Apple Releases 31 Security Fixes

Agram writes, "This week Apple has released fixes for 31 vulnerabilities in its OS, although reportedly a number of known flaws remain un-addressed (according to the instigator of the Month of Kernel Bugs, 'Apple hasn't fixed any of the bugs published during [MoKB], except for the AirPort issue'). Earlier this year, in a move reminiscent of Microsoft's past patching faux pas, Apple released a 'fix' the installation of which broke features unrelated to the targeted flaw. With the growing number of low-level flaws, one has to wonder if Apple's 'more secure' argument still stands. Earlier this month, Microsoft released 6 fixes. Linux does not seem to fare much better. Despite all of these fixes, exploits remain in the wild for each platform. Perhaps, security-wise, the OS choice really boils down to a 'pick-your-poison X user-base' equation?"

Comments

Attacks Still Low

[wiz31337]

Apple has known security bugs and yet people still focus on killing Windows boxes. I'd like to know Apple's secret.

Re:Attacks Still Low

[glhturbo]

It's no secret ... There are more Windows boxes in sensitive areas (servers, etc.) than Macs. Focusing on Windows is more bang-for-the-buck....

Re:Attacks Still Low

[Anonymous Coward]

Apple has known security bugs and yet people still focus on killing Windows boxes. I'd like to know Apple's secret.

It's simple, they charge so much money for their machines that the end consumer doesn't have any money left. No point in infecting and hacking the boxes of people who don't have any money!

Re:Attacks Still Low

[NixieBunny]

Perhaps Steve Jobs doesn't invoke the same "I'm gonna get him!" feeling in the black hats that Bill Gates does. Or maybe it's that darn reality distortion field...

Re:Attacks Still Low

[Lumpy]

That and it's far FAR easier to get admin access for your app or bug-exploit in a windows machine than any other OS based machine.

A script kiddie can completely take over a critical windows server. It's far harder to get your code executed as admin or with admin priviliges on a linux,unix,or OSX machine.

THAT is the biggest reason. Unixes run far more of the internet than windows does, making it a prime target for someone who wants to cause trouble or steal information.

Re:Attacks Still Low

[Thraxen]

Perhaps because Windows has a much larger market share and is thus a much bigger target? Maybe?

Re:Attacks Still Low

[EvilTwinSkippy]

I don't buy that argument.

Back in the dawn of the Internet, I was beating hackers out of my Linux boxes with a stick in the days when Sun, Microsoft, and IBM boxes outnumbered linux by an order of magnetude. Hackers go for soft targets with toys. Macs, with a full BSD system underneath, are just a juicy a target as anything else, and minted by the million would be taken 0wn3d given a smidgen of an oppertunity.

Re:Attacks Still Low

[femtoguy]

I think that it is pretty simple. It is not the number of security bugs that is the issue, it is their severity, and their remote exploitability. Despite the statistics from the article, my department (which has 500 computers, with a mix of windowsXP, OSX and Linux) has had not a single security breach of a Linux or OSX system, but lots of breaches of Windows systems. Part of it is that the OSX and Linux security problems are situations where a local user can escalate his priveledges, something which is serious, but does not necessarily cause security problems. The other part of it is that the worst WindowsXP security breaches come through ad- and spy-ware that come from routine web surfing. This is not considered a bug in WindowsXP (if we just classed ActiveX and IE as security problems, we would have to list that as a windowsXP bug every month/day/week, and the numbers would change pretty quickly).

Anyway, as we all know, don't trust statistics because 82.35% of statistics are made up on the spot.

Re:Attacks Still Low

[iamsolidsnk]

No, the reason is Admin (root) access and the ease of which a hacker can obtain it. As stated above, it is much easier to get this on Windows than on OS X. Any program files that might have a negative impact on the OS X system must be authorized with the Admin password.

Re:Attacks Still Low

[mu51c10rd]

One word...marketshare.

There is big money in hijacking windows boxes. You can pump spam through them or inundate them with advertisements through spyware. Considering that most users have Windows, there is more advertising money there. I think spammers and spyware people would rather have the number of windows users out there viewing their junk than the number of Apple users. However, expect that to change as Apple's marketshare grows.

Re:Attacks Still Low

[Anonymous Coward]

Any program files that might have a negative impact on the OS X system must be authorized with the Admin password.

Wrong. The attacker can simply use a privilege escalation exploit.

Re:Attacks Still Low

[OS24Ever]

I'm sorry but I don't agree with this marketshare thing.

If someone is standing on the corner going 'neener neener you can't hit me' someone out of spite regardless of any reward is going to do it. The fact that they've been touting they can't be hacked for several years now and they still haven't been hacked says to me that it's not easy to do/not able to be done as easily as it is on Windows.

Plus a lot of the 'security' problems don't focus on the exploits of IE and simple browsing hijacking your system with crap. That's the largest problem facing most IT departments that I've run across in the last year or two, not the OS itself being hacked but something stupid the browser does destroying the system.

Re:Attacks Still Low

[jellomizer]

Many of these security holes are often due to Buffer Overflow errors. While Common, they are rather difficult to exploit. Unlike the Active X, and VBScript "Viruses" and Spyware.... Buffer Overflow requires the designer of the script to know quite a lot about what is going on underneath. First they will need to know the platform they are attacking. With Macs you will have to choose between Intel and PPC. then you will need to know the OS, Version of OS X, and know it well enough to pass the opt-code in binary format. Ok Now you can run a program. Now if you need to do some more detail stuff that can cause more trouble then just screwing up the home user account then you will need to find an application who buffer overflow error will allow root level access where they can do important things like opening up low number ports 25 for Email, 22 with SSH and configuring it to allow no password for root.... Yes you could break into a Mac System. But if you fix any part in the link the script will not run to completion So one fix could stop one from taking control of the others (Until an other opening is found). So yes you can break into a Linux, BSD, OS X and Windows box. But with Windows attempt at Active X and their refusal to give programming restrictions to it. Figuring that having a Trust Security is better then preventing access (the OLD Java vs. Active X Debate) Really bit MS in the the Butt.

Re:Attacks Still Low

[kestasjk]

A script kiddie can completely take over a critical windows server.

Did you read about the security vulnerabilities? They're practically all privilege escalation! Remember root-my-mac-mini? The script kiddie that breached OS X was probably using one of these vulnerabilities then, six months ago.

THAT is the biggest reason. Unixes run far more of the internet than windows does, making it a prime target for someone who wants to cause trouble or steal information.

Your argument seems to be that OS X runs on loads of servers, which makes it a great target.. First off it doesn't run on loads of servers, it has no presence in the server market. Second the vulnerabilities are mostly all in WiFi drivers, PPPoE code, and Safari. Why would hackers going after servers be looking in client code?

Also you can only apply the fixes to 10.3 and 10.4. Never mind <10.3 users, they can pay $99 for security, and never mind if they have a machine which won't run 10.3, they can buy a new Mac. This is like MS charging for SP1.

If MS came out with a massive load of critical security fixes like this, which had all been around for ages and in use by hackers, they would be quite rightly ridiculed. When Apple comes out with this disgrace

• "You can't go by numbers of critical vulnerabilities alone, maybe MS patches loads they don't tell us about",
• "Mac OS X runs the internet, hackers are much more interested in breaking OS X than Windows, which no-one runs",
• "So what if OS X has had critical, unpatched vulnerabilities which hackers have been exploiting for months? At least OS X doesn't have spyware and viruses!"

I wish I was exaggerating but people really are posting these; it's bizarre the double standards some people on slashdot have.. We should at least like and dislike Apple and Microsoft for the right reasons, there are many reasons to prefer Apple but security just isn't one of them.

Re:Attacks Still Low

[nogginthenog]

Actually I would say it's your IT departments fault for not locking down Windows. There's nothing in OSX or Linux that will stop adware/spyware, but users generally do not run as root so damaged is limited.

If you're letting your Windows users run as local administrators with with rights to execute any old ActiveX code you're asking for trouble.

Re:Attacks Still Low

[johnpaul191]

it seems like the big windows things that spread to everyday users require a MS Windows machine to send itself to another MS Windows machine (vie email app or something). a Mac or *nix box will break the chain. in theory even a critical Mac attack might require a Mac-Mac transmission, right? it might spread around a group of graphic designers or something, but that may be where the Mac minority REALLY helps keep the machines safe.

i'm not talking about things that infect servers or corporate/edu networks, but the things that CNN reports because it will hit joe 6-pack home users. that's what would probably have an effect on what a home user would think about when buying a new machine.

Re:Attacks Still Low

[1u3hr]

So what if OS X has had critical, unpatched vulnerabilities which hackers have been exploiting for months?

Really? Have hackers been exploiting Mac vulnerabilities for months? Have any of these gone beyond proof-of-concept, if that?

Re:Attacks Still Low

[Old Thrashbarg]

Your argument seems to be that OS X runs on loads of servers, which makes it a great target..

Er, no, his argument was that Unix runs on lots of servers, not OSX.

First off it doesn't run on loads of servers, it has no presence in the server market.

Wow, in that case I'm gonna have to cut down on the coffee because I'm having powerful hallucinations every time I walk into my server room...

Re:Attacks Still Low

[Lumpy]

Hello? where EXACTLY did I say that OSX runs on loads of servers?

Re:Attacks Still Low

[cyber-dragon.net]

I must be halucinating one of our racks too... odd... maybe some sort of mass apple inducsed hysteria? Oh and that article I read about the whole company runs on OSX server racks.

Re:Attacks Still Low

[RAMMS EIN]

``A script kiddie can completely take over a critical windows server. It's far harder to get your code executed as admin or with admin priviliges on a linux,unix,or OSX machine.''

Yes, because buffer overflows are so much harder to exploit on non-Windows OSes, and it's so much harder to get someone to type "sudo make install" than to get them to do the equivalent on Windows.

Re:Attacks Still Low

[krakelohm]

I know the article is specific about OS X, but you took the parents comments about Unixes in general to speak of OS X. He never mentions that OS X runs on a bunch of servers, just Unix and its flavors including OS X. Also yes, Apple does have a presence in the server market, http://www.apple.com/server/macosx/ & http://www.apple.com/xserve/.
On to the ">10.3" section of your comments. Yes the security updates will not work on 10.2 or earlier. That is two complete versions ago. When is the last NT4 security update you saw? Thats two versions ago of the Windows Server market right (2003,2000, NT4). Apple is known for having a quicker turn around for complete updates, this is not news.

I could go on but I will stop there, its obvious that you favor Windows over anything else, which hey thats fine, your prerogative, your a grown adult, do whatcha wanna do. But lets keep it real.

Re:Attacks Still Low

[Falco Danderfluff]

Exactly... Go to http://store.apple.com./ Notice that WebObjects/AppleStore.woa gibberish in your address bar? Without say.... Mac OS X Server and XServe, that store, well it just wouldn't be there.

Re:Attacks Still Low

[kestasjk]

THAT is the biggest reason [for all of these OS X holes]. Unixes run far more of the internet than windows does, making it a prime target for someone who wants to cause trouble or steal information.

If you're not including OS X as a UNIX then what point were you trying to make?

Re:Attacks Still Low

[WaRrK]

I remember root-my-mac-mini - the whole thing was a sham - the guy was giving out SSH accounts to the machine and the "local" user was just using a privilege escalation to get more rights. Granted, its a bug that needs fixing - but giving out logins to anonymous users on the internet isn't something I'm in the habit of.... not after last time..... damn squirrels.....

Re:Attacks Still Low

[Anonymous Coward]

Wow, in that case I'm gonna have to cut down on the coffee because I'm having powerful hallucinations every time I walk into my server room...

No that is the normal effect of seeing Servers that look like they should instead of looking like cheap chunks of ugly plastic.

Re:Attacks Still Low

[Anonymous Coward]

Yes it is.

if you click on a evil exe in windows it runs and does it's deed. do it in OSX or linux and you have to give it an administrator password.

99% of all windows users run as admin. 100% of all windows server administrators log in with a admin level account and do lots of things as admin they they should not.

So yes, it is way WAY easier to get someone to click on something evil and have it run instantly then have them type sudo evilapp..... type in password... then execute. at least the password is a hint to someone that the potential of evil is there. way too many windows apps, including server apps require admin privileges to run. This is rampant in the Corporate world as most vertical apps are so badly written that they do this by default. Add to that that most machines all share the same admin password and BOOM you have a massive infection running rampant easily. you want proof of this? Spyware is rampant everywhere on every windows machine you touch. EVEN corporate machines with well defined policies STILL GET INFECTED SILENTLY.

At least under unix you have to gain those privileges at each machine, they are not handed to you on a silver platter if you compromise one machine only. (yes this is an IT policy blunder and not a Windows blunder, but it's the modus operandi of the Corporate windows world.)

Windows is a security joke because they do not make it difficult to run as administrator all the time and allows apps to have free reign if they are executed as admin. NO APP NEEDS WRITE ACCESS TO THE C:/WINDOWS directory... NONE! yet the microsoft morons designed it that way because of the stupid registry. windows 95 and 98 did more damage to windows security than anything else and the crap added there still lingers.

That is why windows has no security compared to unix.

Let's ignore the fact that most services under Unix lately do not run at the system level but under a protected user that does not have ADMIN access... but hey you were hoping that nobody noticed that.

Windows web server, buffer overflow = admin access. Linux web server, buffer overflow = user acces. Big different there. granted if you are silly and let apache user read the shadow passwords file your fault for not setting up security right.

Re:Attacks Still Low

[Anonymous Coward]

>>Also you can only apply the fixes to 10.3 and 10.4. Never mind 10.3 users, they can pay $99 for security, and never mind if they have a machine which won't run 10.3, they can buy a new Mac. This is like MS charging for SP1.

10.2 is fairly old, and 10.3 only requires a machine with built-in Firewire so all of the machines that can't run it are considered obsolete and are no longer supported by Apple anyway- you can't get parts or support, and the serial numbers are no longer even in GCRM (Apple's internal support database.)

Apple is about to release 10.5, the THIRD major release since 10.2. Anyone using 10.2 needs to upgrade anyway. Or were YOU going to pay the development costs for the 10.2 users out there?

Re:Attacks Still Low

[nurb432]

1 - the windows exploits are easier to do
2 - the results of exploitation is more damaging
3 - there are more windows machines out there so you can effect more machines with less effort.

Re:Attacks Still Low

[IamTheRealMike]

What makes you think they haven't been hacked? I've seen some quite impressive hacks of MacOS X including a very trivial piece of code that dumps every encrypted form submission from Safari (by sucking it out of the app before encrypted). When people say "my Macs don't get hacked" they mean "they don't get automatically hacked on a large detectable scale". That's completely different to "there is no exploit code out there", which is what you are implying.

Re:Attacks Still Low

[wiz31337]

Someone didn't get the joke...

Re:Attacks Still Low

[Germik]

OSX doesn't even let you run as root without first enabling the account, setting a password, and then logging in through the shell. Basically, you don't just login as root automatically like you do admin on a windows box. That's a big difference.

Re:Attacks Still Low

[DeadboltX]

Pretend that you're driving down the street throwing water balloons at people on the sidewalk. You are doing this because you have a store at the end of the street that advertises selling dry shirts. You're coming up to a spot where there is 1 person on the left side of the road and a group of 10 people on the right side of the road. Your goal is to get as many people wet as possible; which target do you throw your water balloon at?

Exploiting vulnerabilities is becoming less pure malicious intent (hitting someone because they say neener neener) and more about financial benefit. This has been made obvious by various previous articles pointing out the moving trend of exploits.

Sure there may be a few people who will try to exploit a Mac just for the sake of it, but a few people isn't enough. Obviously I'm going to pull this next statistic out of my ass but lets say that 3% of the people who actively attempt to find and exploit a vulnerability actually succeed (probably a generous number). 3% of a few is far less than 3% of a lot.

Re:Attacks Still Low

[noSignal]

Exactly. Most malicious users aren't concerned with how cool it is to have created something that affects a very small fraction of machines. Those who are have done so and gotten their recognition. It all comes down to utility, which is directly related to marketshare. Why have 6 mac bots just because they're cool when you could have 600 Windows bots that you could actually do something with?

Re:Attacks Still Low

[dave562]

99% of all windows users run as admin. 100% of all windows server administrators log in with a admin level account and do lots of things as admin they they should not.

So yes, it is way WAY easier to get someone to click on something evil and have it run instantly then ...

WTF are you talking about? What fantasy world are you living in? When I log onto a server I am doing it to perform a specific task. I know my servers like I know the back of my hand. If some random box pops up asking me to run some code I'm going to tell it NO and then break out some tools to figure out where the hell it came from and what it is doing on my server. In over ten years of taking care of networks for small and medium sized businesses, I have only ever seen one SERVER box owned, ever. It was in 2003, it was an NT4 box (fully patched, hahahahaaaa, like that meant anything) and AGAINST MY RECOMMENDATIONS, the client installed a wireless router and failed to secure it properly (because they had the inhouse, part time computer know it all do it instead of paying me). The box blue screened, I brought it up, saw all sorts of stuff that shouldn't have been there, told the client "I told you so." and then sold them a new Windows 2003 server (they needed to upgrade anyway).

It just makes me so mad, and makes me rant like this every time I read some jack hole on /. spreading FUD about Windows boxes getting owned all over the place. Boxes get owned because admins are failing to do their jobs properly. If you understand computer security, you know that nothing is 100% secure. You stay on top of the trends, you put safeguards in place, and you establish procedures to mitigate downtime. Because no matter what OS you are running, you will have downtime. I think that when you STEP INTO REALITY, you will find that the time required to do a bare metal restore on a Windows box isn't all that significantly different from the time required to do the same thing to a Linux box.

Re:Attacks Still Low

[TheRaven64]

Or, more importantly, the cracker is more likely to have a Windows box kicking around to practice on. A Linux box is also likely. A PowerPC Mac, however, was not. With the Intel switch, it is possible for a cracker to install a pirate copy of OS X in a VM or on a spare machine and do whatever they like to it, so this level of 'protection' goes away. It will be interesting to see what effect this has.

Re:Attacks Still Low

[dave562]

If someone is standing on the corner going 'neener neener you can't hit me' someone out of spite regardless of any reward is going to do it. The fact that they've been touting they can't be hacked for several years now and they still haven't been hacked says to me that it's not easy to do/not able to be done as easily as it is on Windows.

What you haven't realized is that it has a lot to do with marketshare. The fact of the matter is that for the longest time Apples were running Motorola and IBM processors. When you compare the number of people who can write malicious assembly code for one of those processors to the number who can write similar code for an x86 processor, you will notice that there are significantly more people with x86 coding experience. Apple had obscurity working for them... kind of like Novell. You never really saw many Novell boxes getting owned over the Internet because they were running IPX and needed an IPX to IP router like BorderManager that required a lot of configuration. People have been writing x86 virii for a LONG time. Now that Apple is running Intel hardware, it is only a matter of time before you start seeing some gnarly exploits coming out.

