Slashdot Mirror
Windows vs Mac Security
sdhorne writes "There is a good technical discussion over at InfoWorld on the merits of launchd and what is lacking in a comparable Windows secure solution. It is a throw back to the UNIX vs Windows security discussion that has been hashed out for many years." From the article: "it always traces back to Microsoft's untenable policy of maintaining gaps in Windows security to avoid competing with 3rd party vendors and certified partners. Apple's taking a different approach: What users need is in the box: Anti-virus, anti-spam, encryption, image backup and restore, offsite safe storage through .Mac, and launchd. Pretty soon any debate with Microsoft over security can be ended in one round when Apple stands up, says 'launchd', and sits back down."
Pretty soon any debate with Microsoft over security can be ended in one round when Apple stands up, says 'launchd', and sits back down."
It seemed pretty wello written. That said, I which he would have said a little more about launchd, at least enough to explain why it gives OSX an advantage. It would have also been nice to have had some kind of side-by side comparing Windows and OSX, like how the windows System pseudo-user trumps the admin user, and how there is not way to trump the OSX root user.
Why this can't happen under OS X:
I don't know if I'd go that far. OSX isn't 100% immune - it just has more common sense.
"We are all geniuses when we dream"
- E.M. Cioran
"Pretty soon any debate with Microsoft over security can be ended in one round when Apple stands up, says 'launchd', and sits back down"
I would have though "(almost) no viruses" would have done the trick since OSX came out...
Or, we don't effectively force everyone to run as super user all the time - if you prefer
*''I can't believe it's not a hyperlink.''
Apple's taking a different approach: What users need is in the box: Anti-virus, anti-spam, encryption, image backup and restore, offsite safe storage through.
Don't you think that if Microsoft offered this that everyone would cry monopoly? Actually, I've seen other people on Slashdot cry this before at the announcement of Microsoft's OneCare program, which isn't even bundled with the OS!
What's worse than finding a worm in your Apple?
Finding half a worm in your Apple.
"Look Lois, the two symbols of the Republican Party: an elephant, and a fat white guy who is threatened by change."
It always traces back to Microsoft's untenable policy of maintaining gaps in Windows security to avoid competing with 3rd party vendors and certified partners
So if they bundled everything you list (anti-virus, anti-spam, encryption, etc.) into the operating system, you don't think they'd be accused of illegally leveraging their monopoly advantage? Just look what happened when they integrated a web browser into the OS a few years ago.
The most rabid believers in American Exceptionalism are the exact same people whose policies are destroying it.
Anyone notice the link at the bottom of the article?
Links to slashdot submit article. http://slashdot.org/submit.pl
Cute.
I wonder if they would have been slapped with an antitrust lawsuit if they incorporated antivirus in the OS. It certainly would of had a big impact on the antivirus companies.
Maybe with apple incorporating it they have the green light to go ahead with it.
Please sign petition to restore sanity to our banking system!!!
http://financialpetition.org/
I'm no network admin, but all I know is since I switched to Mac I have no Norton or Symantec software running and there's no signs of threats anywhere. boxlight
If you don't count a trojan as a virus, then you don't need an anti-virus if your OS is secure. Apple can work on securing its OS or on an anti-trojan, but any effort spent on an anti-virus is wasted.
Was I the only Mac user who didn't know what launchd was off the top of my head?
In Mac OS X v10.4 Tiger, Apple introduced a new system startup program called launchd. The launchd daemon takes over many tasks from cron, xinetd, mach_init, and init, which are UNIX programs that traditionally have handled system initialization, called systems scripts, run startup items, and generally prepared the system for the user. And they still exist on Mac OS X Tiger, but launchd has superseded them in many instances. These venerable programs are widely used by system administrators, open source developers, managers of web services, even consumers who want to use cron to manage iCal scheduling, and they can still be called with launchd.
