Slashdot Mirror
Apple Cites Open Source Core Security
ChilyMack writes "In a CNet article, Apple senior vice president Bertrand Serlet says, 'A lot of security problems derive from the core ... [With open source code,] thousands of people look at the critical portions of source code and ... check those portions are right. It's a major advantage to have open-source code.'"
They're a (relatively) big company. Big companies are supposed to be evil, yet they do lots of Good Stuff(tm) like supporting and using OSS.
This is what Apple's always done that's kept them around... their products are dirt simple, yet really powerful in hands that know how to put them to work.
In the words of a motivational book-on-tape foisted on me recently, it's not enough to have satisfied customers, you need to create raving fans. I bought my first Apple (Pbook G4 1.25) in May, and I've been raving about it ever since. mmm.... iMac...
I mean seriously - if something is important to you, do you just turn it in w/o someone else giving it the once over? My wife reads every talk I give and vise-versa. WE ALWAYS catch mistakes that the other person has made.
It's a no-brainer.
..........FULL STOP.
Apple has been a great demonstration for the added security of OSS. Of the few exploits that have arisen, they've mostly been related to the parts of the OS that are still closed, like AppleScript and Internet Connect.app. Maybe they should expand their OSS efforts into these areas...
(exceptions in recent libpng and libz exploits)
By that logic Apache should have more exploits than Microsoft's web server, since Apache has the major market share. Since that's not so, it seems that vulnerability is a bigger factor than market share when it comes to picking targets.
You've misunderstood what the "Apache versus IIS" example represents.
It shows that open source can be secure. Apache is indeed a more attractive target because it does have a larger marketshare. However, attacks are unsuccessful because Apache is more secure than IIS.
This doesn't mean that marketshare is irrelevant. Quite the opposite. It means that good code can withstand the added attention a marketleader attracts.
You cannot make a parallel between Apache and OSX however. Apache is a product that proves a concept is sound; that open source can be secure even when it is a very attractive target. This doesn't mean all open source is secure, and it certainly doesn't mean that OSX won't be targetted more as its marketshare increases. OSX will be targetted more.
"People have an irrational hate for Microsoft"
I wouldn't call it irrational. Sometimes people vent their anger irrationally, but the cause of that anger is generally quite rational indeed.
And your assertion:
"So really, there are two reasons why Mac OS has not had mass exploits:
1.) Obscure
2.) Not an emotional target"
is pure speculation. If they were the sole reasons, then you'd expect at least one actual exploit to surface in the wild. I'm sure they are factors, but how about it's easier to write viruses/worms/trojans for Windows? And the fact that MS waits so long before security updates?
In short, there are not, simply, "two reasons why Mac OS has not had mass exploits".
A third reason that Macs have fewer attacks is that fewer of the l33t kiddies actually own them.
There's no way I could write code that attacked a Mac without having one to play with - and I don't.
I've got a collection of PCs and a collection of Sun boxes, but no Macs.
I think Milton said it best himself
The fact that a falsehood can be stated with great precision, style, or in a moving manner does not change its "false" nature. For example my corporation's goal may be to maximize profit by designing and developing the most effective and reliable medical equipment.
And of course charities, open source developers, etc. can be unethical. Welcome to the real world, sound bites, or in Milton's case word bites, are not the ultimate source of knowledge or fact. Writers have poetic license to oversimplify or fudge the facts to convey a point.
Big company uses open source = big company gets cheap labour fixing bugs.