In other words, now that Apple has joined the rest of the market, they are exposed to the same liabilities as the rest of the market.

Re:Attacks Still Low

[Steppman2]

Really? Have hackers been exploiting Mac vulnerabilities for months? Have any of these gone beyond proof-of-concept, if that?

Well he DID link to it in his comments...
http://www.zdnet.com.au/news/security/soa/Mac_OS_X _hacked_under_30_minutes/0,130061744,139241748,00. htm

Re:Attacks Still Low

[trianglman]

A script kiddie can completely take over a critical windows server. It's far harder to get your code executed as admin or with admin priviliges on a linux,unix,or OSX machine.

THAT is the biggest reason [Windows is targeted].

If you read the poster's whole comment you would have caught that.

Re:Attacks Still Low

[Steppman2]

On to the ">10.3" section of your comments. Yes the security updates will not work on 10.2 or earlier. That is two complete versions ago. When is the last NT4 security update you saw?

Mac OS X v10.1.0 (build 5G64), released September 25, 2001 (retail)
Mac OS X v10.2.0 (build 6C115), released August 23, 2002 (retail)
Mac OS X v10.3.0 (build 7B85), released 24 October 2003 (retail)
Mac OS X v10.4.0 (build 8A428), released April 29, 2005 (retail)
Mac OS X v10.5.0 (build 9A303), Developer Preview, released November 9, 2006 (beta)
--
Windows NT 4.0 Released July 29, 1996
Windows 2000 Released February 17, 2000
Windows XP Released October 25, 2001
Windows Server 2003 Released April 24, 2003
--

It's more like Microsoft not supporting Windows 2003 than Windows NT...Apple is squeezing every last drop of money out of its users. Extended support for Windows 2000 ends 7/13/2010...just because Apple patches faster doesn't mean they should screw you out of updates once the latest and greatest comes out.

Re:Attacks Still Low

[Anonymous Coward]

If someone is standing on the corner going 'neener neener you can't hit me' someone out of spite regardless of any reward is going to do it. The fact that they've been touting they can't be hacked for several years now and they still haven't been hacked says to me that it's not easy to do/not able to be done as easily as it is on Windows.

The problem is that spite isn't much of a motive compared to profit, and that's the primary driver of malware now.

I'd say that security through poverty might be a lot more effective than security through obscurity.

Re:Attacks Still Low

[Udo Schmitz]

Did you read about the security vulnerabilities? They're practically all privilege escalation!

Local or remote?

Re:Attacks Still Low

[drsmithy]

99% of all windows users run as admin. 100% of all windows server administrators log in with a admin level account and do lots of things as admin they they should not.

99% of the things malware wants to do, do not require elevated privileges.

NO APP NEEDS WRITE ACCESS TO THE C:/WINDOWS directory... NONE! yet the microsoft morons designed it that way because of the stupid registry.

Broken application that require write access to Windows system areas are 100% the fault of the app developer. It's got *nothing* to do with Microsoft.

No developer has had an excuse for releasing software that writes to places like C:\Windows for ca. 7 - 8 years.

Let's ignore the fact that most services under Unix lately do not run at the system level but under a protected user that does not have ADMIN access... but hey you were hoping that nobody noticed that.

Like modern Windows services do, you mean ?

Windows web server, buffer overflow = admin access. Linux web server, buffer overflow = user acces. Big different there. granted if you are silly and let apache user read the shadow passwords file your fault for not setting up security right.

IIS runs as its own user. A buffer overflow only nets you the privilege level of that user.

Re:Attacks Still Low

[Anonymous Coward]

does it matter? it is trivial to convince a user to run an executable.

Re:Attacks Still Low

[drsmithy]

Any program files that might have a negative impact on the OS X system must be authorized with the Admin password.

A binary running as the regular user can do pretty much everything it might possibly want to do.

Not to mention there's a 9/10 chance that just popping up an "Admin password" dialog box will result in the user blindly typing in their admin password, giving away root access.

Re:Attacks Still Low

[drsmithy]

Despite the statistics from the article, my department (which has 500 computers, with a mix of windowsXP, OSX and Linux) has had not a single security breach of a Linux or OSX system, but lots of breaches of Windows systems.

So how are these "breaches" occurring ? You firewall your machines, run users with reduced privileges and restrict IE usage, and if the machines allow people to run their own code, you have an active virus scanner running, right ? What's the vector ?

Re:Attacks Still Low

[drsmithy]

If someone is standing on the corner going 'neener neener you can't hit me' someone out of spite regardless of any reward is going to do it.

Of course. But if this happens in a bar with a brawl between 90 other people, do you think anyone is even going to notice that one guy got smacked ?

The fact that they've been touting they can't be hacked for several years now and they still haven't been hacked says to me that it's not easy to do/not able to be done as easily as it is on Windows.

They've been hacked numerous times. There have been several "proof of concept viruses" for OS X. The difference is none of them have even hit critical mass.

Plus a lot of the 'security' problems don't focus on the exploits of IE and simple browsing hijacking your system with crap. That's the largest problem facing most IT departments that I've run across in the last year or two, not the OS itself being hacked but something stupid the browser does destroying the system.

If the browser destroys the system, the person managing that system isn't doing their job properly.

Re:Attacks Still Low

[Anonymous Coward]

Despite the statistics from the article, my department (which has 500 computers, with a mix of windowsXP, OSX and Linux) has had not a single security breach of a Linux or OSX system, but lots of breaches of Windows systems.

Perhaps your department needs a new IT staff! No competent IT administrator should ever allow a Windows box to be breached. It's quite simple to secure a Windows box.

WindowsXP security breaches come through ad- and spy-ware that come from routine web surfing. This is not considered a bug in WindowsXP (if we just classed ActiveX and IE as security problems, we would have to list that as a windowsXP bug every month/day/week, and the numbers would change pretty quickly).

Seriously, your IT staff should be fired. If you don't give your users administrative rights, they can't install ActiveX components. It's quite simple.

Re:Attacks Still Low

[die444die]

Not only that but OS X 10.2 is a very different beast than 10.4 and even 10.3. On the surface most of it is similar, however with each major update much of the backend has been modified.

Re:Attacks Still Low

[1u3hr]

Well he DID link to it in his comments...

In that case "Participants were given local client access to the target computer and invited to try their luck." Which is a big leg up. No evidence of "hackers exploiting Mac vulnerabilities for months" in the real world.

Re:Attacks Still Low

[MojoStan]

Wish I had mod points. According to Apple's page of available updates for OS X 10.2, 10.2 (released August 23, 2002) got its last security update on December 12, 2004. So OS X 10.2, which was released 4.25 years ago, only got 2.3 years of security updates.

In contrast, "Pro" versions of Windows (e.g. 2000 and XP Pro) are guaranteed 10 years of security updates and "Home" versions get at least 5 years (XP Home gets 7+ years).

I don't understand why Apple doesn't get criticized for not having (AFAIK) an official support lifecycle policy. Red Hat gives 7 years of support for Enterprise Linux. Heck even free Ubuntu LTS (Long Term Support) versions get 5 years of support. Is Apple even trying to be taken seriously in the enterprise?

This bugs me because I thought 10.2 was Apple's first very good version of OS X. Many people who bought 10.2 or a Mac less than 4 years ago should be perfectly fine running 10.2, but they are forced to upgrade if they still want security updates and bug fixes.

Re:Attacks Still Low

[bursch-X]

Apache has 60% of the Webserver market IIS is at a measly 20%, who's 0wnd (or however the script kiddies spell that) more often? which of the two has got the bigger gaping security holes?

Fuck market share.

Re:Attacks Still Low

[bursch-X]

you don't need root, you just need sudo, and you don't need the root password for that, but just the admin's password. So if you have the admin user's password, you own the box.

It's just that trying to run anything as root (or trying to run any app the first time for that matter) will bring up some kind of dialogue to reconfirm you just want to do that, allowing your brains to switch on. After klicking the OK button it's all your fault ;-)

Re:Attacks Still Low

[laffer1]

In my last job, I had to support Mac OS 10.2 clients and servers. It was a nightmare as there is a severe problem with samba in OS X server which would easily cause a DOS attack on the box. I had to disable access to windows clients which were primarily IT and accounting employees. Apple has a terrible patch policy. I feel that they are a large enough company to release patches at least 2 versions back considering they like to do a release every 1-1.5 years. Imagine if Microsoft released a new vista every year. That would be a support nightmare. Of course Microsoft can't even get a start menu change done in a year...

Apple can develop great products, but they sure can't support them very long. Someone at apple needs to learn about maintaining software. Essentially you have to pay for security patches every two to three years. I end up running the latest OS release because safari and a few other things rarely see patches once its a version behind.

Before someone points out that apple is smaller than Microsoft, consider that smaller companies and groups maintain patches to their linux distros for far longer than Apple does with a commercial OS. I suppose some projects have worse policies... for instance FreeBSD EOL'd a bunch of stuff recently. I'm not in a position to back port patches when I get a few releases done with MidnightBSD yet since I don't have many developers. Apple does have developers.

Re:Attacks Still Low

[femtoguy]

My IT people are quite competent. We DeepFreeze every machine that we can, we lock down publicly acessible machines, we spend $1000s on virus scanning, patch servers, deep freeze accounts, we maintain a strong firewall, but users still find ways to mess up their machines. The biggest problem is that users insist that they need IE to look at their particular web site, and they need Outlook to deal with their outside colleagues. Once you have programs that go out and find security breaches running on your user's machines, it is just a matter of time. Our last major breach came because one of our faculty members got his machine infected through IE/ActiveX that was required for some site he wanted to go to, and the people who took it over used it to infect our web server.

In comparison we have 5 Linux servers, 20 Linux clients, 3 Mac servers, and 40 Mac clients, and NONE of them has ever been compromised, even though, we have no extra security past what comes standard with OS X.

That's the difference. We spend $1000s, use strong security, and still have breaches on every type of Windows machine that we run. We do nothing special for Linux and OS X, and nothing happens. My point is that the statistics about security are skewed because they don't count the major vectors for Windows security problems, because they are considered part of the operating system. If we reported IE and ActiveX as security problems (which they are) every month, windows' numbers would always be big.

Re:Attacks Still Low

[toddestan]

10.2 is fairly old, and 10.3 only requires a machine with built-in Firewire so all of the machines that can't run it are considered obsolete and are no longer supported by Apple anyway- you can't get parts or support, and the serial numbers are no longer even in GCRM (Apple's internal support database.)

Depends on how you define "fairly old". Windows 2000 is fairly old - it predates 10.2 by over 2 years, yet will continue to recieve security updates until 2010. Windows 98 is really old, and only got cut off this year.

Apple is about to release 10.5, the THIRD major release since 10.2. Anyone using 10.2 needs to upgrade anyway. Or were YOU going to pay the development costs for the 10.2 users out there?

You would think that with the large Apple tax that they have to pay just get a machine to run OSX, that the users have already paid for the support.

Re:Attacks Still Low

[mr100percent]

"There have been several "proof of concept viruses" for OS X"

No, there have only been trojans, nothing to infect machine to machine like a virus or worm. Please show me these virii you're discussing for OS X.

Re:Attacks Still Low

[bill_mcgonigle]

So, do you think 10.3.9 will get the old heave-ho come Spring (or whenever Leopard ships)?

I guess the problem really is we don't know.

Re:Attacks Still Low

[cbhacking]

A few points to consider:

• OS X has been hacked. There have been rootkits, worms, corrupted image exploits, and at least one spambot in the wild.
• OS X is completely subject to social engineering. Indeed, it may be MORE subject, since many Mac users incorrectly assume that they CANNOT get malware. That makes it much easier to convince people they ought to run the installer/enter password/click OK on that prompt.
• OS X is a MUCH rarer OS that Windows. In general, an exploit for one of them won't affect the other. Therefore, Mac malware has a far lower impact than Wondows malware because it is much more difficult to spread. For example, suppose a Mac ActionScript exploit gets into the wild. Even though it will probably execute on Windows machines (everybody runs Flash) differences in filesystem, user structure, etc. pretty much guarantees the worst it might do is crash the Windows machine. It probably won't really do whatever it is intended to do.
• Bear in mind that malware doens't neccessarily need root priveleges; tons of damage can be done from userspace. Things like spambots and such need nothing more, and userspace exploits can lead to root compromises. Consider a virus that adds itself to downloaded files (after hash check). You download a program from a safe source, don't bother to hash it yourself (basically nobody does), and install it, providing password when requested. Bang, you're rooted.
• OS X's browser isn't perfect either. There have been plenty of problems with Safari, and some of them were quite serious. Firefox is already starting to get exploited, and it only has ~15% usage (of which some very small portion is on Macs). Safari is, last I checked, well under 3%, but there have been at least two exploits for it.

Re:Attacks Still Low

[Walter Carver]

"No developer has had an excuse for releasing software that writes to places like C:\Windows for ca. 7 - 8 years."

True, but Microsoft should added the user profiles long before. Microsoft may not be responsible for what these developers choose to do, but having multiple users is a security-wise thing. Windows (and DOS) just wasn't designed with that in mind. Bill Gates was quoted saying "the Internet? we are not interested in that".

Re:Attacks Still Low

[ninjaman01]

so i am thinking about switching from mac to PC, I have read tons of reasons to use both systems but I am not sure with everything going around. Is apple really more secure than windows? Does windows really have better software? need some help

Re:Attacks Still Low

[kestasjk]

In that case "Participants were given local client access to the target computer and invited to try their luck." Which is a big leg up. No evidence of "hackers exploiting Mac vulnerabilities for months" in the real world.

I don't understand rm-my-mac-mini's most common refutation of "In the real world people aren't given the opportunity to execute code on your system, so why does it matter that if someone can execute any code on your system they can get complete access?"

• Shared hosts, for one, cannot use OS X because shared hosts can only be secure if each user can be effectively seperated. If any user can get admin access running a shared server is impossible.
• If there's a remote execution bug in Safari an attacker shouldn't be able to get very far with it. Perhaps delete or access some documents or passwords, or perhaps look for binaries and shortcuts which the user can write to. Nothing that can't be detected and undone.
  If an attacker can use the Safari remote execution bug coupled with the privilege escalation bug they can access system binaries, and the kernel. This is a much nastier problem; an attacker's code can remain hidden in the kernel for a long time and you can have no way of knowing it. Your Mac is completely at their disposal if they can use a privilege escalation bug together with a remote execution vulnerability.
  "Local" privilege escalation vulnerabilities turn otherwise relatively harmless remote code execution vulnerabilities (which could only execute under an unprivileged user account) into critical remote-root vulnerabilities.

Re:Attacks Still Low

[1u3hr]

I don't understand rm-my-mac-mini's most common refutation of "In the real world people aren't given the opportunity to execute code on your system, so why does it matter

Who says it doesn't matter? But it does mean that the common state of home or SOHO users with one Mac connected to the Internet aren't vulnerable to this.

Re:Attacks Still Low

[kestasjk]

The point I made in my previous post, which you seem to have ignored, is that this vulnerability, coupled with one of the Safari vulnerabilities, is potentially much, much worse than the Safari vulnerability alone. In this way such a "local" vulnerability has a negative impact for all OS X users that use Safari to connect to the net.

Re:Attacks Still Low

[1u3hr]

this vulnerability, coupled with one of the Safari vulnerabilities, is potentially much, much worse

Why is it still "potential"? It's been at least 8 months since this has been public knowledge. So I think this hole cannot be as easy to exploit as you think.

Re:Attacks Still Low

[kestasjk]

It is "potentially" worse because the Safari vulnerability now has the potential to be much worse given a "local" vulnerability which can give you admin access to a system.

Suppose I write spyware; using the Safari vulnerability I can get access to a users system via the web pages they visit. This is limited, however, because I'm limited to what the user can do. My spyware cannot exist anywhere other than the user's home folder. If I want the spyware to remain on the user's system, and remain hidden, I have to use tricks like adding the spyware to startup scripts where a user might not think to look. I can't perform excessive surveillance because there are restrictions on what a user can do.
A user can check to see whether any strange processes are running, any checksums have changed, any file modification times are odd, any permissions have been changed, and if the user finds strange processes or connections they can be stopped, and removed, and the system can be trusted again.

Now suppose I write spyware, but I use the Safari vulnerability coupled with the local admin escalation vulnerability. I can now insert the spyware into the kernel. I can make the kernel report that my spyware process isn't running, I can hide the spyware deep within system binaries, I can stop the kernel reporting true last file modification times, I can stop the kernel reporting network connections I start, there are no restrictions on surveillance; I can dump packets, log keystrokes, etc, etc.
The only way to be confident the problem is removed is a complete reinstall of the OS and firmware.

This is very worrying to a user concerned that hackers might be specifically interested in getting into their machine. The only reason it might not be so worrying to an average user is that spyware isn't currently written for OS X, but this is only because of market share. If there were enough Mac users for Mac spyware to be profitable one of the Safari bugs coupled with a remote execution bug could lead to the worst possible rootkit inspired spyware of all.
If you're satisfied that you're only safe because not enough people are interested in breaking into the system you use then so be it, but don't try and make out that OS X is secure because of it.

Re:Attacks Still Low

[1u3hr]

Now suppose I write spyware, but I use the Safari vulnerability coupled with the local admin escalation vulnerability....

I still wonder: if it's so easy, why hasn't it been done? I know lots of media compnaies, especially, who are heavily into Macs. If they were such easy pickings, why haven't they been taken down? Sure, industrial espionage would try to remain unobtrusive, but plenty of others would just add them to their spam botnets if they could.

This is not an anecdote like: "My grandfather smoked till and lived to be 90, so smoking is safe"; this is statistically significant: "10 million users have been smoking and are still on their feet".

Re:Attacks Still Low

[kestasjk]

As I said in my previous post, spyware hasn't been written for Macs because there's not a large enough market share. Saying that this makes OS X secure is like saying it's safe to never lock your home when you leave because you live in a good neighborhood. Your home isn't secure, there's just a lack of criminals.

Re:Attacks Still Low

[1u3hr]

As I said in my previous post, spyware hasn't been written for Macs because there's not a large enough market share. Saying that this makes OS X secure is like saying it's safe to never lock your home when you leave because you live in a good neighborhood. Your home isn't secure, there's just a lack of criminals.

It's not the same at all. Wherever you are, if you're online you can and will be attacked by some sleazeball in Russia, Florida, Lagos, wherever. And there are millions of Macs online, and many owned by juicy, rich, unsophisticated targets. So I still this make a good empirical case that the ease of attack is not high, in an absolute sense, not just security by obscurity.

