couple reasons we're seeing this press release:
Ethical reporting of security flaws involves going to the company and giving them time to get a patch out. Then, one or both companies announces the flaw... and includes details of the patch. @stake jumped the gun and did not use white hat practices.
ZDNet decided that @stake's announcement meant Apple wasn't going to fix the problem, and decided to give it a spin. As they actually indicated in their story, they did not wait for a comment from Apple before rushing the thing to press.
Hopefully, @stake will do better next time. But I doubt their role in this will be examined very carefully.
I know ZDNet will do the same thing next time. They smell any blood around Apple, they're the first to paint a picture of mass destruction, mayhem and cats and dogs sleeping together.
If @stake hadn't jumped the gun, we'd have seen a press release some time next week on Apple's site about the security flaws, with a fix, and with credit to @stake for finding them. How do I know this? Because it's what they've done every other time, including with 10.1 after 10.2 was released!
...walking-to-the-store-and-buying-a-two-button-mo use-and-plugging-the-fucker-in.app
If you run this software there is a small fee - usually about $10.
What about folks who refused to swallow the $129 to go from 10.1 to 10.2? Will they continue to get security fixes?
(Personally I'm disgusted that 10.1.x users will never get Java 1.4.x)
Namaste
So it's more apple's responsibility to support 3rd party upgrade cards, than the card manufacturer itself? I don't get it.
Does this really look like a troll?
Before I'm excommunicated for failing to deliver a joke with the subtlety of a nailbat-wielding goon, would it change any minds to know that I actually use a 3-button mouse on my PowerBook? Anybody?
Obliteracy: Words with explosions
Well did they say they would support 10.1? 10.0? Did they, huh? huh? The real conspiracy is that they're trying to force upgrades to 10.1! Aha!
from the do-not-jump-to-the-island-of-conclusions dept.
Wow, and here I was starting to think I was the only person in the world who read "The Phantom Tollbooth".
End of lesson. You may press the button.
Here's another example. Whoever metamoderates the parent Offtopic, make sure you metamoderate it as Unfair. The topic being discussed (by the grandparent, which was moderated Insightful) was moderation.
Lets stop posting worthless or erroneous stories
duh
According to this advisory at @stake, they have at least once withheld release of a vulnerability until affected systems could be patched. This paragraph kinda sums it up:
Due to the severity of this vulnerability @stake has confirmed that they will not be releasing this information publicly on their research page (http://www.atstake.com/research/) until Nokia has confirmed that all affected operators have fully patched and tested all affected elements. However @stake would ideally like to release this information no later than 1st June 2003.
So it does seem a little childish to just jump out and announce a vulnerability to the world.... My guess (yeah, it's just the little scenario I've worked up in my mind) is that @stake wanted to "work with Apple" and release a joint press-release type scenario on squashing a vulnerability. Apple of course doesn't want to give credit to anyone for anything (not trolling, just stating an observation), and refuses the offer. @stake gets pissed and blares this up and down the board, issuing press releases, contacting specific non-Apple-loving reporters, etc. You know why I think this? From the same advisory linked above is this self-serving text:
@stake worked with Nokia to ensure that all affected operators where informed and upgraded and only after this time did @stake agree to release this information to the public.
Do you really think that Nokia let @stake get into their code, make security changes, and essentially be a full partner in the effort to crush this vulnerability? I don't.
Dammit, I thought that original post seemed wrong and didn't warrant a response, but why can't Apple just come out and say that *ALL* OS 10 versions will be fixed, instead getting specific with Panther, Jaguar, 10.2.8.whatever.
The initial security advisories did include a "vendor response" section. Across the board that said "upgrade to 10.3", without any mention of a forthcoming patch for earlier releases.
That's the only thing that had Bugtraq up in arms: the lack of assurance that earlier versions would see a patch. And most of the people worried about that were worried because they want Apple to suceed as a Unix vendor, not because they want to see it crash and burn. (I don't know about the Slashdot comments, because I only read more than the highest rated couple of comments when I've got moderator points, but I'd guess that at least some of them were along the same lines.)