The launchd daemon also provides a big performance boost to your system. At any given time, only those daemons that are actually used are launched; combined with the fact that daemons can shut themselves down and be relaunched as needed means that you can reduce the average memory footprint of the system.
http://developer.apple.com/macosx/launchd.html
Soccer Goal Plans
Macs are based on UNIX. It's not faked to appear like UNIX, it is actually UNIX. The permissions system means that a common virus could damage a user's home directory, but the system for the most part would remain unaffected, including other users. It is still possible to write root-kit style viruses that take advantages of subtle bugs in the operating system and other software to gain control of the system, but this is significantly more complicated to do, and IIRC it was Theo from the OpenBSD project who said that attacks like this require many steps that often must take advantage of many vulnerabilities to elevate priviledges, and by fixing even one bug, a whole category of vulnerabilities (even if other bugs remain) becomes inaccessible to a would-be attacker. This, in addition to much of the code underlying OS X being available for hacking up by anybody, in addition to other projects actually hacking on this code (improvements from projects like Samba, Apache, GCC, FreeBSD, even various Linux projects, make it into Darwin and OS X.... and most of all the fact that users don't run as administrators, all of these reasons make it much less likely that viruses could be as damaging as on Windows.
He seems to argue that Windows is less secure than OS X partly because if your Windows system gets infected, you can't trace the source of the problem, but with OS X you have a better chance of doing so. However I think this is the wrong thing to emphasize. If a piece of malware gets true root access on a system then it can do what it likes, including loading new kernel modules to hide files in the filesystem and so on. It's only lack of skill by some rootkit authors that make them detectable (so in effect, it's security by obscurity; there's a good argument that operating systems should make it as easy as possible to do such nasty things once you get root, so nobody will be tempted to think 'such things are only theoretical').
Now he does mention that most services on OS X don't run with unrestricted privileges, so there is much less chance of malware getting root *in the first place*. This is the important thing to emphasize - not what to hopelessly fiddle with once you are already 0wned.
I guess by root I don't necessarily mean what OS X or BSD or even Linux call root, but the classical Unix notion of the Almighty user who can do anything. Many BSDs have securelevel settings meaning that even root is restricted from doing certain things.
-- Ed Avis ed@membled.com
>[...]it always traces back to Microsoft's untenable policy of maintaining gaps in Windows security to avoid competing with 3rd party vendors and certified partners.[...]
What bizarro-universe is the writer living in to write something so patently false?
Microsoft's Standard Operational Procedure is to wait-and-see which niche is picking up enough importance (and we all agree security is a major one this decade, right?) and then cutting off that vendor(s) oxygen by coming up with their own "superior" (guffaw) solution which MS gives away for free, next to nothing or by marrying it to some essential O.S. component.
Another piece of Microsoft-propaganda no doubt.
Sell it elsewhere, chum. I'm not interested in reading anything else you've written if this quote is representative of the drivel you are putting forth. Thank you.
I think the conclusion that he draws is probably correct, but he doesn't really seem to explain why. The reason that systems like OS X and Linux are safer than Windows is not that launchd runs a shell, but that both Linux and OS X tend to run processes that don't need privileges as root.
This is a substantial win. However, if you manage to compromise a process that is running as root, you do have full control of the machine, and you can install your own privileged software on the machine without an authentication prompt appearing on the console.
Also, most of the man pages on OS X are woefully out of date, so giving the existence of these as a reason for why security is better on OS X is unfortunately a cruel joke. Third party apps from the Open Source community do often have better documentation, but the basic man pages from OS X are often years out of date - this is one of my pet peeves about OS X, I will admit.
It sounds like the hack he's describing occurred because he'd installed third-party software that ran as a service with an open port, as SYSTEM (i.e., with full privileges) and that took over his machine. The reason this is less likely (not impossible, just less likely) is because if you are running a third party server process on OS X, it's probably a piece of open source software like Apache, which has been vetted to within an inch of its life, because it is open source, and the many people who care that it is secure have the freedom to check that it is secure. And it probably doesn't run with full privileges, as the author says.
Anyway, like I said, he's right, but his reasoning is a little foggy. And it's important to be aware of the ways in which it's foggy, because this is your best chance of avoiding having your machine hacked.
Conceptually, I agree that LaunchD is a really slick idea and I really hope Linux and the BSDs take a good hard look at this code and the possibility of adopting it. That said, it is not a security panacea by any means, just one more clean, sensible implementation that leaves less room for a vulnerability. The thing that makes me hesitate to laud this feature, however, is the implementation. Apple has a lot of smart people working for them and a lot of old school UNIX geeks to whom secure programming is as natural as breathing. They also have a lot of coders and managers who realize that OS X is not a primarily security minded OS. Sure, it is better than Windows and on par with a desktop Linux distro, but it isn't a locked down OpenBSD install or a super secure Linux distro. They don't focus their efforts on security and it shows sometimes when they introduce new code. LaunchD replaces a number of time tested bits of code and while it is (IMHO) a much cleaner, nicer design I haven't a clue about how well written and tested it is, especially from a security perspective. I'd feel a lot better about claiming it as a security feature if I knew some white hats had pounded on it for a while and exposed anything Apple did not bother to think of. I'd feel a lot better if the OSS community in general jumped on it and adopted it, thus helping with this security testing and adding more eyes.