Re:Attacks Still Low

[kestasjk]

Let's say the chance of a piece of spyware being ran into and executed is X, and N is the number of Macs out there, and Z is the average profit per spyware installation. If the cost of developing the spyware is greater than X*N*Z there's no point in developing the spyware.

Basically if you feel secure then fine. But you're not. :) I just hope no-one actually specifically targets you, because if anyone has a mind to getting access to your Mac you're screwed.

Re:Attacks Still Low

[1u3hr]

Let's say the chance of a piece of spyware being ran into and executed is X, and N is the number of Macs out there, and Z is the average profit per spyware installation. If the cost of developing the spyware is greater than X*N*Z there's no point in developing the spyware.

But once developed, the cost of additional copies is zero, and they proliferate in no time. So it seems no one has invested the time or money to develop that.

Basically if you feel secure then fine. But you're not. :) I just hope no-one actually specifically targets you, because if anyone has a mind to getting access to your Mac you're screwed.

I take precautions. I'm paranoid about my own security. And I don't have anything worth money to anyone else on my computer in any case.

Re:Attacks Still Low

[kestasjk]

But once developed, the cost of additional copies is zero, and they prolferate in no time. So it seems no one has invested the time or money to develop that.

As I said the cost of development makes developing spyware for Macs prohibitively expensive for the profits that such a relatively small market share could yield. I don't see how I could make it any clearer.
If the cost of development is $10,000, but the software is only expected to yield $1,000, it doesn't matter that the software, once developed, is easy to proliferate. It can only be expected to proliferated to so many Macs, which will only yield so much profit.

Re:Attacks Still Low

[1u3hr]

As I said the cost of development makes developing spyware for Macs prohibitively expensive for the profits that such a relatively small market share could yield. I don't see how I could make it any clearer.

Yes, but you miss the implication of your own argument: whether it's too hard or too expensive, no one has actually done this yet.

Though $10,000 should buy you a lot of ingenuity in Mosocow, I would have thought. Maybe it's just that the actual Mac hardware is thin on the ground in poorer countries. So cracked editions of OSX/Intel may change that.

Re:Attacks Still Low

[OS24Ever]

My comments weren't meant that OS X is somehow magically impervious and Safari is the best browser ever done and no one could hack it.

I just don't buy the market share is the reason argument. I feel that it's more of a difficulty level than a don't feel like bothering. It requires more than to visit a website and stupidly click through a pop up or something simple, it takes more than that.

Re:Attacks Still Low

[OS24Ever]

If the browser destroys the system, the person managing that system isn't doing their job properly.

Yeah they're too busy surfing Digg and Slashdot instead of doing their job then. Or the volume of systems at the big companies is so large that they can't do what they need to do and only someone working for a 25 seat company can claim that.

Re:Attacks Still Low

[kestasjk]

Yes, but you miss the implication of your own argument: whether it's too hard or too expensive, no one has actually done this yet.

This is irrelevant. If OS X is insecure and is only free from spyware because relatively few people use it then OS X is not secure.

Re:Attacks Still Low

[1u3hr]

If OS X is insecure and is only free from spyware because relatively few people use it then OS X is not secure.

We're talking past each other... So again, I DID NOT SAY THAT. I said the risk remains theoretical. Not impossible. And when and if it the vulnerabilities are weaponised, we'll know about it pretty quickly.

Re:Attacks Still Low

[hobbit]

Apple's package creation software, by default, makes packages that require an administrator password to install. I don't even know whether it can be made to create packages installed only for the local user other than through the command line.

APPLE IS TRAINING ITS USERS TO TYPE THEIR ADMINISTRATOR PASSWORDS AT THE DROP OF A HAT

Building your operating system on a more secure foundation makes no difference if you don't understand the basics.

No OS...

[mtec]

...will ever be perfect (except for GODOS). All we can hope for is the most amount of intuition and the least amount of irritation.

Re:No OS...

[Dystopian Rebel]

...will ever be perfect (except for GODOS).

Of course, the problem with GODOS is that you can't know if it's perfect until the computer is scrapped. In the Bitchy Beadle release of GODOS, the Schrödinger kernel is expected to improve the tracelogs.

There have been reports of computer users who claim to have briefly seen the perfection of GODOOS when their power supplies have developed an intermittent fault. Unfortunately for the proponents of GODOS, no one whose motherboard has been completely fried has ever been able to compute with it again.

Confusing the question further is the fact that computer users are known to declare that SATANOS is running on their computers whenever anything goes wrong.

Re:No OS...

[Anonymous Coward]

...and GNU/HERD! ;)

Re:No OS...

[Ucklak]

Funny how that BASIC cartridge for the old Atari2600 never got an infection.
I don't think that most modern game consoles do either and they are computers with specified operating systems.

Re:No OS...

[PFI_Optix]

Operating systems which, until very recently, couldn't be updated or modified at all. That sort of makes them resistant to infections. It also makes them obsolete very quickly.

I've wondered if anyone will every find out how to spread malware on the PS3 or XBOX 360, or perhaps the next generation of consoles. I think both work by flashing components of their OS, and it can only be done by disk...this would prevent easy spread unless the system could be tricked into doing it by other means. The static nature of their designs allows a much more signficant lock down on the OS than even *nix can provide.

Re:No OS...

[pboulang]

People keep talking about GODOS, and there is a lot of documentation, but I don't know anyone that's actually used it. Plus, as a game platform it only runs HALO

If you are depending soley on your choice of OS

[antifoidulus]

for security, you have already lost the battle. Staying(relatively) secure involves a few simple steps that most people still won't listen to:

1. Run a firewall and only open what you need to be opened
2. Most importantly: DONT CLICK ON STUPID SHIT! Don't run seedy programs etc. It's amazed how many Windows users get infected like that

Those obviously won't protect against 100% of threats, but very few things in life are guarenteed.

Re:If you are depending soley on your choice of OS

[nadamsieee]

for security, you have already lost the battle. Staying(relatively) secure involves a few simple steps that most people still won't listen to:

They shouldn't have to listen; the system should be designed for security from the ground up.

2. Most importantly: DONT CLICK ON STUPID SHIT! Don't run seedy programs etc. It's amazed how many Windows users get infected like that

Relying on user education is #5 on the Six Dumbest Ideas in Computer Security.

Re:If you are depending soley on your choice of OS

[Anonymous Coward]

1) Don't run as root
2) Don't run as a user
3) Use Lynx, not some vulnerable crap that supports java
4) Unplug the interwebs
6) Actively search for vulnerabilities and fix them yourself
7) Format your hard drive at least twice a day
8) Use a firewall which blocks all ports, especially 80

These measures may sound extreme, but I can tell you that I have been using them for over thirty years with great success. Let me also say that if you fail to follow a single one of these steps, you are at risk for getting a virus.

Re:If you are depending soley on your choice of OS

[ipooptoomuch]

No. Most importantly: Just make sure the average user doesn't get to touch the keyboard, mouse, or any other input device.

Re:If you are depending soley on your choice of OS

[0racle]

A computer is a tool to let you do things, it is not supposed to do thinking for you.

Re:If you are depending soley on your choice of OS

[Weedlekin]

"A computer is a tool to let you do things"

It can also be a tool that others use against you.

"it is not supposed to do thinking for you"

Strange then that artificial intelligence research is almost as old as computing itself.

Re:If you are depending soley on your choice of OS

[oliverthered]

You forgot always wear a condom

Re:If you are depending soley on your choice of OS

[dal20402]

Almost no regular user is thinking about the security implications of his or her computer use. Therefore, the OS designer should do it for them, to prevent damage to other users.

If they are sophisticated enough to think about security at every step, power users can disable or change security features manually.

A computer, to most people, is a tool to write stuff, communicate, and have fun. It's not, in their minds, a tool to promote security. So why not have the machine be as secure as possible automatically?

Re:If you are depending soley on your choice of OS

[Shawn is an Asshole]

Most users, though, treat it as an appliance. They want to plug it in not have to learn anything. As long as keeping a system secure requires a user to bother learning something security will be a problem.

Re:If you are depending soley on your choice of OS

[99BottlesOfBeerInMyF]

A computer is a tool to let you do things, it is not supposed to do thinking for you.

A tool should be designed for a given skill level and environment so it works properly for most people. You wouldn't design a new blowtorch that superheats the air in lower latitudes and kills everyone when you turn it on. By default, it should behave reasonably and if some freak wants to mess with it, they can. That said, Windows in particular does a terrible job of doing what users expect it to safely. OS X does a better job, partly because the ecosystem in which it operates is different and partly for technical reasons. It does, however, do a good job of working by default for that set of users and ecosystem.

Some really common tasks, like running a random game from a Web page when I'm not sure I can trust it, are really, really, really hard on Windows. Given that so much malware is out there, this should not be the case. The computer does not have to "think for you" in order to sensibly inform the user and give them the choices they need. For example, no program not pre-installed on Windows should be able to read your e-mail address book or send e-mail messages without the user specifically authorizing that behavior. "The program 'Marsblast.exe' would like to read your e-mail addresses and connect to the internet in a way normally used to send e-mail. (Stop it from reading my addresses and sending mail)(let it read my addresses and send mail once)(always let it read my e-mail addresses and send e-mail)(advanced options)." This functionality is not impossible to create and if MS were in a competitive market where they had to give customers what they want, this would have been in Windows 2000.

Re:If you are depending soley on your choice of OS

[Anonymous Coward]

And considering that most Mac users think they are running fort Knox on a desktop, Mac users would be more likely compromised by the false sense of security they so frequently have. I'd be interested in how they would feel about security if they were enough installations of Mac's in the world to be a worthwhile target for anything - they seem to be the current frontrunners of security by obscurity mantra IMHO.
 
  Security problems on Mac are nothing new, everytime I see a wack load of posts about how nothing will ever go wrong for a Mac - for entertainment I like to pop open http://search.info.apple.com/index.html?search=Go& lr=lang_&kword=&kbdload&news&q=security&type=kbdlo ad and have a good laugh. according to Apple the Mac isn't Fort Knox and should not be treated so. The only two places that Mac's are the bastion of security are those crappy ads and in the mind of Mac Zealots.
 
That being said, it (currently) is more secure than Windows, but Windows out of the box is hardly something you want to compare something too, Windows REQUIRES security add-ons in the form of firewalls, anti-virus etc and no one has claimed the currently available windows doesn't require them except maybe Sony.

Re:If you are depending soley on your choice of OS

[mrsbrisby]

1. Run a firewall and only open what you need to be opened

Do you honestly think anyone but a network administrator has any idea what you just said?

2. Most importantly: DONT CLICK ON STUPID SHIT! Don't run seedy programs etc. It's amazed how many Windows users get infected like that

Do you honestly think people go Hrm, this program is pretty seedy, but I'm going to run it anyway! .

The real problem is people go Oh, I received an electronic fax, that's not a program and people like you just say No you dolt, that was an exe file, gawd how stupid are you!?

Those obviously won't protect against 100% of threats, but very few things in life are guarenteed.

This is what I think the real problem is: Suggesting that people accept faulty software and their own failings.

Here's an idea: a big red button on the side of the computer. You hold it in, and executables can be created. Tell people that big red button lets other people change the way their computer works and no matter how the computer instructs them otherwise, to only push and hold that button in when they are unhappy about how their computer works and feel the need to change it.

That's what root is supposed to be for- whether they be called Administrator or sudo doesn't make it any more or less safe. The fact that Non-root can install software is a security weakness. The fact that the user can run as administrator and not know it is a security weakness.

My mother in law has been actively computing since 2002 without any viruses or "computer problems of any kind" simply because she has to call me in order to remount /home without -o noexec, or sudo for anything. I wish there were a red button sometimes because she's pretty good about knowing when to call me, but because she honestly thought she had to "Runas" in order to read a fax (after all, that's what the email from her son said to do!), she doesn't mind not knowing her own root password.

Re:If you are depending soley on your choice of OS

[RAMMS EIN]

I'm surprised you mentioned not opening ports you don't need to be open _and_ running a firewall (I remain convinced this is redundant), yet did not mention keeping up to date with patches.

Re:If you are depending soley on your choice of OS

[nadamsieee]

Strange then that artificial intelligence research is almost as old as computing itself.

Despite what its relative age may be, AI has by far the largest hype-to-actual-results ratio of any computer science field. You should read Neville Holme's article Artificial Intelligence: Arrogance or Ignorance if you're interested in the subject. A well thought out response to Holme's article is available online.

Re:If you are depending soley on your choice of OS

[Serious Callers Only]

This functionality is not impossible to create and if MS were in a competitive market where they had to give customers what they want, this would have been in Windows 2000.

Unfortunately it's not in OS X either, though it's long overdue. Any app can use the address book API to access the address book (no authorisation required I don't think), and can send out emails (again, no authorisation required, save running it which many users could be tempted into doing). I was thinking when reading the post above of something built into the OS which blocked ports/folders for all but specific apps - so instead of the current firewall app which gives the user the choice to deny certain ports incoming, you could have a sort of built in Little Snitch, an 'Access Control' for applications (not for users), which did the following - Have a pref pane listing the settings for each app, and on first run of an app give the user a dialog asking :

Would you like this application to be able to :

Send Email
Access Internet
Access Music
Access Images
Access Documents
Access Address Book
Access Other Applications (including prefs)
Access Everything

This is of course possible by running as a low privilege user all the time, but no one is going to do that, and they shouldn't have to. Most Mac apps are well behaved and will only look into Application Support and the Preferences folder, however they could easily be forced to behave by the OS. They should pay the author of Little Snitch and just incorporate it, but extend it to file access too (don't think it does that, if it did I'd buy it). Very easy to do, and the payoff would be huge for security against simple trojans and spyware.

Re:If you are depending soley on your choice of OS

[Jackmn]

Therefore, the OS designer should do it for them, to prevent damage to other users.

If a user is dead set on running something then he is going to run it. There is little that can done to fix that. Implementing a TPM system where the user simply can't run unsigned binaries without flipping some switch is the only solution I can think of, and you can be sure most users will flip that switch as soon as whatever piece of malware they are attempting to install requests it.

Re:If you are depending soley on your choice of OS

[99BottlesOfBeerInMyF]

Unfortunately it's not in OS X either, though it's long overdue.

We'll have to see what exactly is in OS X 10.5.

They should pay the author of Little Snitch and just incorporate it, but extend it to file access too (don't think it does that, if it did I'd buy it). Very easy to do, and the payoff would be huge for security against simple trojans and spyware.

Well, little snitch is sort of an add on for the firewall and not a good basis for ubiquitous system level security. Apple announced a month or two ago that they had ported to 10.5 the Mandatory Access Controls (designed for exactly this purpose) from TrustedBSD, which is itself a port of SELinux controls from the NSA, I believe. The trick with such a system is designing the UI component (which Little Snitch does provide a good model for) and designing good defaults. Since they also announced an application signing framework at the same time my hope is that they will provide ACLs for pre-installed apps, give certified and verified apps an ACL included with that app, give certified apps a fairly restrictive default ACL, and give unsigned apps a very restrictive ACL as the default settings. As for the filesystem access, I'd like to see the most restrictive default be access only to files created by that program itself. I think more granular access than you present would be nice as well and if proper defaults are provided it should be easy to change them with a simple violation notice ala Little Snitch, or by editing that program's restrictions.

Anyway, at least the frameworks for this look to be coming soon. Hopefully the OS integration, UI, and defaults are as well.

Re:If you are depending soley on your choice of OS

[Weedlekin]

"AI has by far the largest hype-to-actual-results ratio of any computer science field."

I am aware of this, but It does not change the fact that the GP's claim about computers not being _meant_ to think is arguable. That there is still ongoing research into AI and its related fields proves that the goal of making computers behave more intelligently is a highly desirable one despite decades of failure, and some areas such as speech recognition and associated natural language processing capabilities are receiving significant levels of funding from major corporations such as Microsoft, IBM, and Google. One could thus argue that a major goal of computer science since the 1950s has been to build an intelligent machine, and the fact that one hasn't emerged yet is a bug, and not (as the GP claims) a feature.

Re:If you are depending soley on your choice of OS

[99BottlesOfBeerInMyF]

If a user is dead set on running something then he is going to run it. There is little that can done to fix that. Implementing a TPM system where the user simply can't run unsigned binaries without flipping some switch is the only solution I can think of, and you can be sure most users will flip that switch as soon as whatever piece of malware they are attempting to install requests it.

The solution is to increase the granularity of control and the feedback from the OS. Right now you can run a piece of software that may or may not be malware. You can run it as an admin with pretty much all permission or you can run it as a normal user (well some people can, maybe not most). Either way, it has significant access to be valuable to a botnet operator. If you're an expert you can run it in a special, locked down user account but that may or may not work. Ditto for a VM.

What users need, is the ability to run it with greatly restricted privileges and then pertinent feedback when it tries to exceed those privileges. We're not talking about a dialogue box that says, "explorerhelp2.exe needs administrative privileges (OK)(Cancel)." Something like "MarsRaid.exe is from an unknown publisher and would like access tot he internet in a way normally used to send e-mail (Stop it from sending e-mail)(Let it send e-mail once)(Always let it send e-mail)(Advanced Options)."

By providing granular security for each application, restricting by default the network, filesystem, and other resources that program can access in accordance with the level of trust given to that program users are told what i going on and given the tools to make reasonable choices. Sure some will agree to let anything do anything, but at that point user education has a manageable task. There is no technical reason why this system won't work and the plumbing is already there on numerous OS's

Re:If you are depending soley on your choice of OS

[im_thatoneguy]

The only reason people aren't educating themselves to protect their computers is because they aren't taking it seriously, and or are not being educated.

Saying the OS providers should be completely responsible for protecting their users is like suggesting a home builder should make automatically locking doors. Only on computers do we give the users a complete walk on responsibility. If you don't lock your home before you leave, thieves can steal your goods, money and even identity. It's no different if you don't have a firewall and invite strangers into your computer on a daily basis.

As people get more and more computer savvy, and as kids grow up, they'll slowly adopt the two rules. We're just in a reallly reallly messy transition period where everybody is living in a virtual world, but hasn't been taught by a parent or teacher figure how to 'take out the garbage and mow the lawn." Since the consequences of ignorance in the virtual world, seem to be nothing more than ignorance, the cycle is perpetuated for the near future.

I would wager most 12 year olds are sufficiently well educated.

This isn't at all to say we should be insecure in our OSes but, 90% of these exploits are going to rely on someone not locking their door when they leave for work.

- Gavin

Re:If you are depending soley on your choice of OS

[sacrilicious]

Relying on user education is #5 on the Six Dumbest Ideas in Computer Security

But the end result of not relying on user education is to deny users their choices... which leads to monstrosities like Microsoft's vision of Treacherous Computing.