I don't know if it was merely a typographical oversight, or if Apple really didn't have any plans to release patches for earlier releases. In the first case they should have been more clear initially (and now they will), in the latter case they were making a huge mistake. I'm inclined to believe it's the former.
This is not the first time that Apple's security PR has been less than impeccable. They've rebounded pretty well each time, and I haven't seen them make the same mistake twice.
It's only reasonable to expect them to get harshly criticized, especially with Mac OS X: they're jumping from a very soft, easy-going market (desktop publishing and education) into an insanely security-conscious market (Unix enterprise servers). They're actually doing quite well, but there are still more entrance pains to come. The security community is, to an extent, xenophobic, and certainly disinclined to believe that a vendor with a relatively small amount of experience in the market can be relied upon to do the right thing. So Apple has to prove themselves a bit. So far, they're doing pretty well. It doesn't matter if you make mistakes like this, as long as you admit to them, patch things up, and then don't keep making them (hey Microsoft, you listening here?).
And Apple really is doing a good job: I've seriously considered bringing Mac OS X (and the related hardware) in as a replacement for aging Sun hardware running Solaris. Sun seems to be falling apart, and (especially with the G5) Apple seems to be a reasonable replacement in the mid-range compute + high I/O line of work without the vendor/service problems you get from Linux (which isn't so hot on the I/O front, since it's hampered by the IA32 architecture's crappy I/O design... other architectures don't matter, because Red Hat doesn't support them commercially).
Do you have a
According to David Goldsmith of @Stake, "In my initial conversations with them [Apple], they said they weren't going to fix 10.2, but I wouldn't be surprised if they change that."
In other words, this isn't just some sort of overblown speculation run amok. Apple did initially tell security experts they didn't plan to patch Jaguar. That was a stupid plan, and even the security experts didn't expect that to last, but that doesn't change the fact that someone from Apple did claim Jaguar wouldn't be patched.
What I find amusing is the fact that Apple zealots are using this story and its development as further evidence in the conspiracy against Apple, when even the much-hated (and deservedly so) Microsoft has been known to back-port security and even many stability patches to the current and previous versions of their OSes as they're working on their next generation products. Does anybody remember that MS backported lots of fixes to NT 4.0 in SP5 and SP6 based on work they'd done developing Win2k?
Unlike Apple, however, MS didn't make NT 4.0 users wait until after Win2k shipped before bothering to release the fixes for NT 4.0. Jaguar users shouldn't have had to wait until after Panther shipped to get those security fixes. They're still waiting, aren't they?
While a lot of the comentary that followed assumed that Apple would not be releasing patches for older versions of 10.x, the original article said nothing untrue.
Were the vulnerabilities fixed in 10.3? Yes.
Were the vulnerabilities patched for older versions? No.
Did Apple comment when asked about whether they would patch older versions? No. (They did comment today).
Just because a lot of alarmists chose to interpret these facts as meaning that Appple would not patch the vulnerabilites for older versions does not mean that the article told any untruths.
Ouch. That's a good point. I never even considered investigating @stake's past advisories. From the link you posted, it looks like they have a long history of being a grey hat.
So much for any hope they'll do better next time.
Thanks for the information!
Yeah...we all know that it's better to apply a shitload of changes and chase the bugs than that thing called incremental testing. Patches have dependencies to determine what previous objects need to be upgraded for the current patch to work. The beauty of unix is the independence of the subsystems.
Some were hoping that putting a unix under mac users would increase their intelligence. Apparently not.
One more example where @stake allows time to fix the issue before going public.....
This @stake advisory was published on July 12, 2002. Under the section "Vendor Response", it states that: "Vendor was notified of these issues on May 28, 2002."