I like LaunchD. I like OS X as a desktop. Lets just not get carried away here with random claims about security. OS X is inherently more secure than Windows, but that really isn't saying a lot. I'm not willing to just assume LaunchD is secure in and of itself, let alone that it will play a big part in securing the OS as a whole.
being offered as a "reason why OS X is more secure than Windows."
The article claims that Administrator on Windows is equivalent to root; and that SYSTEM is more powerful than Administrator (and by implication more powerful than root). This is nonsense.
Administrator is indeed less powerful than SYSTEM. However, Administrator is equivalent to a user on the sudoers list and/or with group write access to system directories. SYSTEM is the correct equivalent to root.
We may quibble about how well Administrator accounts are protected from trojans; or whether non-Administrator accounts on Windows are of much use; those are valid arguments. However, claiming that, somehow, SYSTEM on Windows is magically more capable than root is ridiculous.
If anything, Windows has a somewhat better design in that it is possible to set up privileged accounts with a specific power that only root has on UNIX, yet not have any of the other root powers. However, this capability is quite underutilized, and in many ways is undermined by other (unfortunate) decisions that Microsoft made.
--- What?
"...it always traces back to Microsoft's untenable policy of maintaining gaps in Windows security to avoid competing with 3rd party vendors and certified partners."
Since when has this been a "policy"?
With the DOD recommending that folks update their Windows PC's in the interest of National security, I don't think the same Government would launch an anti-trust campaign against Microsoft for including security tools in-the-box. If that were the case, Windows Vista with its built-in anti virus/anti-phishing/anti-spam/encryption/backup and a slew of other tools would be in real trouble and would ship late...
Oh wait...
In any case, I reckon the reason MS did not do security work until recently was simple economics. Folks bought the software anyway, so there was no incentive to spend up to 20% more on engineering costs with little return on investment. As security becomes a more mainstream topic, consumers and businesses are taking notice. Many corporations, including Microsoft, realize that there is money to be made in security.
As long as corporations confuse interoperability with "windows compatibility" the scam will go on. Only when the commercial user who forks over billions of dollars to MS every year demand true interoperability and injects real competition, it will end. There is no advantage in being the first among the users pushing for it. Pepsi will not care as long as Coke is also spending relatively the same amount of money for similar services. But someday somewhere some corp will bite the bullet and spend what it takes to break the vendor-lock in, and only after that the security situation will improve.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
.mac comes with a subscription to virex.
------- Oh damn.... the Sigfile escaped... -Great OM
to be honest I would go after OS X. Why? Because no one else is. Those who get known are those who, "think different."
Self proclaimed wannabe geek. You know how it is. Most of us who read this stuff probably fit in that category.
maintaining gaps in Windows security to avoid competing with 3rd party vendors
Whoever dreamed up this rationalization is gifted.
The holes are there by design. As in security wasn't a part of the overall design. I would argue that it still isn't.
Like all the versions that have come before, "It's more secure" for about a week after launch and then I'm back to cleaning out infected PC's. This works out great for me because it's my job. Personally, the people that take my advice to switch -always- thank me later for making a switch.
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
offsite safe storage through .Mac
dot Mac is not in any way secure / "safe storage". Unfortunately I bought a subscription before I realised how dangerously unsecure it is. When I started to configure Backup, I thought I'd do some digging first to see what was going on. It turns out that credentials are sent in plaintext. Communication between the user and mac.com is not encrypted. Storage on iDrive is also not encrypted. Backup archives have no encryption.
It's completely wide-open to snooping attacks, and nobody should trust anything to it besides their weekly grocery list or other documents that they don't mind any snoopers (wireless interceptors or Apple employees) from freely browsing. I expect a major security breach is inevitable.. it's just a matter of time. It would take one person with a wireless snooper at Macworld, gathering hundreds of juicy high-profile targets to mess with - and dot Mac will be destroyed by a torrent of negative publicity.
Of the entire Apple product range, dot Mac is the one that is most stuck in the early 90's. It works.. but is a severely inadequate solution.