I predict...

[Anonymous Coward]

...that OpenBSD whores will derail this entire discussion.

Re:I predict...

[NoMoreNicksLeft]

All 3 of them?

Re:I predict...

[peacefinder]

"[...] OpenBSD whores will derail this entire discussion."

Damn. Gotta be a pretty cheap date to whore out for a BSD-licensed OS!

Seriously, man, you've got your terminology all wrong. Whores do it for money. While OpenBSD users don't object to getting paid for it, mostly we do it for free 'cuz we like it. That makes us sluts.

If you'd ever gotten laid without paying for it, you'd know about this stuff.

Free software is not supposed to be 'much better'

[mi]

Linux (if you need a URL for Linux, you are probably at this site by mistake) does not seem to fare much better.

Vendors of commercial software would have you believe, free is supposed to be much worse: "Free and worth every penny"...

That it is even on par is great. If it is better, even if by "not much" — that's terrific!..

Personally, I'd rather the world used FreeBSD, of course, instead of imitations like "MacOS"/"Darwin", or "Linux" :-)

Will break MS-Entourage

[Anonymous Coward]

Symptom is that Entourage quits 3 seconds after launching. Even if you're not an Entourage user, you might want to hold off because typically when a problem this big is found there are other undiscovered issues. Can't really blame Apple for trying to rush this through though, given the nature of what the patch is intended to do to your system.

Public Domain Freeware and Shareware is a good thing to create, trade and buy, but this GPL/FSF communism and their donate-buttons and book-selling "open source visionaries" are a bunch of posers.

Re:Will break MS-Entourage

[b0s0z0ku]

Entourage is a steaming pile of crap anyway. My clients are about 75/20/5 PC/Mac/Other. I've seen Outlook get really slow and almost useless. However, I've seen the database (.pst) file get corrupted and lose messages maybe 2 or 3 times. With Entourage, I've seen the DB get corrupted and lose *all* data about the same number of times despite the lower usage. It's also much slower to resync with an Exchange server than Outlook and unless you dot every i and cross every t during setup, it often doesn't work at all. And I've never seen the feature where you just type in the username, password, and server name and it fetches the rest of the settings working.

So if you use Entourage - backup, Backup, BACKUP. And use something sane like Thunderbird or even Mac Mail unless you're actually syncing with an Exchange server (rather than a garden-variety IMAP service).

-b.

Re:Will break MS-Entourage

[Anonymous Coward]

Steaming pile or not...it won't work anymore if you install this security patch. At least as of right now.

Slashdot

[pubjames]

Dear Slashdot editors,

your readers are all technically literate. Please don't post stories where dumb ideas like "how secure an operating system is = number of potential security holes fixed". That kind of stuff is for pointy haired bosses, not technically literate people.

Thanks!

Re:Slashdot

[MECC]

Dear Slashdot editors,

your readers are all technically literate.

All...?!

Re:Slashdot

[JayJay.br]

your readers are all technically literate.

If that were true, this story would not have a submitter.

Dear Slashdot editors,

Please don't instigate any more flamewars on OS security. If I may help, security actually depends on the administrator, period.

Re:Slashdot

[Xugumad]

In particular; 3 require a malicious local user (two patches to ATS, and the one to VPN) and 7 require local user action to work (the third ATS patch, and the patches to CFNetwork, Finder, gnuzip, Installer, perl and Webkit). Most of the Security Framework issues mean that a certificate may not be correctly rejected if it has been revoked. The Installer patch means that users must now authenticate themselves as being an administrator for some actions, and is a patch to ensure a level of security above that of Windows.

I would consider only the the AirPort and WebKit patches to be critical; the rest apply to parts of the OS that must people won't be using!

This isn't as bad as the article that counted all security alerts about UN*X software, and compared it to the security alert count for Windows OS only, but still...

Re:Slashdot

[RAMMS EIN]

Yes, all. Well, except those in the little village where Asterix and Obelix live.

Re:Slashdot

[curunir]

Well, when you consider it, all readers are technically literate.

However, technical acumen is a whole different matter...

Re:Slashdot

[mkiwi]

Dear Slashdot editors,

your readers [think they] are all technically literate.

BTW we are all lawyers too, although some of us do know some cool HTML tricks :-)

And you though

[El Lobo]

Well, how is that news? Many people think that it is a myth that MS products "are more buggy" because they are the most used. Well, that's NOT a myth. For starters,

1)being the most used OS ibn the world gives you the bonus of the publicity. If you do something bad or have some pretty terrble bugs, half the planet will know about it. If apple have terrible bugs their 3 and a half users will know about it. And that's all.

2) The bonus of the (in)simpathy. being the most used (and missused) OS in the worls affects the simpathy the user have for that products. Using MacOS or Linux makes you "cool" and "underground" so Windows will get that extra bashing.

3)An OS is a TERRIBLY complex thing, and you ***will*** have bugs. There is only a matter of time.

4)Everybody and their cats program (pr missprogram) for Windows. When a 6 years old boy begins programming, do you think they will program for Huniacs mainfrains or for Windows? Thus there will be more "hackers", "crackers", etc for the main OS.

If you want to maliciausly explote an OS to make Major damage/profit, do you want to target millions of Windows users or the 3 and a half Mac users?

Re:And you though

[mrsbrisby]

I'll bite.

1)being the most used OS ibn the world gives you the bonus of the publicity. If you do something bad or have some pretty terrble bugs, half the planet will know about it. If apple have terrible bugs their 3 and a half users will know about it. And that's all.

Except Microsoft Windows isn't the most used OS in the world. A UNIX is- everybody who uses a web browser is looking at a web page- very likely to be served by a UNIX server. I think the sheer number of zombies (about 60% of Microsoft's user base) demonstrates that Windows users simply don't know that they're owned. The other 40% probably have professional UNIX admins running their network.

Or did you mean Operating system with the largest number of installations? That'd have to go to TRON- immensly popular in Japan, it's on just about every piece of industrial or business hardware there: I'm talking billions of deployments.

2) The bonus of the (in)simpathy. being the most used (and missused) OS in the worls affects the simpathy the user have for that products. Using MacOS or Linux makes you "cool" and "underground" so Windows will get that extra bashing.

I think accepting any bugs is a mistake. Note that Linux and FreeBSD both make honest efforts to fix their bugs- but unless someone has disclosed it to Security Focus, Microsoft won't fix it. They know just like everyone else that Bugs are defects and since Microsoft sold a defective product, they have to fix it. Of course, the fewer that are disclosed the better.

3)An OS is a TERRIBLY complex thing, and you ***will*** have bugs. There is only a matter of time.

Er, no. The reason defective software is available is because people just like you who think defective software is acceptable. If nobody thought defective software was acceptable, there simply wouldn't be any defective software. NASA (for example) makes defect-free software (albeit at a significant expense)- but usually failures are acceptable if the failures are graceful and recoverable. EROS and J2SE are two operating systems that work like this.

4)Everybody and their cats program (pr missprogram) for Windows. When a 6 years old boy begins programming, do you think they will program for Huniacs mainfrains or for Windows? Thus there will be more "hackers", "crackers", etc for the main OS.

I disagree. Up until distributed zombies became popular (thanks mixter), nobody targetted Windows simply because no gain could be had. Now zombies are used for everything from spamming to extortion. Six year olds aren't "bringing down windows" - I mean, I don't know if six year olds are bringing down windows. They're not bringing down UNIX, that's for certain (the oldest and most pervasive operating system ever), but if six year olds are bringing down Windows, I'd highly recommend you seek elsewhere.

If you want to maliciausly explote an OS to make Major damage/profit, do you want to target millions of Windows users or the 3 and a half Mac users?

You'll find very few people disagree with this, but people don't want to "maliciously" exploit an OS: they want to make profit. Spammers and spyware installers don't target Windows: they target ignorance. When ignorant people start buying Macintosh and UNIX desktops again, you'll probably see some real targets there. After all, would you rather have 1% of 1000, or 99% of 100?

Please

[daveschroeder]

The issue is having an actual usable vector for mass-propogation, resulting in the massive downtime and recovery time, billions of dollars of lost productivity, and tens of thousands of manhours in remediation. That's not to say no one could ever find some suitable vector for propagation that can strike large numbers of Mac OS X users effectively; just that it's very unlikely for a variety of reasons, not the least of which is that these days, most Mac OS X computers aren't exposed in such a way that anything could effectively spread en masse remotely without user interaction.

Almost everything relies on some form of user interaction, and yes, these things are still bad, especially ones that take advantage of some shortcoming in the OS. What's laughable about the submission is that it makes it look like it's "bad" that Apple fixed oh-so-many vulnerabilities, and then complains that it's not fixing enough. Apple does fix issues reported to them, period. And yes, we all have stories about this or that outstanding bug or vulnerability that is still open, but Apple has markedly, hugely improved, mostly because of listening to feedback from customers, particularly enterprise customers, in the security arena. It does have a way to go, and whether or not any fix is "fast enough" will always be subjective.

No one sane ever said Mac OS X was invulnerable. It has bugs and vulnerabilities like any OS. Apple responds to them. Someone will always think they're not responding fast enough, or correctly, or what have you, but the fact remains that Mac OS X has been on the market for over 5 years, and there has yet to be any substantial issue that has been exploited on any scale. And no, it's not exclusively because of marketshare.

Re:Please

[El Lobo]

No one sane ever said Mac OS X was invulnerable.

You have never talked to the average mac user, have you?

Re:Please

[daveschroeder]

I don't care if the "average Mac user" thinks that Mac OS X has no bugs, is invulnerable to everything, and will dance a jig if they ask.

Effectively, for almost all desktop users in any environment, Mac OS X is much more secure, much less attacked, and much safer to use from a malware perspective, for almost all average users, period. Some of the reasons are due to marketshare, some are helped in part by marketshare, some are because of architectural decisions, and some are a mix of multiple reasons. But regardless of what someone "thinks", Mac OS X is still a manifestly safer OS for an "average user", and there is simply no disputing that.

If you want to get people to understand that even Mac OS X has bugs, great. (Duh?) If you simply want to make stupid people no longer stupid, that probably won't work. The average person doesn't care. All the average person knows, when they make the switch for example, is that their Windows box was packed with spyware and adware and then "got slow" and had multitudes of typical Windows problems that typical people have, and they don't have the same problems with their Mac.

Do Macs have problems and bugs and vulnerabilities? Yes. Will anyone win the pissing match of "which one is better" when it's not done for any reason other than to be a pissing match, like this article seems to be doing? No.

Re:Please

[EvilTwinSkippy]

Where have you ever met an "Average" mac user.

They fall into 2 categories: Mouth breathers who know Photoshop like the back of their hand but can't be trusted with scissors, and ubergeeks who use Mac because they consider it the Mercedes Benz of hardware and software.

Re:Please

[AKAImBatman]

Here's something to ponder for a moment:

Is it possible for the Macintosh to have a major security flaw in the Apache Server?
If the Macintosh had a major security flaw in Apache, could there be a Code Red style of attack?
Would Apple release a patch to address the flaw in Apache, even though it's not their software per se?
How many users would actually be vulnerable to this exploit?

If you know the answers to those questions (the real ones, not the projections from Windows users) then you know why Mac users feel invulnerable, even though they're not.

Re:Please

[Anonymous Coward]

No one sane ever said Mac OS X was invulnerable.

You have never talked to the average mac user, have you?

I don't see what you're getting at...

Re:Please

[99BottlesOfBeerInMyF]

Is it possible for the Macintosh to have a major security flaw in the Apache Server?

Of course, in fact it has already happened.

If the Macintosh had a major security flaw in Apache, could there be a Code Red style of attack?

It's possible if the exploit was coded before the patch (which is rare in the extreme on OS X). Also, since Apache is not running by default on OS X, it would hit a tiny number of users and most would not care.

Would Apple release a patch to address the flaw in Apache, even though it's not their software per se?

Apple is an Apache contributor and has released security patches in the past. They also can make fixes to the version they ship, which is a little nonstandard as it must deal with Apple's filesystem quirks.

How many users would actually be vulnerable to this exploit?

Hmm, i would be, maybe. I have a Web server on my laptop I run occasionally to test things and sometimes open it up in a coffee shop while collaborating.

If you know the answers to those questions (the real ones, not the projections from Windows users) then you know why Mac users feel invulnerable, even though they're not.

Yeah, I know a lot of Mac users and most certainly don't feel invulnerable. At the same time, however, they don't have any qualms about telling a clueless relative to just get a Mac and not worry about it.

Re:Please

[AKAImBatman]

...Also, since Apache is not running by default on OS X, it would hit a tiny number of users and most would not care...

...Apple is an Apache contributor and has released security patches in the past...

Precisely! :)

What we're seeing is Apple fixing issues that cannot be successfully exploited on 90%+ of the Mac machines in existence. Worms like Code Red or Blaster wouldn't be able to find enough hosts due to the default security setup of OS X. The only folks who would be vulnerable would be the ones who know enough about internet hosting to enable a service.

While there's no guarantee that these users are significantly more educated, they do at least know that they're running a potentially exploitable service. This is in direct opposition to the situations that made Code Red and Blaster possible. Had IIS Personal Server not enabled itself without the knowledge of most users, it's highly likely that Code Red would have failed to spread. (Especially since a security patch had been available in both cases.)

Re:Please

[Anonymous Coward]

Please,
You mean that Mac OS X has any scale?

Re:Please

[spearway]

Actually yes I have talked to a lot of average Mac Users.

The situation reminds me of the 80s when Toyota introduced a new concept in the US: a car that would run reliably for 300k. With that they went on to push aside all the US manufacturer that with their crap quality and car that would break down and require large amount of maintenance. It was not that Toyotas would never break but consumer recognized that, in practice, they were running a lot more often than the competition.

The same thing is happening. Go around Mac users and all the machines, even badly maintained, are functional. You can perform all the tasks you need to without undue annoyance for unscheduled maintenance. Most users know that his Mac can break like and driver knows that his car can break, it is just that with some equipment it is more likely than with others and therefore is or is not a daily preoccupation.

Re:Please

[Old Thrashbarg]

Oh dear, I fall into both of those categories... should I seek help?

Re:Please

[Anonymous Coward]

How about a combination of market share and utility? No one runs servers on OSX. They run servers on Windows, FreeBSD, and *nix. Anyone who is hacking OSX boxes is most likely doing so on a personal basis. Black hat hackers won't worry about it because there's little utility in being able to break into a handful of personal computers, they're concerned with the more valuable systems. White hat hackers might care about this, because they care about information, not utility. But white hats don't screw people, so that's a nonissue.

Re:Please

[Anonymous Coward]

> Effectively, for almost all desktop users in any environment, Mac OS X is much more secure,
> much less attacked, and much safer to use from a malware perspective, for almost all average users, period.
>
When you write or say ", period", it makes it seem as if your point is not valid, and therefore you feel you need to boost your argument artifically by appeal to your own authority. That works especially badly when you have not established any authority. It contributes to bad discussion because it implies that if someone disagrees with you, you will not bother listening, because, after all, you are right, period.

Re:Please

[Anonymous Coward]

Saying "period", even if you or others don't personally like it, doesn't invalidate the argument, nor is it a logical fallacy or an appeal to authority. Irrelevant as it is (since the point is correct), it's perfectly easy for anyone to see exactly who the poster is and what he does in this case, by simply clicking the URL in the post.

Re:Please

[dcam]

What we're seeing is Apple fixing issues that cannot be successfully exploited on 90%+ of the Mac machines in existence. Worms like Code Red or Blaster wouldn't be able to find enough hosts due to the default security setup of OS X. The only folks who would be vulnerable would be the ones who know enough about internet hosting to enable a service.

It is worth noting that by default windows is not vulnerable to Code Red. You would need to install IIS. Incidentally that generally requires you to insert the windows CD to install it. Vista may include in by default, but it hasn't shipped with any version of windows that I have ever touched (95, 98, NT4 workstation/server, 2000 pro/server, 2003, XP pro).

That said, IIS is more integrated into the OS than Apache.

What the URL

[jlebrech]

First of all whats the URL for Linux? and second what's a URL?

Re:What the URL

[Weedlekin]

"what's a URL?"

It's short for "Universal Reason for Litigation", and is something big IP owners use to obtain money from people who have very little of it.

Arnt most of the "flaws" actually trojans?

[falcon5768]

In which case you have to execute them (and thus give your username and password or do some other action) to even run them and let them do their bad things?

I mean give me a fucking break I could write a trojan in 5 minutes that makes you delete your entire user folder... that doesnt make it a flaw unless your talking about the jackass who executed it instead of following the simple rule of the internet..... DONT RUN ANYTHING YOU HAVE NO CLUE IS SAFE... that means shutting off open up safe files after download too!

And likewise wasnt a bunch of the "flaws" proven to be so reliant on certain things to happen at certain times that it would be next to impossible to actually get them to do anything but kernal panic?

Re:Arnt most of the "flaws" actually trojans?

[Anonymous Coward]

No, no they're not.

It's not hard to read the article. The link is provided and everything.

Re:Arnt most of the "flaws" actually trojans?

[falcon5768]

um yes they are... I DID read the link and all of the vulnerabilites... I was making a point. 5 require user interaction, and all but 2 of the rest just kernal panic you and thats pretty much it, you have to be really lucky to get them to run code.

Re:Arnt most of the "flaws" actually trojans?

[99BottlesOfBeerInMyF]

Arnt[sic] most of the "flaws" actually trojans? In which case you have to execute them (and thus give your username and password or do some other action) to even run them and let them do their bad things?

These are potential holes that have been fixed. Some are issues where data (like a font or disk image) despite being just data could execute code. Some are remote holes that could lead to a remote compromise without user interaction. Some are ways to locally or remotely crash something or locally escalate privileges.

As for trojans, they are a serious consideration that should be addressed by the OS, but are not related to this security fix. It looks like 10.5 will include at least the security frameworks needed to mitigate most of them.

Re:Free software is not supposed to be 'much bette

[jimstapleton]

I wouldn't.

I'd prefer my current OS of choice to remain relatively safe. If everyone in the world used it, then people would bother to hack it more. Let them keep their sucky OSes :-)

Re:Free software is not supposed to be 'much bette

[EvilTwinSkippy]

You do realize that Darwin is based on FreeBSD 5.0, right?

Re:Free software is not supposed to be 'much bette

[Anonymous Coward]

> Personally, I'd rather the world used FreeBSD, of course, instead of imitations like "MacOS"/"Darwin", or "Linux" :-)

You do realize that FreeBSD is an imitation of BSDLite and that "MacOS"/"Darwin" were architected from the official BSD 4.4 under the direction of one of the guys who created OpenBSD, right?