That's pretty much a month and a half advanced notice before going public. Again, it appears that since Pingtel acknowledged their "accomplishment" with "a point by point response to the @stake advisory" they held off with the announcement. Granted, this is a completely different platform, different security implications, etc. But still, the signs point to someone throwing a temper tantrum and going very public very early, with subtle yet noticable allegations that the Apple security fix would require a $129 purchase.
MACHINE(1) BSD General Commands Manual MACHINE(1)
NAME
machine - print machine type
SYNOPSIS
machine
DESCRIPTION
The machine command displays the machine type.
SEE ALSO
make(1)
HISTORY
The machine command is currently under development.
BSD July 26, 1991 BSD
_______
I don't get it. I have been trolled?
But did you hear that M$ is buying Google?
*smack*
Under capitalism man exploits man. Under communism it's the other way around.
I didn't see the word "beleagured" anywhere in the security advisories.
We are talking about Apple Computer, right? I often get them confused with the Beatles' record label, Apple Corps, Ltd.
machine(1)
Description
The machine command displays the machine type.
double bullshit for "i386"
We've secretly replaced Slashdot with new Folgers Crystals - let's see if it notices.
Apple said:
"Apple's policy is to quickly address significant vulnerabilities in past releases of Mac OS X wherever feasible," Apple said in a statement given to MacCentral. "The shipment of Panther does not change this policy. Apple has an excellent track record of working with CERT and the open source community to proactively identify and correct potential vulnerabilities."
Which is a nice bit of damage control but stops far of saying "We are going to patch pre 10.3 releases."
I personally think they will fix 10.2 but I do find it unsettling that they, having been givin the opportunity *twice* to directly answer now, haven't done so with a definitive answer.
Although Apple doesn't give direct credit, don't they usuall provide a link to the advisory or somesuch?
" So either you're saying the @stake people are liars. Or the bad press from the story made Apple change their minds. I'd say the latter is more likely to be true."
Well we don't know all the details. It's possible @stake wasn't lying and it's possible Apple hasn't changed it's position.
@Stake quite possibly was talking to a developer type when the matter came up. And when asked about the developer, being aware of development schedules and all, truthfully answered "We currently have no plans to fix 10.2". Which may have been true but still may not have been the directoin of position of Spple management.
... since Apple just allowed the story to spread for a few days without issuing any correction, I and many other Mac fans I know of went out and bought Panther. This was a scam to scare us into upgrading. Next time, I'll steal the OS first, just in case.
I know, I know, I'm the bad guy here for not "having faith" in Apple, but Microsoft would have issued a correction statement right away, and the Linux guys, from what I've seen, would've patched everybody in the first place. I'm a switcher, and Apple better learn that I switched once, I can switch back if they start to screw me.
~John M
Slashdot never posts corrections for any of the incorrect stories about Microsoft on the front page... is Apple sponsoring this site or what??
I am sure the next conspiracy will be coming right up with the next Microsoft-related post here at /.
jack's bicycle is music to my ears
Which is why of late I rarely use my Powerbook.
Apple has a lot going for it, but one thing lacking that really bugs the hell out of me, is usefull low level documentation.
Your average user doesn't care about tweaking their system, they're happy if it works. The apple philosphy is simplicity.. unforentatly that simplicty comes at the expense of utility. Those few users who do unmain stream thigns with their systems, have older hardware, or use their apple hardware in conjection with non-apple hardware are offten up shit creek without a paddle.
For the most part, the Mac comunity isn't very helpful either. The Mac comunity tends to be comprised mostly of consumers and fanboys...there aren't that many skilled hackers out there though. (This is not a bad thing, it only means that apple tends to supply. ) so there often is very limited help there.
*shrug* ah well.
But I thought that they didn't need perfect code to prevent security problems
Heads up on using an XServe. It's really cool, but there are some Apple-particular quirks that got me when I went from using RH to using an XServe. This is with version 10.2.6 so some of these may already be addressed in Panther.