Mac OS X's Dock is not meant to be a task manager: it's mean to be a collection of one-click shortcuts to your most commonly used applications, folders, and documents. That it also shows running applications to also easily switch between them is just a bonus, and does not make it into a task manager. If you want to see a list of running threads and processes, (force) quit processes, and graphs of CPU, Memory, and Disk usage, as well as Disk and Network activity, use Activity Monitor (/Applications/Utilities). It's all about the right tool for the right job.
You're dead-on with the performance issues of XNU, though.
I felt a great disturbance in the force, as if millions of spelling nazis and grammar nazis suddenly cried out in terror...
> Good artical
> realtivly
> the point is mute
> equaly
> becaomes
> less then
> secruity
- For the complete works of Shakespeare: cat
If OSX had that kind of a market share, youd bet your ass that everyone would be breaking down its walls, in exactly the same way.
Most people keep their money in their mattress. If most people had home safes, everyone would be breaking into safes and taking their money in exactly the same way.
Do you see how this analogy exposes the flaw in your logic? To show a classic example, IIS has a much smaller market share than Apache, but is compromised more often. If OS X had an equal market share as Windows, OS X would still be compromised less often for the following reasons:
Would you rather it effect Apples measly market share, or Microsofts dominant machine?
It depends upon my motivation. Ideally, it would run on both. The thing is, there is plenty of motivation for crackers to write malware for OS X, simply to gain publicity and respect in the community or to shut up smug mac users. It hasn't happened yet because there are a lot of barriers besides market share.
Most mac users are just as dumb as most windows users, they just tend to have some sort of superiority complex.
I'm not sure this is true. There are plenty of dumb users on both systems, but a lot of the security industry has moved to macs, providing a greater likelihood a mac malware will end up on the machine of someone with a clue. More importantly, however, mac users can be dumb, and because they have a more secure system by default, they are still not exploited as often.
neither is really better than the other, from a sheer 'does this work' standpoint.
I strongly disagree as do most users I know that have actually run OS X and Windows as their regular machine. From both a security perspective and a general use perspective, OS X is a more usable desktop machine for most people. Just because OS X is not perfect for security, does not mean it is as bad as the abysmal mess that is a standard Windows installation.
Apparently this guy had the experience switching from Mac -> Windows and see what happens. A lot of people say it has to do with market penetration (Thanks to the M$ FUD) but nothing is less true. There are far more hosts running on any flavor of Unix or using the GNU tools or somewhat compatible tools for that matter than Windows hosts connected to the Internet.
The biggest flaw in Windows is stuff running as SYSTEM. Try this in Windows: schedule a command in a terminal to run cmd.exe the next minute using the "at" command. As you will notice, you will get your cmd.exe... running as SYSTEM. You don't even have to be a very privileged user to do that, kill your own explorer.exe and start explorer.exe in that cmd.exe you have and guess what: you're running your system as SYSTEM. This would be like running Bash, KDE or Gnome as root, although possible, you can't elevate root out of standard user rights. Same thing for hooks into IIS (.NET) or any other application, they can all elevate to SYSTEM without too much trouble. Would be like suggesting to run Bind or Apache as root, and as any Unix guru would say: Blasphemy! Blasphemy! and you would feel the vibration of Rich Stevens (http://en.wikipedia.org/wiki/W._Richard_Stevens) spinning in his grave at the speed of the fan running in the server.
Custom electronics and digital signage for your business: www.evcircuits.com
Some of the criticisms in the article are perfectly valid, but many of them are (supposedly) going to be fixed in Windows 95 (whenever that gets out..) Is that out yet?
Some of the criticisms in the article are perfectly valid, but many of them are (supposedly) going to be fixed in Windows 98 (whenever that gets out..) Is that out yet?
Some of the criticisms in the article are perfectly valid, but many of them are (supposedly) going to be fixed in Windows 2000 (whenever that gets out..) Is that out yet?
Some of the criticisms in the article are perfectly valid, but many of them are (supposedly) going to be fixed in Windows ME (whenever that gets out..) Is that out yet?
Some of the criticisms in the article are perfectly valid, but many of them are (supposedly) going to be fixed in Windows XP (whenever that gets out..) Is that out yet?
Sorry to be redundant, have you heard this joke before already?
I only look human.