As far as Linux, it is a homebrew system inspired by the demo-os Minix that Andy Tannenbaum wrote about in his book on operating system theory and it is in no way related to BSD.

And further, all of the same reasons for choosing BSD over Linux (mainly, pre-integration) go double for choosing Apple Darwin over BSD.

You know what, you're right!

[NoMoreNicksLeft]

My linux laptop is all crudded up with 9000 spyware bonzi buddy applets, and my OSX work machine was just discovered to be a spam zombie spewing out half a billion UBE's per week.

Bad, Apple, bad. *thwacks Apple with rolled up newspaper*

Don't break any fixes anymore, you're supposed to be perfect.

Re:You know what, you're right!

[nanoakron]

How did you find out? I'm genuinely interested.

Re:You know what, you're right!

[NoMoreNicksLeft]

I read all the tech pundit blogs of course. They tell me how it's all an illusion that linux boxes are cheaper and more stable, and how Apple's aren't any more secure than windows, only ignored by hackers.

Re:Free software is not supposed to be 'much bette

[mi]

You do realize that Darwin is based on FreeBSD 5.0, right?

I do. That's why I called it "imitation".

As well they should.

[oneiros27]

The main point they should make is that OpenBSD doesn't bundle in lots of other software packages.

Therefore, they don't have people saying 'fixes for 31 vulnerabilities in its OS' ... as Apple patched 31 vulnerabilities, but most of them were not part of the OS (applications like FontBook and FontImporter) and not even maintained by Apple (like OpenSSL, PHP, Samba, perl).

Makes sense

[Tarlus]

I would imagine that in a parallel dimension where Apple's OS is by far the most widely used in the world, with Windows being a distant second, Mac OS would be known to have the most insecurities or viruses. All of the hackers with no lives who actively exploit these things (as well as the hackers with lives who report their findings so they can be fixed) would be focused on this OS because of its immense user base.

I'm not saying that it would be as insecure or virus-ridden as Windows really is, but in that parallel dimension it would have more known issues than Windows would because nobody would care about targeting the 2% of the market using Windows.

I agree with the "pick your poison" mentality, but in this real world case, it's the difference between choosing arsenic or just really strong orange juice.

Re:Makes sense

[ImaNihilist]

The old "security through obscurity" argument doesn't really hold water. There were less Mac users back in the OS 9 days, and yet there was plenty of viruses and malware for the platform. As the Windows userbase increased in absolute numbers, so did the amount of malware. However, once Apple released OS X the level of malware essentially dropped to zero and that's where it's been ever since, despite the fact that the Mac userbase is much larger today, in absolute terms, than it was in the OS 9 days. There must be something inherently more secure about OS X and its BSD-base.

Futhremore, one would think that hacking OS X and BSD would be a higher priority than hacking Windows, since people who have sensetive data that they want to secure are less likely to use Windows. The expected value of the payoff for hacking OS X and BSD is going to be a lot higher than it is for Windows. Robbing a bank in the ghetto with a vault made of plywood might be easier, but it's not going to have much money in it. I guess if you rob enough of those banks you can make up for it, but still.

Re:Makes sense

[0racle]

Yes but even though OS9 was full of holes, a Mac was still seen as more secure then Windows because you heard of Windows bugs doing crap, not Mac problems.

It's not security through obscurity but what makes a better target. Right now, breaking OS X might get you bragging rights, but thats about it. More and more malware is written by people with financial goals, not to get the actual information on individual computers but as a stepping stone to something much better. Why go after individual CC numbers when you could use a poorly secured system as a spambot and 'legitimately' make money. Why get that one CC number when you could use that machine to get access to a database full of them. Both of those require a whole lot of compromised systems before you get lucky, something breaking OS X doesn't give you.

Re:Makes sense

[theurge14]

Once again, all one has to do is acknowledge the Apache vs IIS marketshare numbers to realize that 'security through obscurity' isn't the entire picture.

http://news.netcraft.com/archives/web_server_surve y.html

Re:Makes sense

[Tarlus]

Well, you're arguing on specifics whereas I was arguing on general facts.

MacOS 9 had more issues because it was the last of aged and dated lineage of the original Mac OS. That's the reason they introduced new technology (to Macs) in OS X. So of course OS X would not have a lot of security issues or viruses because it hadn't been in the wild long enough. And that still holds true today (at least for the most part, as this article points out [31 Fixes]), because of the fact that OS X is indeed based on Unix. Unix (as 99.999% of /.ders are already aware) has been around and refined over the last 30 years (as thus reflects in BSD) so it can naturally be expected to be more secure and rock-solid than the relatively young Windows NT.

You people need to stop telling me that I'm using the flawed and tired "security through obscurity" argument. That is not my approach at all. If you read my whole post then you would have seen that I already affirmed that OS X, if it were in the lead of the market above Windows, would have more known flaws, but not as much as Windows does in reality.

Re:Makes sense

[ImaNihilist]

So MacOS 9 was less secure because it was old, and BSD is more secure because it's old. Good game.

Re:Free software is not supposed to be 'much bette

[mi]

I'd prefer my current OS of choice to remain relatively safe. If everyone in the world used it, then people would bother to hack it more.

You are relying on security through obscurity. There are arguments for it, but they are generally frowned upon. Certainly around Slasdhot :-)

Re:Eh?

[falcon5768]

1) nothing is unhackable.

2) Even before these patches you would be hard pressed to exploit any of these bugs just as your hard press to do anything with any of the bugs exposed in the month of fud.... er kernal bugs or whatever that guy called it.

Apple requires a lot of user interaction to exploit anything... on the other side of the coin, a xp box could just surf to a bad site and be completely hijaked if not properly protected from adware.

31 vulnerabilities are 31 less vulnerabilitys OSX has vs XP. Finding more vulnerabilities doesnt mean your less secure or that your software is buggy, the flip side of the coin is very easily there could be 31 or more vulnerabilites in XP that have NOT been found.

Re:Free software is not supposed to be 'much bette

[jimstapleton]

I'd like to find your rational for that statement. OS X is based off of the Mach Microkernel. The FreeBSD people, to my knowledge, never bought into the idiotic "Microkernel on a multipurpose OS" hype.

Additionally, I'm pretty sure MacOS came out before January 2003 When FreeBSD 5.0 was released

Actually, according to Wikipedia, though not the best source available, it was based on OPENSTEP/NEXTSTEP. This also reports the release as 1999/2001 depending on version.

Linux?

[blantonl]

Could someone post a link to this Linux?

Re:Linux?

[bano]

Your at this site by mistake.

Re:Linux?

[Anonymous Coward]

distrowatch.com

31 fixes

[Rik Sweeney]

That's a fix for every day of the month!

Re:31 fixes

[stormeru]

November has only 30 days, maybe the fix no. 31 is for 1 December. Cool! Apple knows the future!

Re:31 fixes

[Anonymous Coward]

Not this month! ;)

Re:31 fixes

[Derblet]

Not in November. :@)

so...

[thelost]

...what is being suggested is that the more complex a system becomes the more points of failure it has - wow, I need me a ticker tape parade.

It's hardly news that if someone goes looking for problems they find them - what is more revealing is the general response to the issues discovered:

Windows: 'well that's what you get when you write closed source crap and you try and bleed money out of your customers'.
Apple: 'That'll wipe the smiles off their smarmy faces'.
Linux: 'Oh we so good - look at how open source instantaneously fixes these problems, cures cancer and helps little orphans'.

all these above responses are of course propaganda (please refrain from using that awful, awful word "fud").

It's ironic that one of the hottest topics on slashdot, climate warming is accused of being one of the most tainted sciences but when it comes to something much simpler, the efficacy of patches on modern systems it turns into the biggest mud slinging match you could imagine.

Re:Free software is not supposed to be 'much bette

[jimstapleton]

Yeah, I mostly could care less what /.ers think in their oppinions. While the news is interesting, and the commentary is often amusing, in the end, I find I go for what works, not what looks good. Certain groups of /.ers tend to follow certain trains of thought that appear noble or righteous, but often ignore many aspects of reality.

Explain yourselves...

[mrn121]

I thought it was a pretty well-established fact at this point that Mac OS X is considered to be more secure not because it is less vulnerable to attacks, but because it is a less desirable target for attacks. Think of OS X as, say, Sweden. It is safe to live in Sweden, not because they have a massive defense system, but because no one cares to attack them. Windows, according to this analogy, would be more like the U.S.: A huge defense system, but every hole in the security matters, because people are actually trying to get through. Anyone who has worked in software (which I imagine many Slashdotters have) can tell you that no software is secure, and anyone who tells you that their software is 100% secure is blatantly lying.

That said, what I really want to know is why big companies like MS and Apple don't explain more fully WHY they aren't releasing patches to known issues. As a software product manager, I spend a lot of my time determining what issues are deserving of patches, and there certainly ARE good reasons not to patch a bug, but I would probably take it an extra step and explain to my clients exactly why the decision not to patch was made. We don't necessarily want patches, we just want an explanation.

Re:Explain yourselves...

[99BottlesOfBeerInMyF]

I thought it was a pretty well-established fact at this point that Mac OS X is considered to be more secure not because it is less vulnerable to attacks, but because it is a less desirable target for attacks.

It's both. Macs don't have the numbers that make botnet operators look to make a worm. They do, however, have a lot of valuable data and make just as nice of control channels as a Linux box somewhere. There are a lot of credit card numbers and the like on Macs. The thing is, they're also a lot harder to get to than on a typical Windows box, so people go for the easy target.

Windows, according to this analogy, would be more like the U.S.: A huge defense system, but every hole in the security matters, because people are actually trying to get through.

Okay, I can see that analogy. And malware is like the Mexican immigrants walking across the border without any problems. It's not in the best economic interests of the US to stop them, just as Microsoft has no real motivation to stop malware. They both like to make noise about it for PR reasons though.

That said, what I really want to know is why big companies like MS and Apple don't explain more fully WHY they aren't releasing patches to known issues.

I think most people don't care. I mean the average Joe says, "they found a hole and fixed it, cool." The security geek already knows the score. So who are they targeting with this info? And what info, exactly do you want?

Re:Explain yourselves...

[brian_tanner]

Sweden. It is safe to live in Sweden, not because they have a massive defense system, but because no one cares to attack them.

Also, until recently (end of the cold war) Sweden had mandatory military service. You might not wan to invade such a country because every single male in the population is now potentially a well trained freedom fighter, unlike other countries where a large portion of the masses can more easily be contained by a relatively smaller military force. Even if the country is small, the strength of its defenses come into play. If it were easy to make spam zombies out of OS X boxes : you can rest assured, people would be doing it.

Re:Explain yourselves...

[femtoguy]

>> I thought it was a pretty well-established fact at this
>>point that Mac OS X is considered to be more secure not
>>because it is less vulnerable to attacks, but because it
>>is a less desirable target for attacks.

I don't think that this is well-established at all. I see it as an excuse, not a fact.

>>Think of OS X as, say, Sweden.

How about this. Consider OS X as like Great Britain. Handguns are illegal. If you live in Great Britain, your probability of getting shot by a handgun is significantly lower than if you live in the US. This is not because there are fewer people in GB (note it is still possible to bet shot in GB, just much less likely).

Windows chooses not to fix major bugs, such as encouraging users to also have administrative rights and allowing execution of arbitrary remote code with full user access. This is the fundamental problem with Windows. Until this is fixed, it can never be a secure operating system, no matter how many or few people use it.

Re:Eh?

[joshier]

I was being stupid, but thanks for your detailed explanation.

Serious question, do you know anything I can do to make my windows XP secure?.. I used to have Agnitum outpost firewall but it really pissed me off, so I'm not using any firewall at all now.

Thanks.

Change of the times

[RootWind]

The days of cracking just for "fun" or "reputation" are mostly over. Malware is driven by money now. Botnets, and spyware are the name of the game. No point in disabling ("owning") computers with malicious code when you can just silently commandeer them to make money. A lot of the malware spreading requires user intervention, which requires a mass audience, and a targeted spreading mechanism (e-mail is still the #1 way to spread).

Re:Free software is not supposed to be 'much bette

[Anonymous Coward]

You: "Microsoft makes such a bloated terrible operating system"
Me: "XYZ in a OSS distro is crap"
You: "Well its free. what do you expect?" Exactly."

Classic example of this linux truth right in this post. Omg some of you linux nerds are unbelievable.

For a perfect explination of way OSS sucks, read http://microsoftisawesome.blogspot.com/2006/11/why -does-open-source-software-suck.html

pfft. quantity of fixes means nothing

[Tom]

I fixed over 50 bugs in my web-game during the past two days. Does that mean I'm less secure than windos?

These numbers mean nothing at all.
First, it's the number of fixed bugs, not of existing bugs. If product A has 500 holes and fixes 5 of them, and product B has 50 holes and fixes 10 of them - these dumbwit journalists would tell you that product A is more secure.

Two, quantity alone means nothing. If product A has 5 remote root holes and product B has 20 spelling bugs - these dumbwit journalists would tell you that product A is more secure.

The worst thing is that they get paid for producing this kind of misinformation. No, wait - the worst part is that there are lots of people out there who don't know technology and actually believe that crap.

Re:Free software is not supposed to be 'much bette

[jimstapleton]

May I ask what you mean by "pre-integration"? It doesn't sound like my reason for using BSD over Linux...

Vindication? Maybe.

[Anonymous Coward]

Apple took a great thing and used it to build a good thing. I think this is a good illustration of that.

People who use or support OS X because it's presumably more secure than Windows should consider taking the next half of that step and just run BSD/nix. Don't go half way if you're looking for a more secure OS; skip the pretty GUI and the skewed user management. Go with the whole advantage, not just the parts Apple left in.

Come and see the snobbery inherent in Linux!

[Anonymous Coward]

From the blurb: Linux (if you need a URL for Linux, you are probably at this site by mistake)

Fantastic! So what the poster is saying is that "If you're on slashdot and you're not a Linux geek you're out of place here".

Out of place as in not welcome for the most part too considering some of the groupthink that goes on.

Just try to get a valid, non-snobbish answer to a n00b Linux question around here. I dare you. Just like the snobs on #Linux. Try it there and you'll get the same.

The day I decided that Linux wasn't for me was the day I went to #Linux and asked for the name of a good distro a n00b could run without pulling out his hair. The response was directing me to DistroWatch or some-such site with nothing more than a list of distros. Out of 40 people this is the lone answer I got.* Great. And yet Linux users still claim Joe Sixpack is welcome to try to adopt? It sounds more like throwing down the gauntlet as opposed to inviting him in.


* Later I tried DSL and Mepis. While I found nothing "wrong" with them I do find overall Linux support lukewarm at best and I don't have the problems with windows that most claim to have. I just don't see a reason to switch yet. Maybe in a few more years when some of the zealots mature a bit and realize that supporting a product is more than just shouting "OMFG~! It's the best, if you don't like it you're just a fucktard!!11!!" and start producing apps a little bit better than Gimp I'll give it another go.

Mac OS X is still more secure, BY FAR.

[Caspian]

"With the growing number of low-level flaws, one has to wonder if Apple's 'more secure' argument still stands."

No, no, one doesn't.

Number of Windows machines I've had to painstakingly remove highly virulent spyware/adware from: Dozens.
Number of Mac OS X machines I've had to painstakingly remove highly virulent spyware/adware from: ZERO.

This is far more than just anecdotal evidence; this is how things go in the real world. In the real world, 50+% of Windows machines are badly infected by spyware, and 0% of Mac OS X machines.

ZERO.

By far the most prevalent security and stability breaches "in the wild" are not rootkits or remote exploits... they're spyware and viruses, both of which are virtually exclusively Windows issues. You can claim that this is mostly or wholly due to the overwhelming dominance of Windows over all other operating systems (in terms of "market share"), but the fact remains.

Until I start getting calls from blue-haired grandmas to hand-pick bits of Hotbar and Bonzibuddy and porno pop-up daemons out of their Macs, I won't buy the "Macs aren't any more secure than Windows" FUD. And neither should you!

Re:Mac OS X is still more secure, BY FAR.

[Phantombrain]

Spyware and Viruses however usually have NOTHING to do with the security of the OS. Most spyware and viruses are the result of stupid users opening the file sent by a zambian buisinessman or downloading every program popups tell them to. There are just less spyware and viruses for OS X since not as many people use it, thus it is not a primary target.

Spyware/viruses do not mean the OS is insecure, but that the users of it are.

Re:Mac OS X is still more secure, BY FAR.

[LindseyJ]

You can claim that this is mostly or wholly due to the overwhelming dominance of Windows over all other operating systems (in terms of "market share"), but the fact remains.

"My argument is right! (If you ignore all those silly facts that make it wrong, I mean.)"

Re:Mac OS X is still more secure, BY FAR.

[99BottlesOfBeerInMyF]

Spyware and Viruses however usually have NOTHING to do with the security of the OS.

Okay, take a deep breath and reread what you wrote. Spyware and viruses are security problems. If the OS does not handle them, then it has not provided ideal security. The OS is responsible for telling users what it is doing and letting them do what they want. If it is sending thousands of e-mails and they don't know, but would like to, it has failed. If they wanted to run a game, but did not want that game to have permission to send e-mail, and the OS did not give them that option, it has failed.

There are just less spyware and viruses for OS X since not as many people use it, thus it is not a primary target.

There isn't as much malware for OS X, but I don't think that matters, fundamentally. That is because if there was as much malware, it still wouldn't be a problem because the OS would deal with it better. Partly this is because the current design is better and partly this is because it would adapt to the threat in response to users. Apple has sales on the line, a lot of them. MS loses little of nothing by not fixing the problem.

Spyware/viruses do not mean the OS is insecure, but that the users of it are.

An OS that is designed to be used by some mythical perfect user in a mythical perfect world and which is not designed for real users in the real world is an insecure failure.

Re:Mac OS X is still more secure, BY FAR.

[lectos]

It has nothing to do with the OS or security. It's all about market share. You can reach more people with a Windows virus/worm/spyware than you can with an OSX virus/worm/spyware. If you want maximum penetration, you hit the one with the most market share.

If OSX had 90% of the home user market as Windows does, then it'd be hit just as hard. Since OSX is closer to 5% of the market, what is the point in exploiting the vulnerabilities?

No system is perfect. I am going to laugh at the stupid people that download whatever they want on OSX without fear. Most of the OSX people that I know do not even run antivirus.....

Re:Mac OS X is still more secure, BY FAR.

[99BottlesOfBeerInMyF]

It has nothing to do with the OS or security. It's all about market share.

Congratulations. As the 100th person in this thread to repeat this assertion it falls upon you to prove it, or at least provide any support for it, since no one else has.

If OSX had 90% of the home user market as Windows does, then it'd be hit just as hard.