No PDC functionality in Apple's implementation of Samba (I know this is fixed in Panther)
DHCP does not use any MAC address filtering if you want to control it that way. The address filtering screen you see applies to Netboot devices only. (Don't know if this is "fixed" in Panther. It's just not available in 10.2.6)
No native SCSI tape drive support in OS X Kernel. Seriously. If you install a SCSI card, you will be dependent on your backup software vendors SCSI driver solution.
No recommended or "built-in" backup software for your files. You basically have to decide how you are going to do this keeping in mind that the HFS+ file system will not "show" resource forks to typical Unix backups like tar or dump. There is an hfstar utility available from MetaObject which is a patch to GNUtar.
Maybe this was just my bad luck, but we have Apple Support and many of their solutions involve "reboot the server". This is usually unnacceptable in most production environments, particularly coming from a Linux background where independent processes can be killed and restarted on command. Read the man pages for "lookupd".
You can't change the IP address on the server without re-installing the OS. No, seriously. This is according to Apple itself. Although they do provide you with an unsupported script for changing the IP. If you have already changed the IP, they recommend you re-install the OS.
No native way to import user accounts WITH passwords. It will import /etc/passwd like information, but the password will be empty and must be created for each user using the GUI interface. There is a third party utility for that also. Or, you can set the "user changes password at next login" option.
Permissions, work the same as on other Unixes unless you enable Apple permissions, which is recommended particularly for Dropboxes, and Group folders. However, you can only enable Apple-permissions on shared items through the GUI. Also, Apple has different ideas on how home directories should be shared.
Things I like about XServer
Freakin' fast, particularly with a nice XRAID and the built-in Gig NIC.
As long as you stick with the options available on the GUI and don't try to customize the server processes, my 81 year-old grandmother can configure it.
Holds alot of disk space in that skinny server (upto 720GB). Also, I don't notice any "speed hit" from "only" using 7200 RPM ATA drives as opposed to SCSI 10,000 RPM.
Quiet. Unless you get the XRAID, then not so quiet.
To summarize, if at all possible I would try to get an "evaluation server" out there to look at what services you will need to implement and how the XServer implements those services. While it does have the UNIX underpinnings, the customizations on it make it a different enough animal that a straight application of methods and "best practices" from Linux to XServer will not work.
Of course, all standard disclaimers apply - Not an XServe expert, blah blah my experiences may not reflect those of others blah blah blah
You mean those non-voting shares that were sold long ago? Or are there other shares that you have discoverd and are ervealing for the first time?
It's not offtopic, dumbass. It's orthogonal.
Microsoft sold all their shares in Apple years ago! They dont have any shares in Apple anymore!
Ok, my work is finished here.
Remember, it was an @Stake employee who got fired for pointing out that Microsoft dominance and security are issues.
So let us not forget that @Stake is a tainted biased and are in fact Microsoft paid SOB.
@Stake has long since lost credibility in my books.
* The "reinstall to change IP address" is actually an OpenDirectory issue, and only happens if you slected "permanent IP address" at install. Not really an OS issue.
/System/Library/Extensions, probably for licensing reasons. SCSI drivers is a sore button since I have a couple fo Adaptec 2906 cards that just won't run under 10.2.8. Possibly Adaptec's fault.
* SCSI drivers. These exist in
Veteran, Bermuda Triangle Expeditionary Force, 1992-1951
Is it just me, or did Apple put out the patch only after the media storm? They could have killed the story yesterday simply by promising that the patch was on its way...
Bill Gates was found dead in a ditch this afternoon, strangled with the cord from an Apple optical mouse. While no suspects have been identified, Slashdot has set up a database of pro-Macintosh posters and is cooperating fully with Microsoft and Federal authorities (in that order).
Cripes, first I thought this meant the Atari Jaguar. I had the most puzzled expression...
BytesTemplar.com
I only have a simple question, really:
If the original story, about Apple not fixing security holes in Jaguar, made the front page, why didn't this?
Fox^H^H^HSlashdot: Fair and Balanced.
