Slashdot Mirror
Apple Releases 'Highly Critical' Patch
Toothpick writes "Apple Insider reports that a new security update is available for download from Apple. This addresses issues identified in sudo, Safari, and OpenSSL among others.
The gory details are, predictably, available on the Apple Info site." Commentary from ZDNet is also available.
... oh, they did? Before there were any exploits in the wild?
Never mind.Information wants to be anthropomorphized.
So called highly critical patch installed itself yesterday on my iBook.
:-)
For those of us who need it, Apple update takes care of it.
If there was an exploit that meant we should click on "Software Update" instead of waiting for it to cycle round, great but this is just Apple-bashing. Is this a microsofty going "look! other OS's have security updates too" while there are many many exploits in the wild for them?
Anyway it's a day late. This is "internet time", if you can remember that far back
- Paul
Apple includes the BSD userland utilities, and while it does include some GPL'd software it does not require any to run properly. However, I believe we should petition them to starting calling it the "Mach based Darwin/BSD/Mac OS X featuring OSS Software by GNU, Apache, Postfix, Samba, ect."
Ummmmmm... when did Apple change their domain to "get.sent.to" ? Don't support someone with clickthrough advertising, just go directly to http://www.apple.com/support/downloads/
You don't understand the Windows vs. Professional OS sequence for vulnerabilities:
Professional OS:
-Vulnerability found by white hat security world
-OS Vendor informed
-OS Vendor works on patch that both fixes vulnerability and doesn't make things worse
-Vendor tests patch thoroughly
-Vendor releases patch; world as a whole, including script kiddies, first hear about vulnerability
-Users, trusting vendor's track record, install patch (see "doesn't make things worse" above)
-Any exploit is too little, too late.
Microsoft:
-Vulnerability found
-Microsoft informed
-Nature of vulnerability leaks out to world as a whole
-Microsoft shoves thumb up bum, waits 6 months
-Exploit released
-Microsoft shoves second thumb up bum, wonders about apparent discomfort
-Microsoft eventually releases patch, may or may not make things better or worse
-Frustrated people buy Macintoshes
Simple, isn't it?
By the way, both sudo and OpenSSL are OpenBSD spin-offs and nothing at all to do with the GNU project.
I am TheRaven on Soylent News
SecurityFocus is apparently owned by Symantec, so I'm unsure just how much salt you might want to throw on that article. I'm guessing at least a grain or two.
You say you got a real solution
Well, you know
We'd all love to see the plan
(The Beatles)
1) Securityfocus is owned by a company with a vested interest in selling anti-virus software to Mac (and PC) users. It does serve a useful purpose, but when the points made are so vague, I consider it more advertising than service.
Say I wanted to market X, and say that I'm a sneaky and underhand individual. I might purchase or support a website dedicated either to X or anti-X and have *some* articles on it that suit my purpose. I wouldn't undermine the integrity of the site (well, much), but I would use it as an authoratitive mouthpiece that mouthed off about *my* preferred direction.
So, ok I'm a cynic, but so far my cynicism has been proved right depressingly often. Sigh.
2) "Looking at the numbers" is no useful guide to pretty much anything to do with security. The phrase works when the numbers themselves are the pertinent facts (eg: a bank-balance sheet). "Humans are obviously not the dominant species on the planet - there are millions more houseflys. Look at the numbers".
The point is that one dose of cancer can kill you, but you may survive fifty or more infections of the common cold without significant harm. The numbers don't tell you the relative importance of the problem, and indeed may just reflect different counting methods or diligence in detection.
Simon.
Physicists get Hadrons!
My brother recently switched to Apple.. We were IM'ing about this update and he said..
"one thing i looove about this thing is that i'm never afraid to update like in windows. i'm not scared that it will be worse off"
Trust is important. How many people haven't updated Windows to SP2 still??
Everyone is entitled to his own opinions, but not his own facts.
Look at the numbers. Whoever would have thought that the numbers for MS and Apple would have got this close?
Counting the number of bugfixes released is no measure a a system's security. The number of remote vulnerabilities on a default install of the OS, the ease of exploiting those vulnerabilities, the number of local exploits, and the likelihood of an exploit happening are all factors. Additionally, predictive criteria, like past performance and the exposure and design of the architecture may be useful. If you look at Windows it has innumerable unpatched local vulnerabilities and working exploits that have existed for many years. They don't even bother fixing them most of the time. OS X on the other hand has a handful of potential local priviledge escalations vulnerabilities, that are fixed in a timely manner, and with one or two proof of concept exploits (none unpatched). Windows has a number of long running remote vulnerabilities and they crop up every month. Exploits for these vulnerabilities occasionally appear before a fix is available for the vulnerability, and regularly appear before administrators have time to thoroughly test those fixes (which is very necessary due to the kludgy Windows architecture and their history of catastrophically broken patches). On OS X I am unaware of any remote vulnerability with a published exploit that preceded the fix for that vulnerability.
The ease of exploitation of vulnerabilities on Windows is much higher due to the lack of a usable non-admin environment, non-network services that run exposed on the network, default settings that run unneeded services, auto execution of scripts and executables within default and unremovable applications, ease of concealing the nature of an executable in the GUI, integration of web browsing and file browsing code, lack of packaging for executables, shared registry, and larger install base for automated propagation. OS X is by no means perfect and experiences regular security flaws. Much of the security auditing that is done, is a side benefit of the open source user environment components OS X shares with other UNIX-like systems. I'd be much happier if Apple did some more thorough security testing of their products. That said, to make the argument that the security of OS X is approaching the same level of complete cluster-fuckedness that is Windows based solely on counting the number of vulnerabilities patched by the respective vendors is ludicrous.
Microsoft: the latest security hole in the HTML control is a buffer overflow in Javascript. They've known about it for months. Nothing happens until a sample exploit is released.
Apple: the latest security hole in Webkit is a buffer overflow in URLs. The first anyone hears of it is a patch through Software Update.
You just don't understand what they mean by critical. I installed this patch and it immediately started complaining about all the junk on my desktop. Then it started berating me for my lack of sensible folder organization. It criticized my choice of web browsers. I turned on iTunes to drown it out and it started giving me a hard time about my musical choices. By the time it started in on my clothes I was sick of it, so I uninstalled the patch. I'll take the data insecurity so as not to put up with the emotional insecurity, but YMMV.