Well, this is a possibility, but since it doesn't have 90% market share, why should I care? It's like saying, "Bob's house is no more secure than mine. The locks were made using almost the same process. His doesn't get broken in as much as mine, just because he doesn't live next to a crack house in Detroit." Umm, great, but for anyone considering a real estate purchase, we don't care so much why it doesn't get broken into, only that it doesn't.

Since OSX is closer to 5% of the market, what is the point in exploiting the vulnerabilities?

Well thousands of crackers would love the bragging rights and to shut the mouths of all those smug Mac users who brag about their security all the time. Also, new worm variants are implementing data mining techniques and there are a lot of credit card numbers and passwords on macs. Finally, if making a mac worm is just as easy as Windows, why not add the exploit to an existing worm and grab that 5% rather than adding another Windows exploit that will likely just duplicate the bots you have now?

No system is perfect.

True.

I am going to laugh at the stupid people that download whatever they want on OSX without fear.

So far, those people have been pretty safe, so why laugh at them? Going forward, it looks like they might remain safe since the new MAC framework in OS X 10.5 will likely make downloading and running even random trojans fairly safe.

Most of the OSX people that I know do not even run antivirus.

Most people in Sweden don't carry a gun everywhere since they're more likely to have an accident with it than do something useful. The same is true with Antivirus on OS X. So far there have been two antivirus programs for the system with serious security holes, and no malware for OS X mitigated by them. If malware becomes a problem, OS X will adapt to solve that problem. That's what happens when the manufacturer is not a monopoly and has money on the line.

Re:Mac OS X is still more secure, BY FAR.

[shmlco]

Any piece of software attempting to open an outbound connection, particularly to common port like SMTP, needs to flag the fact to the user and explain, in English, what's going on.

"Tic-Tac-Toe.exe is attempting to send an email, but is not a known email program. Do you want to allow this?"

Re:Mac OS X is still more secure, BY FAR.

[99BottlesOfBeerInMyF]

Any piece of software attempting to open an outbound connection, particularly to common port like SMTP, needs to flag the fact to the user and explain, in English, what's going on.

Yup. It's the last part that I haven't seen done right. As I see it there are four fundamental chunks to this technology

• Application level security restrictions by resource/service
• An index of trust levels for applications, based upon application signing, user specified values, etc.
• A good set of default restrictions based upon those trust levels and tailored for pre-installed apps
• A good GUI that ties into the OS and explains things in English

OS X 10.5 is slated to include at least the first two and I'm hoping for the latter two.

Re:Mac OS X is still more secure, BY FAR.

[weicco]

"The OS is responsible for telling users what it is doing and letting them do what they want" Oh. Maybe then you can fix that wikipedia article: http://en.wikipedia.org/wiki/Operating_system

Re:Mac OS X is still more secure, BY FAR.

[99BottlesOfBeerInMyF]

Oh. Maybe then you can fix that wikipedia article..

Why, it looks fine to me. It specifically addresses the user interface and even GUI as part of the OS. Part of a user interface is effectively communicating what is happening to the user. As for giving them the ability to do what they want within it, that is clearly the responsibility of the OS as it is program management as described by that Wikipedia article. I guess I don't understand what your issues are.

Re:Mac OS X is still more secure, BY FAR.

[Zantetsuken]

the problem I see with even this is simple. most users are simply dumb and/or lazy enough to not take the time to read the alert and simply click "yes" to every dialog box they see. so basically they get one that says (literally) "Do you want to turn your machine into a spam-sending zombie and steal your credit-card info?" [...] user clicks "yes" simply because they want to get back to reading their AOL or other crap email inbox, or go back to reading about Paris Hilton and whatever's going on in some foreign country or other...

Re:Mac OS X is still more secure, BY FAR.

[dreamer-of-rules]

It has nothing to do with the OS or security. It's all about market share. You can reach more people with a Windows virus/worm/spyware than you can with an OSX virus/worm/spyware. If you want maximum penetration, you hit the one with the most market share.

Why would any malware writer target an unexploited segment of several million households that have an above average amount of disposable income? They'd be crazy to waste their efforts, right? Even though, as you suggest, it's just as easy to remotely exploit an Mac OS X system as a Windows system. Right?

This is an old excuse, and it's still wrong. Old Mac OS versions had viruses. I get the impression that you think that all vulnerabilities are equal. That if any vulnerability exists, then the system is insecure. Security isn't just about the potential to get hacked, with the only two choices being "100% secure" and "0% secure". Nothing is 100% secure with finite resources. OS X is "more secure" than Windows because, in normal circumstances, it is much more difficult for a remote and untrusted person to gain privileged access to an OS X system.

OS X IS MORE SECURE, BY FAR, than a Windows system. Here are some of the many reasons:
* There are many fewer open ports and services by default.
* OS X security updates are installed in a timely manner by a simple but effective dedicated application ..whereas Windows requires that the default web browser be insecure enough to install kernel updates, ..and Windows does not automatically check for security updates by default. When they are set to automatically check for updates, either the notification can go unnoticed in the system tray, or the pop-to-front notification can cause inadvertent reboots (by stealing the focus and defaulting to reboot).
* Many services and apps in OS X come from well-tested open source.
* The OS X user is prompted for changes to the system or startup items, even as an administrator.
* It is much easier to be a non-admin user in OS X.
* OS X does not auto-run programs on removable media.

Windows is designed for the Enterprise, which emphasizes remote administration and local user restriction. OS X is designed for local administration and protection from remote commands. Both can be changed, but by default, OS X is far more secure from remote exploits.

Also, because of the way that multi-user is broken in Windows, and the mess that is the Windows folder structure, Windows is less secure from local exploits in practice. My Mac friends find it simple to setup and use separate user accounts for each member of the family, and in the absence of malicious and experienced local activity, they are pretty secure. My Windows friends find the multi-user experience so frustrating that often they don't even bother, or if they do, everyone is an administrator.

In a bank or hospital where significant threats come from malicious employees and have IT departments to manage the systems, I can't say which is more secure, in practice. But for home or small business use, where the security threats are likely to come from outside or from user negligence, OS X is by far more secure.

Re:Mac OS X is still more secure, BY FAR.

[drsmithy]

Why would any malware writer target an unexploited segment of several million households that have an above average amount of disposable income?

Because the ROI is higher targeting several hundred million other households.

* There are many fewer open ports and services by default.

Current versions of Windows have no open ports by default.

* OS X security updates are installed in a timely manner by a simple but effective dedicated application

As they are in Windows.

..whereas Windows requires that the default web browser be insecure enough to install kernel updates,

Every program on your Mac is "insecure enough to install kernel updates" if you run it with the appropriate permissions (just like Windows).

..and Windows does not automatically check for security updates by default.

All current versions of Windows do.

When they are set to automatically check for updates, either the notification can go unnoticed in the system tray, or the pop-to-front notification can cause inadvertent reboots (by stealing the focus and defaulting to reboot).

No, it can't, because the pop up notification doesn't have any buttons highlighted by default.

Re:Mac OS X is still more secure, BY FAR.

[drsmithy]

Any piece of software attempting to open an outbound connection, particularly to common port like SMTP, needs to flag the fact to the user and explain, in English, what's going on.

That's gonna make using a modern computer a pretty painful experience. Heck, if I was prompted about (and had to subsequently approve) every outbound network connection on my PC, my productivity would probably halve, (if not more).

Not to mention it's pretty much guaranteed to make the prompts utterly ineffectual, as users will just be conditioned to clicking "Allow" all the time. It would be like your car prompting you every time you turned the steering wheel.

Re:Mac OS X is still more secure, BY FAR.

[weicco]

Oh. I was being unclear. I meant that internal security section. My opinion, what I've read from books, is that it's not operating system's job to meddle anti-virus, anti-spyware etc stuff. OS just schedules processes, manages memory, I/O and so on.

How can OS know what is a malicious program? I mean, I write "evil script" rm -rf and mail it to someone. Recipient then executes that script. How can OS (or AV-software) know that this isn't what the user wanted? That's an lousy example, I know, but I think it's a clear one. MS could integrate somekind of anti-virus/anti-spyware stuff to Windows but I can only imagine what kind of charges would fly from F-Secure and Symantec and EU after that.

Re:No Wonder Apple Marketshare Is Still Down At 2%

[chia_monkey]

I keep looking for the sarcasm tags here. Where are they? Is this post for real?

Just yesterday I was down working with some developers. There were four rather old G4 Powerbooks and one new (3 months old) PC. Four PowerBooks running flawlessly. PC was already riddled with spyware and viruses and not working properly because of such. These poor people have an unusable computer because of all these security flaws...well...PC-specific flaws. Luckily they kept chugging along on their old Macs while the PC was being worked on.

Not at

[cyfer2000]

I think you forgot to type "Not at".

Linux *can* be more secured...

[netchipguy]

IMHO a technically inclined person can shave Linux down to the bare minimum services relatively easily. There are distributions that focus on rock-solid stability or security, and others that focus on being a Windows replacement.

Troll???

[dwayner79]

Come on... that was funny. I chuckled.

Exactly

[sterno]

If an exploit does nothing more than let you play solitare someplace you shouldn't, then it doesn't matter. And the thing is, even if OS X is only as secure as Windows (which I'd dispute), it's still good for overall security of the Internet. One of the biggest problems with the Internet today is that if 95% of the computers run one operating system, it becomes easier to write exploits that affect the majority of people.

On the other hand, if 50% of the people were running OS X, then no exploit could harm more than half the people at any given time. So in the long run, perversely, OS X is beneficial to the security of Windows.

Mach-O (Macho Man)

[iMouse]

In case anyone happened to miss this on the MoKB site...

Be sure to have your speakers turned on and up.

http://projects.info-pull.com/mokb/MOKB-26-11-2006 .html

"OS X = Sweden"

[Dystopian Rebel]

Think of OS X as, say, Sweden.

I myself think of OS X as Turks and Kaikos. Life is easy, I avoid paying as much "tax" as the majority do, and down on the beach... Swedish chicks are playing volleyball.

Check out Apple's wrongdoing...

[Anonymous Coward]

Here: http://malfy.org/

That's part of why my server is NetBSD on MIPS...

[rthille]

Anything that will trip up attacks (different OS, instruction set) can help. Certainly if there were a determined attacker who cared about getting into my server in particular the 'oddness' of it wouldn't stop them, but for worms expecting the usual suspects it should be enough.

No duh!

[Infonaut]

Perhaps, security-wise, the OS choice really boils down to a 'pick-your-poison X user-base' equation?

Yeah, like, everyone knows that all OSes are, like, equal in all respect. It's not like they were designed differently or anything. It's all just 1s and 2s anyway. Every computer gets cloggged up with worms, viruses, and malware. It's just that there are more Windows users out there, and the Mac users just keep quiet about their virus infestations, so they can keep the Sacret Cult of the Mac going strong. I know plenty of Mac users who have to do clean installs all the time because their machines get so clogged up with worms and viruses. All of these whiners talk like that's not true!

Re:No duh!

[Anonymous Coward]

and the Mac users just keep quiet about their virus infestations, so they can keep the Sacret Cult of the Mac going strong. I know plenty of Mac users who have to do clean installs all the time because their machines get so clogged up with worms and viruses. All of these whiners talk like that's not true! What planet are you on? Mac users keep quiet? Does that mean they've managed to suppress anyone in the world from mentioning any supposed Mac virus/worm? You know plenty of Mac users with machines clogged up with worms and viruses? Do let us know who they are, please, we'd all like to examine the first known OS X viruses and worms. I've dealt with hundreds of Macs even since OS X was released and have yet to see a 'virus' or 'worm'. I'm afraid the truth is very boring, there are none. Fact: At present there are no known OS X viruses or worms in the wild. Fact: For OS 9 there were a few but nothing compared to the 10,000 plus for Windows. Get a life!

Re:No duh!

[shreevatsa]

and the Mac users just keep quiet about their virus infestations, so they can keep the Sacret Cult of the Mac going strong. I know plenty of Mac users who have to do clean installs all the time because their machines get so clogged up with worms and viruses. All of these whiners talk like that's not true!

What planet are you on? Mac users keep quiet? Does that mean they've managed to suppress anyone in the world from mentioning any supposed Mac virus/worm? You know plenty of Mac users with machines clogged up with worms and viruses? Do let us know who they are, please, we'd all like to examine the first known OS X viruses and worms. I've dealt with hundreds of Macs even since OS X was released and have yet to see a 'virus' or 'worm'. I'm afraid the truth is very boring, there are none. Fact: At present there are no known OS X viruses or worms in the wild. Fact: For OS 9 there were a few but nothing compared to the 10,000 plus for Windows. Get a life!

Irony can be either intentional or unintentional...

Re:No duh!

[Infonaut]

Irony can be either intentional or unintentional...

That made me laugh out loud. So true.

Re:No duh!

[dn15]

I know plenty of Mac users who have to do clean installs all the time because their machines get so clogged up with worms and viruses. All of these whiners talk like that's not true! Macs can and do have problems, like all computers -- no argument here. But these problems to *not* include worms or virus infections. I have been working as a Mac tech professionally for about five years now, and I have *never*, and I repeat *never* seen a Mac infected with any virus other than MS Office macro virus.

Dumb

[simpl3x]

Nobody reads the articles silly!

Re:Free software is not supposed to be 'much bette

[b0s0z0ku]

Actually, according to Wikipedia, though not the best source available, it was based on OPENSTEP/NEXTSTEP.

No, it was supposed to be a successor to NeXTSTEP. And both OS's use a Mach kernel. IMHO, it's a poor successor, since NeXTSTEP had a unified filesystem structure. OS X lacks it, instead imitating OS 9 and below in the Finder and being rather UNIX-y everywhere else. And tools like Spotlight work poorly. Spotlight can be controlled (as root only) from a UNIX-shell. But it can't index networked volumes unless they're mounted via the Finder. No automounted volumes for example! Instead, in an office environment using LDAP, you need to automount a scripts directory then have a AppleScript in there that runs via a login job that mounts the volumes via Finder. Then have a script that runs via Cron and makes sure that volume's being indexed. Hopefully this shit will be addressed in 10,5.

Blech.

-b.

Same old "popularity = bigger threat" argument.

[Anonymous Coward]

I would imagine that in a parallel dimension where armoured trucks are by far the most widely used vehicles in the world, with Ford Pintos being a distant second, armoured trucks would be known to have the most flaws and ways to break into them. All of the thieves with no lives who actively exploit these things would be focused on these vehicles because of the immense user base.

See how silly that sounds? Even if armoured trucks were more widely used, it would not imply that they would have the most vulnerabilities. It would still be easier to break into a Pinto, and I am certain that there would be far more "flaws" for the Ford. The same goes for *nix. It's been designed with security in mind, like an armoured truck. That doesn't mean it's perfect -- social engineering (ala "give me your root password") will still gain you access to the driver's seat. But market share does not necessaarily imply greater vulnerability.

Whew!

[cciRRus]

Good thing I'm using Windows. Oh wait...

That's why...

[Mr. Ascii]

I use CP/M. I am not aware of any published security holes for it.

Re:That's why...

[Anonymous Coward]

It doesn't have many published features, either.

Philosophy of pick-your-poison

[bugnuts]

The philosophical differences are that the Linux user base can both find and fix the problems, but closed source can only find and report problems.

Although you multiply poison by the user base, the more people that use Linux the more secure it becomes. The more people that use an OS where the users cannot find and fix problems, the less secure it becomes as an overall platform.

A large part of the problem is finding it, and when a security flaw is found in Linux it is pretty much always fixed So, userbase for Linux is good because they can fix the problems themselves, or report it directly to someone who can.

But when you are sourceless, a large userbase can report a problem and they must depend on someone else to fix it. So, the more people that use it, the more people using it with a particular bug. Usually, the fix timeframe is based on Impact * number of reports, and although Microsoft has gotten pretty good about turnaround time for patches, they used to be horrible and if there's a lack of reports I suspect bugs will go unpatched for quite some time. However, you still have the issue that all closed source has: the user can't fix things for himself and that includes bugs.

Lastly, comparing OSX to Linux and WinXP isn't really fair to Apple... they're still relatively new to the scene and have a lot of bugs to shake out. And when comparing, you can't just say "N bugs in X OS over K days", you have to also multiply this by the impact. 31 local DoS security fixes is not as scary as 1 remote execution fix.

Re:Philosophy of pick-your-poison

[4iedBandit]

Lastly, comparing OSX to Linux and WinXP isn't really fair to Apple... they're still relatively new to the scene and have a lot of bugs to shake out. And when comparing, you can't just say "N bugs in X OS over K days", you have to also multiply this by the impact. 31 local DoS security fixes is not as scary as 1 remote execution fix.

Actually it is perfectly fair. Apple is not new in the OS marketspace. They have experience from the pre-X days, they have Next experience and they are built on OSS in the core from NetBSD and FreeBSD. You insult all the people who have ever worked on all of those projects when you call it "new."

To say they have "a lot of bugs to shake out," does them a disservice and only furthers the FUD. Define "a lot" and compare it to the bugs on all the other platforms.

Everyone loves to point and say, "Ooo look! Apple has security issues too!" Of course they do. The big difference is remote execution fixes. Local user exploits require access to the box and the hacker has to get on the box first. OS X goes a lot farther to preventing that right out of the box. Vulnerabilities that allow external entities to exploit your OS are, in my opinion, far more concerning. Local users are another issue and not a small one at that, but at least I like to be sure that an external attacker can't root my machine directly.

Is there a site listing the number of remote root/admin exploits available for each OS in their default "out of the box" configuration? That would be the real lightning rod to shutdown the "OS X is just as bad as Windows" crowd.

Re:Philosophy of pick-your-poison

[bugnuts]

Apple is not new in the marketplace, but I wouldn't call NeXtstep (Job's baby) an apple product. They are relatively new, as I said, in relation to WinXP and Linux 2.x. OSX was not merely an incremental upgrade from their previous OS's.

To say they have "a lot of bugs to shake out," does them a disservice and only furthers the FUD. Define "a lot" and compare it to the bugs on all the other platforms.

Gladly, and your argument will partially stand up. Remember, though, bugs are often found by users. Virtually ALL OS's go through a phase where huge numbers of security issues are found. I say they have a lot of bugs to shake out because of this newness, and I admit that's my conjecture. I would put a lot of cash that says several more serious bugs will be filtering in over the next year.

Here are some statistics. I wasn't meaning to further the FUD, either. You'll see that, so far, Apple is doing merely "okay". And this is exactly why I was saying you have to judge the bugs by the impact, not just the sheer number of them.

Scroll to the bottom for impact graphs

OSX graphs
winXP pro graphs
linux 2.6 graphs

Note these are not "out of the box" configurations, but merely reports of security holes. So I couldn't provide "default" security status.