Mikey-San
Karma: +Eleventy billion (mostly affected by watching Celebrity Jeopardy)
Wow, a +3 offtopic post -- those are rare. Maybe we can all get it to a +5 offtopic... Here is how I think it can be done:
- Do a couple more +1 mods to it, doesn't matter which type
- Then have someone mod it as "offtopic" to flag it as offtopic
- Finally, have someone mod it as an underrated, which does not carry a name change (such as "insightful", "interesting") with it. At this point it should be labeled as +5 offtopic.
Slashdot's first reaction to VMware
Shouldn't it read "NeXT conspiracy, please!"?
or maybe they got scared after it was /.'ed so they decided not to indirectly force Jaguar users to upgrade to Panther and release the patch for Jag.
/.!!!!
Go
Which would let them update to Panther for the cost of the media.
Why does anyone care?
I mean, @stake was really scraping the barrel to find security holes. "If a third party application installs files with bad permissions, then that can be used to break security." Is there an operating system out there for which this is NOT true?
Umm... no, certainly not. I think the reality is, it's not *anyone's* responsibility to ensure upgrade cards keep working with new OS's designed for newer machines.
Apple had a pretty well defined set of rules of which systems supported which OS products of theirs. Anyone trying to bend those rules by purchasing 3rd. party hardware that puts CPUs in boxes never originally designed to run those CPUs is taking a chance.
The vendors of the upgrade boards probably have some interest in making them compatible with as much new Apple software as possible - so they can keep their sales up. But ultimately, the only thing I see them really *needing* to support is their compatibility with MacOS 9.1 and earlier.
Except for folks trying to do things a machine was never meant to do, just because they won't pay for/can't afford the right tools for the job -- the G3/G4 upgrade cards are really designed to boost the speed of a given, older Mac, running the OS's it was intended to run before the upgrade was installed.
Ya, who the hell needs RAID-5?
Manipulate the moderator system! Mod someone as "overrated" today.
Thanks for the thoughtful reply. Good to hear the voice of someone who isn't a slashbot.
Apple did initially tell security experts they didn't plan to patch Jaguar.
That is speculation. You have no way of knowing, unless you know exactly who said what to Goldsmith. And you don't.
There is a very simple way to determine who Goldsmith talked to. Just check and see who was fired at Apple on Friday.
I think it's a bit naive to swallow that Apple did this on it's own and not even consider that it was done to stop the backlash.
http://slashdot.org/index.pl?mode=&issue=20031 031
Integrate Keynote and LaTeX
I am not one to bash other OS's -- I am one to defend missinformation regarding my OS of choice though -- however, I cannot believe that you would be one to defend MS History of spotty security...Most used OS in the world I'll give you, but they are no paragon of responsibility...
We apologise for the fault in this post. Those responsible have been sacked. -- Signed RICHARD M. NIXON
Apple does in fact give "direct" credit. In the case of the most recent patch, it may be found here, and they've done so at least since 10.2.4 as indicated here.
No, I was most definitely not defending MS's poor security performance. I merely pointed out that even as shoddy as MS's security efforts have been to date, even they haven't attempted to get away with something as stupid as telling their customers "Pay $129 to get the latest security fixes."
Obviously you've never actually talked to MS tech support. I have more than once been told that the correct way to fix a problem is to upgrade to the latest version. Usually another fix is available but upgrades are the official solution.
I will repeat what has, at this point, become patently clear...Apple patches older versions of it's software for free. I have used all versions of OS X, and all versions have recieved security updates for free with great regularity.
I know a lot of folks around here expect miracles, and that is a good thing, but just because a company takes an extra week to patch a security problem that is essentially non-critical -- as opposed to criminally negligent a la MS outlook and VB script related vulnerabilities -- doesn't mean they are leaving their users out in the cold.
I have never had to update any version of OS X for security reasons -- performance reasons, I'll give you, but never security.
We apologise for the fault in this post. Those responsible have been sacked. -- Signed RICHARD M. NIXON