Slashdot Mirror
Windows vs Mac Security
sdhorne writes "There is a good technical discussion over at InfoWorld on the merits of launchd and what is lacking in a comparable Windows secure solution. It is a throw back to the UNIX vs Windows security discussion that has been hashed out for many years." From the article: "it always traces back to Microsoft's untenable policy of maintaining gaps in Windows security to avoid competing with 3rd party vendors and certified partners. Apple's taking a different approach: What users need is in the box: Anti-virus, anti-spam, encryption, image backup and restore, offsite safe storage through .Mac, and launchd. Pretty soon any debate with Microsoft over security can be ended in one round when Apple stands up, says 'launchd', and sits back down."
Anyone notice the link at the bottom of the article?
Links to slashdot submit article. http://slashdot.org/submit.pl
Cute.
I don't know if I'd go that far. OSX isn't 100% immune - it just has more common sense.
In a nutshell, OS-X is built upon a known animal, whereas Windows is an animal which continues to be re-invented, like a leopard changing its spots to stripes, then plaid, then paisley, then something else. With such moving targets all the time it's small wonder they've got security issues. Some begin to be addressed with good programming practices (which Apple could certainly lapse at at any moment, and may well have and we haven't heard about) Another is to require tight control over interfaces between code from different departments. Microsoft going back to scratch time and again doesn't necessarily mean anything is getting better.
A feeling of having made the same mistake before: Deja Foobar
Macs are based on UNIX. It's not faked to appear like UNIX, it is actually UNIX. The permissions system means that a common virus could damage a user's home directory, but the system for the most part would remain unaffected, including other users. It is still possible to write root-kit style viruses that take advantages of subtle bugs in the operating system and other software to gain control of the system, but this is significantly more complicated to do, and IIRC it was Theo from the OpenBSD project who said that attacks like this require many steps that often must take advantage of many vulnerabilities to elevate priviledges, and by fixing even one bug, a whole category of vulnerabilities (even if other bugs remain) becomes inaccessible to a would-be attacker. This, in addition to much of the code underlying OS X being available for hacking up by anybody, in addition to other projects actually hacking on this code (improvements from projects like Samba, Apache, GCC, FreeBSD, even various Linux projects, make it into Darwin and OS X.... and most of all the fact that users don't run as administrators, all of these reasons make it much less likely that viruses could be as damaging as on Windows.
being offered as a "reason why OS X is more secure than Windows."
The article claims that Administrator on Windows is equivalent to root; and that SYSTEM is more powerful than Administrator (and by implication more powerful than root). This is nonsense.
Administrator is indeed less powerful than SYSTEM. However, Administrator is equivalent to a user on the sudoers list and/or with group write access to system directories. SYSTEM is the correct equivalent to root.
We may quibble about how well Administrator accounts are protected from trojans; or whether non-Administrator accounts on Windows are of much use; those are valid arguments. However, claiming that, somehow, SYSTEM on Windows is magically more capable than root is ridiculous.
If anything, Windows has a somewhat better design in that it is possible to set up privileged accounts with a specific power that only root has on UNIX, yet not have any of the other root powers. However, this capability is quite underutilized, and in many ways is undermined by other (unfortunate) decisions that Microsoft made.
It depends on how they offered it. If they made it impossible to uninstall, then yes, we would yell monopoly. However, if they made these features able to be uninstalled (or never installed in the first place) and easily replaced by third party tools, then I don't think we would have anything to complain about. I don't have any problems with MS including IE with the operating system, I just wish it could be removed from the system.
Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
As long as corporations confuse interoperability with "windows compatibility" the scam will go on. Only when the commercial user who forks over billions of dollars to MS every year demand true interoperability and injects real competition, it will end. There is no advantage in being the first among the users pushing for it. Pepsi will not care as long as Coke is also spending relatively the same amount of money for similar services. But someday somewhere some corp will bite the bullet and spend what it takes to break the vendor-lock in, and only after that the security situation will improve.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
I'm not sure that 're-invented' is how I'd describe windows, or their efforts at security.
In the past Microsoft have commented that they have completely ditched the code Windows was written with and re-written from ground up, to try to address myriad flaws. That's pretty drastic. I've done it with small projects which simply grew too large and unwieldy because they were never expected to scale to newer demands* Microsoft is effectively doing this with Vista and yet... there still appear to be security flaws. Something wrong with that picture. Could be they're just a victim of their success and such a massive undertaking of code is approaching the event horizon just before the black hole.
*You know the type.. you develop some nifty little tool to summarise information for your own use and someone sees it and says, "Hey! That thing does in seconds what I spend a week doing! I need it, set me up with it!" Next thing you know your little tool has to be user friendly, go to printers, be in colour, etc. Continually piling in changes makes it fragile so you step back, figure what it all needs to do and how to achieve the goals and then recode, with an eye toward more scalibility and unforeseen features later.