My mother is a halfling and my dad is an ogre, so that makes me an Ogreling
[From the article]
SYSTEM doesn't trump Administrator(s): since either can control the kernel, they both represent full control. SYSTEM can't magically bypass security descriptors any more than administrators can; both have but indirect end runs available. SYSTEM's profile has the global system environment. In Win32, shells have considerably less importance, but SYSTEM processes can still have them. SYSTEM's actions can certainly be audited, so I'm not sure what they meant by impossible to log.
There are lots of services running as low privilege LOCAL SERVICE and NETWORK SERVICE. Perhaps there could be more. Note that a single svchost can represent several services.
The binaries that implement system services are protected by system file protection. SFP isn't a security feature; it's there to work around buggy installer behavior.
This isn't true on a domain where the admin has designated installable packages, and RunAs works fine for installation programs that are written properly.
I'm not sure what's meant by this, but if your kernel is owned on any OS, a rootkit can be installed to evade any kind of debugging.
Non-human-readable? Never used the registry editor? The key and value names seem to be in English... It's like saying that a filesystem isn't human-readable because you need ls. There are no plans to make the registry obsolete for system configuration. In fact, the new boot loader's config database is a registry hive. As for owning the computer throught the registry, every key is protected by an ACL. There's nothing inherant in the registry that allows an attack, privilege escilation or otherwise.
So then the admin takes ownership of the keys in question, forcibly with the SeTakeOwnershipPrivilege, and since the owner of an object can always set the DACL, the admin returns himself full control. Either that or use the SeRestorePrivilege to overwrite the key directly.
What's wrong with the shell's ACL editor? What's wrong with the default permissions?
Since root can ignore security, this isn't saying anything. In Windows, only the kernel can bypasss security.
What I thought was interesting in the article was how many of his complaints were probably due not to bad design per se, but to poor practices -- things like documentation, structural transparency, consistent use of system policies, etc.
What struck me is that there are definitely seeming flaws in Windows that make it insecure as-is, but that it doesn't have to be this way; Microsoft has chosen and continues to choose to operate in such a way that exacerbates rather than minimizes the effect of many of the inherent weaknesses of the platform. A similarly designed system, managed and documented differently, would probably be less problematic.
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
There are PLENTY of hackers out there, of every level, who would absolutely love to be able to point to themselves as the first "l33t hax0r" to write a real world OS X virus and "wipe that stupid little grin off their [Mac user's] smug little faces."
And in the six years OS X has been out, not one, NOT ONE, has succeeded.
...if Windows were designed securely in the first place. This isn't a troll, just an observation.
In a sense everyone is trying to argue that Microsoft can't include additional security tools because they'd be accused of leveraging their monopoly. The enitire antivirus industry likely wouldn't exist, and this would be a moot point, if Windows were designed securely from the start.
What we seem to have now is pressure on Microsoft not to make things *too* much better because they would wipe out a lucrative business niche occupied by third parties. Microsoft is a slave to backwards compatibility, so they won't scrap everything and start from scratch. But they can't win because if they offer an antivirus solution they're leveraging their monopoly unfairly. Or they're an extortionist because they failed to secure Windows properly, but are getting more money from customers by forcing them to purchase their anti-malware solution.
OSX is better than Windows in terms of security. But Microsoft only have themselves to blame. They should break with backwards compatibility, buy themselves and Linux distro and layer the Windows GUI and APIs on top of it. Do it right and their security problems will be a thing of the past.
Windows systems have been, are, and probably will be getting hacked - a lot - on all levels in the forseeable future, they talk up security but there is still the current (well publicized) vulnerabilities.
Other systems (Mac/Linux) aren't having such major issues - they tout security, and are blasted because 'they are obscure'. There is a lot of 'talk' of possible vulnerabilities, and there are speculations there may be vulnerabilities. But they are STILL more secure now and have a good track record.
What part of this would make me trust Windows more?"Enjoy what you're doing! If it becomes drudgery, you're doing it wrong!" - Jim Butterfield
I'm just wondering if anyone has ever built a firewall device from a Windows box. When I search for "windows firewall" all I get are references to the application that runs on windows, not any kind of firewall device.
You could build (and Linksys, SMC, DLink etc have built) a firewall device from Linux, *BSD, maybe OSX of which I have no experience, but who could or would build a firewall device from Windows?
Would you really have to be off your gourd to trust one?
Once I was a four stone apology. Now I am two separate gorillas.