Re:Philosophy of pick-your-poison

[4iedBandit]

I wouldn't call NeXtstep (Job's baby) an apple product.

Since Apple bought the remains of Next, it's incorrect to think that none of the Next technology exists in today's Mac OS.

They are relatively new, as I said, in relation to WinXP and Linux 2.x. OSX was not merely an incremental upgrade from their previous OS's.

My memory is faulty, but I think OS X was first released in 2001. So It's been around for 5 years as a commercially available OS. Has Linux been around longer? Sure. To use your example, Windows XP has also been around since 2001 However you're implying that because OS X was not an incremental release, it's buggier. My supposition is that OS X is newer, but the technologies it's based on have been around for quite some time (Next, NetBSD, FreeBSD, etc.) and are very proven.

Here are some statistics. I wasn't meaning to further the FUD, either. You'll see that, so far, Apple is doing merely "okay".

Based on the statistics from Secunia, which you link to, I would say Apple is doing better than "okay." In 2006 there have been 21 advisories for OS X, 39 for Windows XP Pro, and 40 for Linux. When you say "okay" you imply average. However the statistics linked to indicate better than average. Unfortunately those graphs don't indicate virigin, default installations for any OS and are therefore not really useable to say than any one OS is more secure out of the box. Still, the data you offer makes OS X look better by almost half and you still call this "okay?" If this is "okay," what do you call Windows and Linux? Horrendous? What would you call "good?"

I say they have a lot of bugs to shake out because of this newness, and I admit that's my conjecture. I would put a lot of cash that says several more serious bugs will be filtering in over the next year.

And only a fool would take you up on that bet. As long as the software continues to evolve and people continue to use it bugs will be found, even serious ones. However I absolutely disagree with the mindset that something must have more bugs simply because it's newer. Consumers don't have to settle for mediocrity in software.

To further muddy the waters, you also have to take into account QA product management between OS venders. Apple has to be better than Microsoft because of their market share. Apple's reputation is hurt far more by exploits and hardware issues than any other OS/hardware vender. They are motivated to get it right. Will that change in the future? Possibly. When Steve Jobs passes on there's a good chance Apple will lose their way and finally die.

Re:Philosophy of pick-your-poison

[bugnuts]

I stated twice, and you missed it twice: the importance of a bug must consider the impact. Based on the statistics from Secunia, which you link to, I would say Apple is doing better than "okay." In 2006 there have been 21 advisories for OS X, 39 for Windows XP Pro, and 40 for Linux. When you say "okay" you imply average. However the statistics linked to indicate better than average.The raw numbers mean very little ... if you think 21 advisories makes a better OS, you are unintentionally spreading FUD yourself.

If you look at the impact, you'll see that 25% of those Apple advisories result in system access whereas 0% of the 40 advisories for Linux result in system access. I'll take the 40 Linux bugs over the 21 OS-X bugs any day. Apple is doing "okay" as I stated, and I stand by that. They've had 5 system access flaws, therefore they are not outstanding. Linux has had zero system access flaws found this year, if you can believe Secunia. However I absolutely disagree with the mindset that something must have more bugs simply because it's newer. Consumers don't have to settle for mediocrity in software.I'm saying that, over time, bugs are found. But a large majority of the serious flaws are usually found within a year or two after release. It might have fewer bugs overall, but simply because it's newer, those bugs will be coming out sooner.

Also, it looks to me that they cannot leverage their previous OS knowledge to any serious degree. Nextstep, which was based on Mach, cannot apply - it was both based on a microkernel, and on completely different hardware. When faced with things like device driver buffer overflows (Airport bug, e.g.) there's no comparison whatsoever ... different CPU, different hardware, different kernel. And since Nextstep is so old, I'd bet only a small percent of the Next programmers are even working on OSX. They also wrote the 13-sector DOS3.2 for the apple ][ and that doesn't matter either.

You have one point that is not lost on me: a default OSX system is probably tougher to crack than a default WinXP pro system. Unfortunately, I don't have statistics for that but I'd love to see a credible comparison. However, IIRC, there have been a couple recent challenges to break into a default, fully-patched apple system, and all have been cracked within a day or two.

Re:Philosophy of pick-your-poison

[drsmithy]

Since Apple bought the remains of Next, it's incorrect to think that none of the Next technology exists in today's Mac OS.

In fact, one of the best ways to describe OS X to someone who time-warped in from the early '90s would be "Next (or Open) STEP 5.x".

Re:Philosophy of pick-your-poison

[4iedBandit]

I stated twice, and you missed it twice: the importance of a bug must consider the impact.

Mea culpa. Third times a charm though, and I agree with you.

I'm saying that, over time, bugs are found. But a large majority of the serious flaws are usually found within a year or two after release.

By your own measure then, Apple is 3 years past this. So I still take issue with you that OS X will have more serious bugs more often.

Also, it looks to me that they cannot leverage their previous OS knowledge to any serious degree. Nextstep, which was based on Mach, cannot apply - it was both based on a microkernel, and on completely different hardware.

Actually, in the end NextStep ran on Intel hardware. While hardware architectures require different code to run, to say that all software design and development principles don't apply from one platform to the next is simply not true. To say that the Next experience brought into Apple doesn't apply is again a disservice to the people doing the work. The same C code that generates "Hello World" on the PPC will generate "Hello World" on Intel. If everything were still written at the machine level I would concede your point, but modern OS' have long since departed from machine level coding. You may think of NextStep as old and irrelevent, but the fact remains that it was a well designed OS. If something is irrelevent simply because of it's age then you must necessarily get rid of Linux, Windows and every other OS in production today.

However, IIRC, there have been a couple recent challenges to break into a default, fully-patched apple system, and all have been cracked within a day or two.

And if I remember correctly, all were cracked from the inside. Meaning local user exploits. I believe this is what you are refering to. You should also see this in which OS X was not breached in the time the server was available for attempts. Granted I did not do an exhaustive search, but I will still stand by my supposition that OS X is more secure out-of-the-box than Windows.

Will Vista change that? We'll see.

Re:Philosophy of pick-your-poison

[Anonymous Coward]

the more people that use Linux the more secure it becomes...userbase for Linux is good because they can fix the problems themselves

No, the more geek and programmer people that use Linux the more secure it becomes. Do you think typical school admins can reprogram their apps? Can my mother diagnose the SSH exploits? For now, the masses hardly matter.

It Never Did

[RAMMS EIN]

``With the growing number of low-level flaws, one has to wonder if Apple's 'more secure' argument still stands.''

It never did. First of all, you can't compare security of operating systems, because you can't eliminate bias from your tests. Secondly, Apple's OS is closed source, which you can never trust. Thirdly, much of the OS is written in unsafe languages (particularly C, C++, and, perhaps, Objective C - I don't know if the last is unsafe), and thus, the statistical probability that it will contain security holes is high. Finally, I don't think Mac OS X has been so thouroughly scrutinized by security experts as Windows has, so it's very well possible that Windows is more secure by now, regardless of it's starting position. However, we will never know that, because of the first point.

Re:It Never Did

[99BottlesOfBeerInMyF]

It never did.

Sure it did. The "more secure" applies versus Windows though, which is what most people use as the goal post.

First of all, you can't compare security of operating systems, because you can't eliminate bias from your tests.

Select 100 random users of each system and see how much malware they have. It is simple and practical as a real world evaluation.

Secondly, Apple's OS is closed source, which you can never trust.

Lots of software is closed source. Lots of software which is open source is too long and convoluted for any person to properly audit. It's not a matter of trust, just results.

Thirdly, much of the OS is written in unsafe languages (particularly C, C++, and, perhaps, Objective C - I don't know if the last is unsafe), and thus, the statistical probability that it will contain security holes is high.

So? Can you show me an OS where this is not the case? We're talking about "more secure" which is to say relative security.

Finally, I don't think Mac OS X has been so thouroughly scrutinized by security experts as Windows has.

Half of what people think of as the OS, in OS X is both open source and derived from code that has been tested more thoroughly and regularly than Windows. Much of the rest has little room for security holes because it is simply not in any position to cause security problems. OS X is by no means a poster child for a super secure OS, but compared to Windows it is no contest. I know people who have worked at Microsoft and it has given me little or no faith in the thoroughness of their security testing. My understanding is every hole is rated by how serious it is and how many people it effects and more than half of them MS knows about are not even fixed. Apple, on the other hand, has just fixed some holes that affect maybe one in a thousand of their customers and only cause a denial of service then.

OS X is "more secure" than Windows and that's just the way it is. You'd be hard pressed to find an expert that disagrees.

Re:It Never Did

[RAMMS EIN]

If you define security as the inverse of how much something gets exploited, you're right. However, I care about security as in all vulnerabilities, not just the ones that have been found and are actively and widely being exploited, but also the ones that remain to be discovered or the ones that aren't actively being exploited, but could be used by a determined attacker to gain access to my system.

Note that even your test is severely biased: if you find 100 random Windows users and 100 random OpenBSD users, I am almost willing to guarantee you that the OpenBSD know more about security, care more about security, and have taken more and better efforts to secure their systems. It's entirely plausible that such bias would skew the results.

Re:It Never Did

[99BottlesOfBeerInMyF]

If you define security as the inverse of how much something gets exploited, you're right.

Yeah, that's pretty much how I define security all right.

However, I care about security as in all vulnerabilities, not just the ones that have been found and are actively and widely being exploited, but also the ones that remain to be discovered or the ones that aren't actively being exploited, but could be used by a determined attacker to gain access to my system.

If a vulnerability hasn't been found, it can't be used. If a vulnerability exists in a package, but no one ever finds it, does it make a sound... err make me less secure? Nope. Security by obscurity is a valid type of security, just not an ideal one. If you're looking for a desktop OS that is highly unlikely to be exploited for an average user, OS X is a very good choice. It is a much better choice than Windows. If, however, you're not a typical user and you face an extra high risk of some particular threat, like direct attack by talented hackers trying to get your top secret whatever, then you should consider a system designed to counter that threat. Perhaps SELinux or some other locked down system designed with security as the top priority. Most people don't want to use such a system because it sacrifices a lot of functionality and ease of use to gain that security.

All of this, however, sidesteps the issue being addressed which is, "Is OS X 'more secure'." If you're comparing it to Windows, yes it is for general users. If you're comparing it to Solaris for an application in an environment full of homocidal security experts that hate all macs and will instantly attack any user of such a system physically with Uzi's, then no it is not "more secure." I think it is a bit unreasonable, however, to apply those criteria. In the general case OS X is much more secure than Windows.

Re:It Never Did

[RAMMS EIN]

``All of this, however, sidesteps the issue being addressed which is, "Is OS X 'more secure'." If you're comparing it to Windows, yes it is for general users. If you're comparing it to Solaris for an application in an environment full of homocidal security experts that hate all macs and will instantly attack any user of such a system physically with Uzi's, then no it is not "more secure." I think it is a bit unreasonable, however, to apply those criteria. In the general case OS X is much more secure than Windows.''

For your definition of security, yes. And clearly, you consider my definition to be unreasonable. Since this is a matter of definitions, I won't argue further which OS is more secure or if you can ever know this, but I will explain why I use the definition that I use.

You say: ``If a vulnerability hasn't been found, it can't be used. If a vulnerability exists in a package, but no one ever finds it, does it make a sound... err make me less secure? Nope.''

To me, that is tantamount on saying "Our voting machines are perfectly secure; there is absolutely no evidence they have ever been exploited.". This is missing the point. I trust a system if I'm satisfied that it _can't_ be exploited, not if it _hasn't_ been exploited. The point of security is not that it protects against attacks that have already succeeded, but that it prevents future attacks from succeeding.

Another way of seeing it is that, while successful attacks demonstrate that a system is insecure, nothing demonstrates that a system is secure. It's like theories in science: we'll use the theory for which no counterexamples have been found, but we never know that nobody will ever find a counterexample, proving the theory wrong. No amount of experiments that yield the results predicted by the theory ever proves the theory right, because we can't run _every_ experiment. Same with security: you can't run _every_ attack, so you will never know the system is secure, but someday, somebody might run an attack that succeeds, and your system will have been compromised. If it can be compromised, it's not secure. At least, that's my definition.

"More secure" and "less secure" implies that you have some scale on which you put systems, so that one system can be higher on the scale than another. I claim there is no such scale. Is Windows less secure than OS X, because we know more vulnerabilities in the former than in the latter? Is absolute space more wrong than the solar system model of the atom?

Re:It Never Did

[99BottlesOfBeerInMyF]

You say: ``If a vulnerability hasn't been found, it can't be used. If a vulnerability exists in a package, but no one ever finds it, does it make a sound... err make me less secure? Nope.'' To me, that is tantamount on saying "Our voting machines are perfectly secure; there is absolutely no evidence they have ever been exploited.".

This is not true. We were discussing vulnerabilities that have been discovered, not vulnerabilities that we know have been discovered. I can see where you are confused by the distinction.

I trust a system if I'm satisfied that it _can't_ be exploited, not if it _hasn't_ been exploited. The point of security is not that it protects against attacks that have already succeeded, but that it prevents future attacks from succeeding.

Any and all systems can be compromised. What concerns a rational person is not this fact, but the probability of that happening. Past exploitation is a good indicator of possible future exploitation.

Same with security: you can't run _every_ attack, so you will never know the system is secure, but someday, somebody might run an attack that succeeds, and your system will have been compromised. If it can be compromised, it's not secure. At least, that's my definition.

Okay, but since it is an unknowable quantity it is also completely useless. By that definition all OS's are insecure. How does that help me make decisions?

"More secure" and "less secure" implies that you have some scale on which you put systems, so that one system can be higher on the scale than another. I claim there is no such scale.

Fine, but then the proper response to the question "is it more secure" is not "no." The proper response is "your question makes no sense according my definition of security since nothing can be 'more secure' than anything else."

Is Windows less secure than OS X, because we know more vulnerabilities in the former than in the latter?

According a useful definition, yes. A reasonable assessment of the two indicates that in general use the former is more likely to be compromised than the latter. That's how people make decisions, by using reasonable predictions based upon the current information.

Re:It Never Did

[RAMMS EIN]

``Any and all systems can be compromised. What concerns a rational person is not this fact, but the probability of that happening. Past exploitation is a good indicator of possible future exploitation.''

I disagree (except with the middle part). I do believe it is possible to have systems with no exploitable holes in them, and I do not believe past exploitation is a reliable indicator of future exploitation: it's entirely possible that holes exploited in the past have been plugged, and no future exploits will occur, or that no past exploits have occurred, but future ones will.

Re:It Never Did

[99BottlesOfBeerInMyF]

Well, I think we've pretty much exhausted the discussion. We have a few fundamental disagreements. I don't think it is possible to create a perfectly secure OS, given the nature of the system. I think we can come close but anything happening in the physical world is subject to randomness and complexity at higher levels. I also feel that past exploitation is one good indication of future exploitation. It does not make it certain, but OS's are created by process and individuals. Past exploitation shows behavioral patterns of both attackers and designers and as far as I've seen provides a fairly reliable way to predict rates of future exploitation.

Unless some other predictor drastically changes the probability of a random OS X box being compromised is small while that of a random Windows box is high.

Re:It Never Did

[5plicer]

much of the OS is written in unsafe languages (particularly C, C++, and, perhaps, Objective C - I don't know if the last is unsafe)

I suppose you'd prefer an OS written in Java or Haskell? C is THE language for kernel development. What the hell do you think Linux and BSD where written in?

Re:It Never Did

[RAMMS EIN]

``I suppose you'd prefer an OS written in Java or Haskell?''

Yes, actually, although they wouldn't be my languages of choice.

``C is THE language for kernel development.''

Arguably, but then, the kernel is only a small part of the OS...and it could be even smaller than is currently typical.

``What the hell do you think Linux and BSD where written in?''

C. That's why they have all those security holes.

Re:It Never Did

[5plicer]

What would be your language(s) of choice?

Re:It Never Did

[RAMMS EIN]

I'm very picky (i.e. a perfectionist), and I've found something wrong with every language I've tried. That's why I'm working on a language of my own (Mana), but progress is slow, as I'd rather take a few extra years and have a better result than rush things out the door.

I get a lot of pleasure out of programming in Ruby. It has a few quirks, but the big problem is that implementations are so slow. Maybe with Ruby 2.0 this will all be better. At any rate, a lot of the software I use on an everyday basis (especially for email) is written in Ruby (by me).

OCaml is a language I could actually write an operating system in. It's closest to ideal of all languages I've found. A friend of mine was actually writing some code to allow drivers for Minix 3 to be written in OCaml. I would have gladly written some drivers afterwards; unfortunately, he abandoned the project.

I'm also a big fan of Common Lisp. People complain about its parentheses, but once you get over that, it's a very powerful language, and, better yet, you can easily extend and adapt it. There actually is an OS being written in Common Lisp: Movitz.

bit of perspective

[webbod]

The issue is having an actual usable vector for mass-propogation, resulting in the massive downtime and recovery time, billions of dollars of lost productivity, and tens of thousands of manhours in remediation.

Let's face it, even if you had something as highly virulent and damaging, so few organisations rely solely on Macs and they make up such a small proportion of pc's out there, that although it would make headlines, it would be unlikely to have much of an impact on the global economy. Windows viruses can cost billions of dollars because they can infect hundreds of millions of machines.

It really all comes down to...

[leamanc]

...the user security model. *nix-based systems like Mac OS X, Linux and *BSD are just truly multi-user systems with security in mind from the beginning. Granted, networking and kernel bugs can still exist, but it's just a lot different with Windows.

Windows was designed to be a single user system (like pre-OS X versions of Mac OS), and has just had supposed "multi-user" capability grafted on to it over the years. It is my understanding that they wanted to go the *nix way with Longhorn/Vista, but it just was too darn hard to maintain precious backwards compatibility. I could be wrong, because I really know jack crap about Windows. I have Parallels/XP on my MacBook for testing, and that's about it. Any Windows zealots (are there *any* here?) please feel free to correct me if I'm wrong about this pseudo-grafted multi-user security thing. I'm proud to be an IT pro who can honestly say "I don't do Windows."

The authorization box in Vista sounds all wrong, and another futile attempt to copy the way *nix GUIs do it. The fact that they've tried to make a bash-like shell replace the DOS shell, along with the constant aping of the Aqua interface just shows that although they own the desktop market, they still fail miserably at stealing all the good ideas.

Guess I've gone off topic somewhat, but someone please at least mod me Interesting because the main point is security in Windows vs. security in *nix is just two entirely different ballparks.

Re:It really all comes down to...

[drsmithy]

Windows was designed to be a single user system (like pre-OS X versions of Mac OS), and has just had supposed "multi-user" capability grafted on to it over the years.