A feeling of having made the same mistake before: Deja Foobar
Microsoft has been declared a monopoly in Federal court, and found guilty of anti-trust offenses related to abusing that monopoly in violation of the Sherman Anti-Trust Act.
Apple, on the other hand, is not a monopoly, and hence it would be perfectly legal for them to bundle anything they damn well felt like bundling.
Why is this so difficult to understand? Microsoft, because of their market position, is held to a different legal standard. End of story.
Learn from the mistakes of others. You won't live long enough to make them all yourself.
Why is this so difficult to understand? Microsoft, because of their market position, is held to a different legal standard. End of story.
It's not difficult to understand; it's annoying because it's the wrong argument, and it really muddies the debate. We don't need to hold Microsoft and Apple to different standards to show that one is better than the other. There is nothing wrong with MS bundling software with their OS. What was wrong was that they were forcing companies like Dell NOT to include competing software (such as Netscape).
It's a moot point any way though, because in this case we aren't even talking about the right thing. As someone else mentioned, we're talking about a system that is built to resist viruses and such, not virus scanning software bundled with the OS.
Thinkin' Lincoln - a web comic of presidential proportions
I haven't seen anyone cry "monopoly" over that. I've just seen people cry that Microsoft is selling services to fix problems in its own OS, like with OneCare, instead of fixing the problems in Windows to begin with. And guess what, despite Vista's security enhancements, it's still based on Win32, still based on a registry, and is basically just a bunch of new APIs and rewritten subsystems on top of the same old code.
Also, there's a difference since in the Apple world, there isn't an antivirus or antispyware market, but in the Windows world, there is a huge market that's been around for over a decade, so it's a big deal when Microsoft starts bundling its own versions of these services.
For the record, OS X ships with no antivirus software. Not needed.
"Sufferin' succotash."
But at the same time Apple gets applauded for rolling EVERY SINGLE LITTLE POSSIBLE THING into their OS?
Because they don't force you to use any of it. You can delete any of the utilities that you want. Don't want ichat? Trash it.
On the other hand, good luck getting rid of Windows Messenger. It's even hidden in Add/Remove Programs and fixing that requires a hack well beyond most users.
Don't want to use Safari? Make it go poof.
On the other hand, you CANNOT get rid of Internet Explorer. And that's bad. IE is full of security holes and you can't get rid of it. Safari is far safer, and you can get rid of it.
What hypocrisy was that, again? There's a damn good reason MS gets blasted and Apple doesn't. (Well, it does, but nowhere near as much, and I just explained why.)
i am a soviet space shuttle
If you remove things like IE
But IE is part of the OS... just ask Microsoft. Seriously, though, back when my previous company had to deal with IIS before moving to a more secure/sane server, one of the server bugs was fixed by upgrading IE on the server, so IE-is-fundamental-to-the-OS is frighteningly close to actual truth with Windows.
Also, I'd like to see the statistics you cite that say that Windows hasn't been hit statistically more than MacOS. There are no MacOS-specific worms or viruses "in the wild", so it's hard to come up with the sigmas for what would be "expected" for what a comparable OS should expect.
E pluribus unum
The very successful worms of the early 21st century were all about causing as much aggravation as possible. The creator of the ILOVEYOU virus didn't make any money from disrupting corporate email servers but he did get to cause a lot of aggravation. You think there are no virus writers wanting to stick it to smug Mac/Linux users? You think no-one would take the time and effort to annoy them? You don't understand human nature too well if you believe it's merely marketshare that's keeping malware away from OS X and Linux.
Ok, I agree with most of your post, but ...
... iTunes springs to mind. Anyway, the Apple solution to buggy software requiring elevated privileges is "you can't run that software" - not very helpful if you need it.
The purpose of most of the DLLs in SYSTEM32 is documented, just look at the summary tab in Explorer, the problem is that with any complex operating system it's trivial to make up fake names that sound plausible
I just looked at the summary tab on a dozen random DLLs in my system32 directory (most from microsoft, some from 3rd parties), and there was no information in any of them. Why can't 3rd parties use a different location than MS... at least that would help a little (would help me anyway, if not the actual problem being discussed)
Windows requires users to use Administrator to install software? No, buggy software requires that. Historically a few Mac programs have had the same requirements
"buggy" software? I think you mean to say legacy OR poorly coded... this is one of those side effects that windows carries from version to version (like the registry) because MS refuses to leave customers high and dry for old software. Back in the old days this was the right way to do things, store configs in programdirectory/conf... we didn't have an appdata directory like we do now. Same with registry hives, they weren't setup in the same way they are now where certain users could do certain things. Calling it buggy implies the software is behaving contrary to design, it's not, it's just that the target has moved and the software hasn't all moved with it.