Your argument can be easily demonstrated to be false. In particular: Apache is currently (and has been for a while) the most popular web server on the market. It has something approaching 70-80% market share. However it does not suffer from 70-80% of the vulnerabilities and exploits that are out there. What web server *does* suffer from 70-80% of the exploits? Microsoft IIS. For some reason, it's more exploited despite having significantly less market share. Thus: arguing that Microsoft's problem is simply one of exposure is a totally bogus argument.
Mac is not dramatically more secure through launchd...
It is simple really. Six years into OS X, growing market share, and no viruses in the wild.
First principle. No ports open by default. Macs ship with a closed box. Plug it into the Internet, wait, and your machine will never get infected simply because it is not listening on any port, and no attacker has any foothold to get into the box. Over the years Windows has shipped with a wide variety of open ports, whether they be for netbios, smbd, messenger, IIS (on NT), or others. Many of these have been launching pads for viruses and worms.
Second principle. Design the OS from the ground up to support privilege descalation. That is, make it so that every action on the machine is executed with User privileges or less, unless you really need more privilege. Launchd is a part of this. On Windows, you still have ActiveX with escalatable privilege, and people get infected from web surfing or opening email.
That is really all it takes. Make it so a user cannot compromise the OS trivially, and there are no open ports, and you made a box as secure as a Mac. Once you start opening ports, you need to know what you are doing or you will be 0wn3d by some script kiddy. Make it secure by default, and force the user to take positive action to do anything that is a potential security problem (like installing executables from random places on the internet).
Interesting read. I agree with most of his points, with comments on the following:
Microsoft does not sign or document the name and purpose of the files it places in SYSTEM32
Most, if not all of the files can be identified through a simple Google search. It doesn't get Microsoft off the hook -- they should provide proper documentation, but such information is available.
Windows requires that users log in with administrative privileges to install software, which causes many to use privileged accounts for day-to-day usage.
Not all software. User-level installations should be possibly to non-restricted directories.
Windows requires extraordinary effort to extract the path to, and the files and TCP/UDP ports opened by, running services, and to certify that they are valid.
TCPView. Now you have it. And since Microsoft now owns Sysinternals, I guess they have it too.
Malicious code or data can be concealed in NTFS files' secondary streams. These are similar to HFS forks, but so few would think to look at these.
This is not really Microsoft's problem. If no one can remember the features of the OS, it's their fault when they overlook them.
Apple's daemons have man pages, and third parties are duty-bound to provide the same. Admins also expect to be able to run daemons, with verbose reporting, in a shell for testing.
Duty-bound? Sure, they probably all provide them because that's what everyone else does, but most Windows applications include a help file too.
Launchd can tripwire directories so that if they're altered unexpectedly, launchd triggers a response.
I believe TripWire exists for Windows too.
The UNIX/POSIX API, standard command-line tools and open source tools leave malware unable to hide from a competent OS X administrator. It takes a new UNIX programmer longer to choose an editor than it does to write a console app that walks the process tree listing privileged processes. Finding the owners of open TCP/UDP ports or open files is similarly trivial. The "system" is not opaque.
I may be wrong here, but aren't their other ways of injecting malware into a system than setting it up as a detectable process? I know on Windows machines there are a number of ways to get around a process walk -- does the same thing exist in *nix?
Wer mit Ungeheuern kämpft, mag zusehn, dass er nicht dabei zum Ungeheuer wird. --Nietzsche
It is not that hard to argue for OSX security over Windows security due to the track-records, but this article is total crap. A few of the points:
With all that said I can easily see people going to OSX to improve security, that does not make that article anything but deeply flawed however.
On the other hand, OS X doesn't have all the legacy cruft of ye olde unix. I think one of the main strengths of Apple systems is that they do a clean start every now and then. Quite contrary to the Windows style of supporting everything since the DOS days.
Personally I prefer Linux for the sheer amount of control. But the Apple way might have some benefits compared to more traditional unices. In any case I believe it's much more secure and sane than any Windows. I've recently convinced a friend to get a Macbook, since it's pretty much the only way to get a real OS preinstalled.
Escher was the first MC and Giger invented the HR department.
"The default in Windows is now to have no open ports as well due to the Firewall,"
The Windows Firewall is worthless, and does very little against any kind of attack. See the results of http://www.firewallleaktester.com/. The windows firewall in reality is more "security blanket" than Security. The point of many complaints that you wil see here is that there are so many backdoors to the core components of MS operating systems that security is a nightmare. Personally I agree with your analysis of the state of anti-malware. I just think that there is too much financial incentive for a completely secure end-user OS to not be designed. Just my cynicism speaking.
I'm a happy pessimist. I expect and prepare for the worst, when it doesn't happen I am pleasantly surprised.
Getting extra mod points these days. Rather than informing themselves by actually reading the specifications and informing themselves on the issue at hand, they mod real problems down, preventing other users from the opportunity to inform themselves as well.
I thought that this was news for nerds, and stuff that matters. Well, if it doesn't matter that there are no protections in place for owners of TPM enabled equipment to Slashdot, I guess they're already cashing their cheques from Apple. In light of the consistent pro-Apple slant to this site, I will refrain from recommending this site to new tech-people as one of the 'go-to' sites for stuff that matters.
Frankly I'm disgusted by your incredulity, as any self-respecting tech would first inform themselves as to the issue, and then make their decision, rather than mod down a story that is a) on topic (if we're actually discussing Windows v. Apple security) b) relevant as software runs on hardware c) not an attempt to troll for (un)favourable responses, but rather an attempt to elucidate a very clear and present issue facing computer users today.
In closing, to whoever modded me down: 'Bite Me Fanboy' to quote the Main Man.
if I claimed I was emperor just because some watery tart lobbed a scimitar at me they'd put me away!
I find your excuse of legacy software annoying.
The subject line is a short summary of the solution that Microsoft should have implemented a long time ago---to implement a union of file systems so some files are drawn from a read-only file systems and others from a read-write file system.
See http://en.wikipedia.org/wiki/UnionFS.
Basically, the program folder has only read access to users, but unionfs of the program folder and a user folder in "Documents and Settings" would allow each user to modify content of that program folder independently. Users do not see each other's changes, and the main copy is left intact. You also don't need to be a privileged user to run that program.
Mac OS X also has it. See http://www.kernelthread.com/mac/osx/arch_fs.html.
I apologize in advance if Microsoft has already included that feature, but I would get even further irritated because there is absolutely no excuse now to make everyone administrators.
I once had a signature.
It's important to fully consider the virus model. There are two -completely separable- parts to an infection, regardless of whether it's computer or biological:
/., please stand up and take a bow!)
1. there has to be a vulnerability
2. there has to be a vector
Now market share has substantial impact on -vectors-, but has -no impact- on the core vulnerability. This is the point so many people miss when they claim that the only reason MacOS X is not infected is because of market share. This is not my original thought, but I'm very sorry I do not remember who first pointed this out to me. (If you read
For a long time (I don't know if this is still true), the Army corporate Intranet, Army Knowledge Online (AKO,) was run on top of a whole ton of Macs. This was after the Nth infection of their previous Win NT baseline, and the 3-star said "Fix it." It's my understanding from about 5 years ago from a friend who worked on that project that there were a few first-stage penetrations/DoS attacks, but NO (zero, nada, zilch) successful infections of the Macs, even when they were running WebStar on OS9, and then none when they moved to OS X. (He provided no details for security reasons, and I didn't ask. But having known this guy for 12 years at that point, I take him at his word.)
So to those who claim that "there's no reason for a hacker to infect a Mac-based system," I'd point to both the big-time hacker glory that people in that culture would get for screwing up www.us.army.mil, and to the much more serious impact of a deliberate cyber-attack (e.g. Al Queda, Hezbollah, Chinese espionage, etc - all of which I believe are documented as attacking US military web sites, and unfortunately with some success for sites other than AKO.) Most well-run websites can detect a penetration, even without a change to the home page.
Anyway, my point is that the lack of infections has to be attributed primarily to lack of vulnerability, and in evidence I offer the big headlines that come out whenever someone thinks they've found a vulnerability in OS X. But so far, to the best of my knowledge, there's been no successful infection "in the wild", and certainly NOTHING to resemble the Windoze viruses that seem to spread across the 'Net about every year or so. This canNOT be attributed only to "lack of market share".
dave
WebKit isn't Explorer. The Windows equivalent of the Finder, the Explorer, shares (many) DLLs with Internet Explorer; it even seems to share resources at run-time with it. The OSX Finder doesn't use WebKit (at least not up until now). The only thing you will damage by removing the WebKit framework is applications that use it to display HTML or provide other simple browsing functionality, not any system application. Under Windows though, you would take away the entire interface.