Windows NT was designed and build from day one to be a multiuser OS. Back when Apple were working with System 6 and 7.

I could be wrong, because I really know jack crap about Windows.

You're hiding it well.

I have Parallels/XP on my MacBook for testing, and that's about it. Any Windows zealots (are there *any* here?) please feel free to correct me if I'm wrong about this pseudo-grafted multi-user security thing.

Happy to help. You're wrong.

I'm proud to be an IT pro who can honestly say "I don't do Windows."

Proud of being ignorant ? How "IT Pros" have changed...

Guess I've gone off topic somewhat, but someone please at least mod me Interesting because the main point is security in Windows vs. security in *nix is just two entirely different ballparks.

Indeed. The security in Windows is vastly more capable than the security in traditional unix.

Re:It really all comes down to...

[leamanc]

Proud of being ignorant ? How "IT Pros" have changed...

So I can infer from your question that being ignorant of Windows does not make one an IT professional? Just because I happen to sysadmin and provide desktop support to 300+ Mac OS X, Red Hat/Fedora, and Ubuntu/Kubuntu boxes, and refuse to work with Microsoft products, I'm not an IT professional? I didn't realize the knowledge of Windows was mandatory.

Personally, I thought times had changed when people weren't brainwashed to use Microsoft products. Guess being a *nix guy 10-12 hours a day just doesn't qualify you as a pro. Times have indeed changed...

Re:It really all comes down to...

[drsmithy]

So I can infer from your question that being ignorant of Windows does not make one an IT professional?

No. You can infer that I wouldn't consider anyone proud to be ignorant of anything IT-related an "IT professional".

Re:It really all comes down to...

[leamanc]

Well, call me a snob or whatever, but I absolutely abhor Windows and am in a position to work exclusively with OS's that I like. Maybe I should have picked another way to say it. Maybe I shouldn't say I'm proud of it, but I'm very glad to not have to work with Windows.

On the point of "grafted-on" security, I'm sure that I've read it on Slashdot many times that the administrative structure is something like that, basically the opposite of the *nix way. But since nobody on Slashdot (who usually foam at the mouth to bash Windows' security model) wanted to back me up on it, I'll take your word for it. I stand corrected.

Re:Eh?

[b0s0z0ku]

Serious question, do you know anything I can do to make my windows XP secure?

Don't go to skeezy sites - porn indices & poker. Stick it behind a hardware firewall. I'd use a LinITX box running IPCop and Copfilter, but that's just me. Run good antivirus (Avast or Kaspersky seem to work for me, Norton/McAfee worked poorly and slowed things down too much).

-b.

Re:Free software is not supposed to be 'much bette

[NatasRevol]

You really want to have 500 network home directory users indexing your fileservers, possibly all at once?

Seems a bit harsh on the server.

I see your point for indexing some data volumes, but they're not typically automounted, unless you have a very static user profile.

Re:Eh?

[joshier]

Well, I only use firefox, opera, thunderbird and Gaim for msn/yahoo.

I don't visit porno sites, nor use p2p.

I have a hardware firewall (router one) and try to keep the open ports forwarded to a minimum.

I don't have an anti-virus either, but was wondering if there's a good software firewall someone might suggest, but it looks like those are rubbish and that you're better off with a hardware one.


Thanks

Re:Free software is not supposed to be 'much bette

[b0s0z0ku]

You really want to have 500 network home directory users indexing your fileservers, possibly all at once?

It doesn't have multiple computers index at once, believe it or not. It uses a protocol that designates one of the computers using the root directory of the resource as a "master" indexer, the others are "slaves." After the indexing is done, the copy of the index on the resource itself is "published" to a local copy on all the computers connected to the resource - that local copy is periodically updated. Since the kernel tracks file changes and sends them to the master index, indexing in theory is only needed once if all of the computers connected to the share are running Tiger or better. I have it re-index biweekly just to be safe.

-b.

Well

[Shivetya]

An amount of the security Mac user's experience is simply because your not a big enough market to have fun with yet. No set of programmers is going to beat out users for finding ways to make their system vulnerable. There is value in not being noticed by the hacker community, don't spend it. There is also value in not being as exposed to people who should never have had a computer in the first place.

Re:Well

[deesine]

Given the amount of more-secure-Mac bragging and the egoistic nature of many hackers, I find the belief that Macs are more secure simply because of a smaller market share an oversimplification. The hackers that I know are not only motivated by money. They hack things just to say they have. In that regard osX is the holy grail, and no knight has claimed it, yet. But that's not for lack of trying.

Re:Free software is not supposed to be 'much bette

[Weedlekin]

"OS X is based off of the Mach Microkernel"

"based off" isn't the same as "is", because the OS X kernel (XNU) isn't a Microkernel. This Apple document says as much:
http://developer.apple.com/documentation/Darwin/Co nceptual/KernelProgramming/Mach/chapter_6_section_ 1.html#//apple_ref/doc/uid/TP30000905-CH209-TPXREF 101

Here's the relevant quote:

"in Mac OS X, Mach is linked with other kernel components into a single kernel address space. This is primarily for performance; it is much faster to make a direct call between linked components than it is to send messages or do remote procedure calls (RPC) between separate tasks. This modular structure results in a more robust and extensible system than a monolithic kernel would allow, without the performance penalty of a pure microkernel.

Thus in Mac OS X, Mach is not primarily a communication hub between clients and servers. Instead, its value consists of its abstractions, its extensibility, and its flexibility."

"Additionally, I'm pretty sure MacOS came out before January 2003 When FreeBSD 5.0 was released"

It did indeed. OS X was (and is) based on FreeBSD 4.4, not 5 as the GP claims. Note though that once again, "based on" != "is", because there are a number of differences between Apples XNU kernel and the FreeBSD one.

I'm sorry, but that's just wrong.

[porkchop_d_clown]

You've got some good points, but this:

Secondly, Apple's OS is closed source, which you can never trust.

is just wrong, which anyone who frequents slashdot should know by now. Apple Open Source includes most of the operating system, and much of the rest is built on other open source projects such as Apache and Mysql.

Heck, if you had looked at the list of fixes, many of them are actually updates to newer versions of open source packages, such as ClamAV.

Re:I'm sorry, but that's just wrong.

[RAMMS EIN]

Did I really say Apple's OS is closed source? I meant large _parts_ of it are closed source. Thanks for your correction.

Re:I'm sorry, but that's just wrong.

[Jerry Rivers]

So which is it? You can't BOTH be right. Either large parts of Mac OS are closed source, or most of Mac OS is open source. Which is it?

Re:I'm sorry, but that's just wrong.

[RAMMS EIN]

I think we can both be right. "Large parts of", to me, does not mean "most of". So large parts of OS X (e.g. the whole GUI and many (all?) of the applications built on top of it) are closed source, and large parts (most, according to my parent) of OS X (e.g. the kernel, the BSD subsystem, and the command line utilities) are open source.

I have to say that one of those fixes is...

[porkchop_d_clown]

the funniest vulnerability I've ever seen. OS X is vulnerable to arbitrary code execution via a carefully crafted font !?!

On the other hand, the recently announced problem with DMG files is down right scary.

Re:I have to say that one of those fixes is...

[biftek]

I take it you've never written C code to parse any file format....

MS FUD?

[WaRrK]

I've been following Mac news for about 3ish years since I switched. It seems that on the run up to the Vista release there has been a bit of a Spike in "Macs aren't as secure as you think" articles. Is this a stealthy "Get the facts" campaign?....

Security Device

[KenshoDude]

There is a poster where I work. It reads: "The greatest security device ever created." Beneath that is a picture of a human brain. Unfortunately, the human brain is also the greatest security vulnerability ever created.

When you have behavior like computer users with administrator rights clicking "OK" on the "Install smiley faces now!" pop up, the vast majority of security breaches are due to poorly trained computer users and system/network administrators. If OS/X or Linux owned the desktop marketshare that Windows does, it still would not improve the behavior of the users and admins. I haven't found an O/S yet that trains people not to do stupid things on their computers.

Dedicated servers don't browse the web and install weather tracker toolbars, so they are a completely different discussion.

Re:Security Device

[99BottlesOfBeerInMyF]

If OS/X or Linux owned the desktop marketshare that Windows does, it still would not improve the behavior of the users and admins. I haven't found an O/S yet that trains people not to do stupid things on their computers.

For OS X, it might not make a big difference. If Linux had the same market share, however, it would also certainly adapt to allow less competent users to safely do what they want. You can't provide a user with a lousy user interface that doesn't bother to tell him when his computer starts sending thousands of spam messages and that makes it nearly impossible to run some random, untrusted software safely, despite that being one of the main he reasons he bought a computer, and expect the user to change. It's not going to happen. OS's need to be made to accommodate the needs of the user safely, not to force users to stop doing what they want to.

When you have behavior like computer users with administrator rights clicking "OK" on the "Install smiley faces now!" pop up

Allow me to explain in how many ways your OS has already failed. It presented an "OK" dialogue, which is worse than useless, not an actual action, and only conditions users to click the meaningless button. Your user doesn't know they have administrator rights, or even what administrator rights are. They should, by default be logging into a less privileged account. Finally, installing some program called "smiley faces" should not compromise a computer or cause it to be able to silently start sending spam messages without the user's explicit approval. By default any new programs not signed and verified as kosher by a trusted certifier should be run with extremely limited access to all system resources and possibly run in a VM.

Once these issues are solved and the user is presented with a dialogue like 'the program 'smiley_faces.exe' is from an unknown and untrusted manufacturer and would like permission to access the internet in a way normally used to send e-mail and would like access to completely control your computer in every way from this point forward. (stop it from completely taking over my computer forever and sending e-mail)(let it do anything it wants from now on and send e-mail)(advanced options)" and the user clicks the button that lets it take control of the computer forever you can again start complaining about user's behavior. Until that time, please direct your disdain at the improperly designed OS that does not deal with the realities of who their users are or what the computing environment is like.

This is inevitable, but Apple can do better.

[frostilicus2]

I think that this is inevitable. Mac OS X is a desktop OS, desktop customers demand shiny new features and Apple needs to compete with Microsoft in adding such features, otherwise it will fall behind in market share. These new features make for a supremely usable OS, but it means that development is always too fast. Security flaws are invariably human logic errors, and when a lot of new code is written really fast, errors are made. Conversely, take OpenBSD, its pace of development is slow and thorough and due to its comprehensive code audit (which slows development) very few security holes are found in the code. As complexity escalates, so will the number of bugs and until Apple's workforce is replaced with androids (Which I'm sure will have a negative impact on its cool reputation) errors will continue to be made. Although inevitable, we need not accept that there should be quite as many flaws as there are - Apple is in a uniquely privilege position over microsoft in using the unix permission system and the mature core that mach and FreeBSD provides, it must not become complacent. Increasingly, it appears that Apple is becoming sloppy - There are reports of Apple not using automated bound checking and the such. Such arrogance is inexcusable from any developer, and as Apple's popularity increases poor security will invariably become more of an issue. Its time for Apple to seriously take stock of this issue.

Re:This is inevitable, but Apple can do better.

[Anonymous Coward]

mmmmmmmmmmmmmmm.......... buttplugs

Monoculture is the bigest securitythreat

[a-moll]

Why is there almost an endless number of malware for windows, and hardly any for mac. Is it because Mac has less holes? NO! It has nothing to do with this (I will moderate this statement later). The reason is that 95% (more or less) of users are running windows, and the rest is all other systems. What has this to do with it you ask? Try looking at it from Joe Hackers perspective. He wants to get lots of zombie computers to send spam to make money (this is a typical Hacker of 2006, hackers aren't what they used to be). The question he then asks himself is something like: "How can I get most zombies for the least amount of work? Lets see. If I make a website attacking all the visitors running safari on osx i'll get about 10-20, if I on the other hand attack IE on Windows I'll get 1-2 thousand. In other words: using 1 hour to attack safari on osx gives me a little money. Attacking ie on windows gives me MUCH money" I wonder what he chooses to do?
Security is chiefly NOT a technical issue, its a human issue, as it is humans that initiate security-attacks.
On the other hand, if it, technicaly, is a thousand times easier to attack mac than a windows, then it will be worth while to atack macs to.
The biggest reason we have so much spam in our mailboxes is windows and its marketshare, and its userfriendlyness.
I've stopped helping friends with windows that dont run an antivirusprogram. This I tell them is the hidden cost of running windows, and it has nothing to do with windows being technically inferior to mac securitywise, its purely numbers.

All I hear is Charlie Brown's teacher

[joebagodonuts]

I can't hear you because I have my Powerbooks in my ears.

Apologies to Patrick Roy for stealing his quote.

Not really

[Anonymous Coward]

my OSX work machine was just discovered to be a spam zombie spewing out half a billion UBE's per week.

Not so funny. Earlier this year, one of our local lusers turned on the webserver on his G5, and installed PHP and TikiWiki without telling IT. We learned he was using it when TikiWiki had a major security hole found a while back, and the machine probed 130k IP addresses in Brazil before compiling a spam proxybot. Fortunately, it only sent out a few thousand pieces of spam before NetOps came over and confiscated his machine.

He was lucky he zealously backed up all of his files regularly to DVDs; if it had been to a hard drive, they'd have taken that for inspection, too.

Run with minimal privilege.

[emil]

In addition to the points above, do not browse the internet with the Administrator, root, or admin accounts. Do not use these accounts for day-to-day work.

Under OSX, the admin account(s) have the privilege of writing to the root directory (which is unusual, even though sticky-bit protected). With the growing number of UNIX-functions assimilated into non-standard Apple software (/etc/passwd, /etc/inetd.conf [launchd], etc.), the security of the admin user should not be trusted or used unwisely.

Under Windows, create restricted users that do not have the power to install software and use those for day-to-day work (even a "power" user is too much). Use "Run-As" to elevate privilege when necessary. If you have a piece of suspected malware, run it as a restricted user or on a throwaway machine.

Windows (and I mean the VMS-derrived NT family) actually has the more flexible and powerful security environment, and it is quite good when used properly. It is a shame that the OS is shipped with all security disabled.

[Offtopic] New Asterix movie == teh suxx0r

[empaler]

Seriously, I just can't stop hating that movie. 15 minutes into the movie I considered getting up, walking to the nearest train station, catch a train to France (I live in continental Europe), and skin Uderzo and Goscinny alive for allowing that story to see the light of day.
I considered strangling them, but peeling the skin off of their arms and forcing them to eat it seemed so much closer to just. And I'm usually a pacifist...

Then again, their last album should have been a warning.

Taking this further and further off-topic: I miss the old days...

Re:[Offtopic] New Asterix movie == teh suxx0r

[alexhs]

Erm...

Goscinny is dead... since almost 30 years.

And Asterix's adventures are sucking more and more since his death. Check the list.
Now, do whatever you want with Uderzo ;)

You might want to look at Iznogoud, another serie of the great Goscinny...

Re:Free software is not supposed to be 'much bette

[poopdeville]

Tiger's Darwin subsystem is based on FBSD 5.0. See:
http://developer.apple.com/opensource/index.html

OSX server market...

[klubar]

Other than "eating their own dog food" does any major ( > 500 employees) run Mac Servers as their primary web presence? I think the "real" web server market is pretty well locked up by LINUX (not Apple OS X) and Windows. The reason Linux servers (as well as Windows Servers) don't get hacked is that most or the large "juicy targets" are run by professionals and protected by administered firewalls and other technology. These servers have the patches applied and logs are monitored.

Re:OSX server market...

[vindimy]

Amen! Nothing else to add. Go patch your servers and monitor the logs... stop whining about insecure OS's when the real problem is you. YOU!

Root My Mac mini was a fraud

[jscotta44]

The Root My Mac mini event you mention was a fraud and was demonstrated to be so at the time. The hacker was given on account on the machine. While it was pitched and reported as being a "remote exploit" the "hacker" was given SSH access to the machine so that what he really did was have full run of a local machine.

So, come on. While there may be some great examples of OS X vulnerabilities, this is not one.

Re:Root My Mac mini was a fraud

[dave562]

Just for discussion's sake, how many attacks on Windows boxes are really "remote" exploits then? Last I checked they either count on having one of the core networking ports exposed to the internet (137, 139, etc), or they require the client to visit a site that then excutes codes in their browser.

I think that it's pretty safe to say that no matter what OS you are running, the days of truly remote exploits on properly secured boxes are more or less past.

Like I said earlier today in another thread, the biggest threat to network security are the internal users. Those are the folks who are going to be elevating their privledges and causing havok. Unfortunately these days, it is more likely than ever because of the easy availability of exploit information on the internet. Anyone with any sort of inclination to hack a box can spend an hour on Google and get a pretty good understanding of how to run a few scripts to own something. The fact that OSX is now on the list of boxes being exploited goes to show that computers are inherently insecure and it doesn't matter what the host OS is. In fact now that Macs are running Intel chips, every hacker who can write x86 ASM code is having a field day.

Pathetic fan boys

[Cougem]

The above post was +1 informative, because it actually told the truth. And then guess what, it's moderated 'overrated'. WTF? Fuck off, iInsecurefanboys.

You'd think it was a traumatic experience...

[nick.ian.k]

The day I decided that Linux wasn't for me was the day I went to #Linux and asked for the name of a good distro a n00b could run without pulling out his hair.

That's like deciding not to shop at a particular grocery store because you went there the day the customers were all smarmy sophisticates who looked down their nose at you when they saw what you were putting in your cart. If the selection of goods relative to your needs is sub-par and the aisles are full of rat droppings, that's one thing, but what you're doing is pretty far removed from the realm of objectivity.

It's easy to make snap judgments about anything, particularly anything affiliated with a community, based on a single experience that happens to reinforce a stereotype. That doesn't mean it's a fair judgment or an informed judgment. By your reasoning, any of the following assumptions could be true, simply based on encounters that I myself have had which seem to confirm the common wisdom notion of "those people are like that":

-Windows users are corporate shills. Therefore Windows is not for me.

-Mac users are smug assholes incapable of dealing with objective criticism of their platform. As such, I will never own a Mac.

-Linux users are post-script kiddies "working" out of their parents' basement after flunking out of college. Subsequently, I can never use Linux.

-People who code in Perl don't give a damn about producing readable code. Perl will not be a good solution for anything I do, ever.

-Web designers who use Flash don't give a damn about standards, let alone understand them. Flash is a bad solution for everything all of the time.

I've paid witness to many incidents, conversations, and even altercations which suggest the above points, but I've also seen plenty of evidence to the contrary. Similarly, I could say you're prone to making a big deal out of first impressions and allowing them to severely color your general perception of others, but OTOH, you might be an intelligent fellow who does all sorts of great things with his time and throws terrific parties. I'd never know of it because the one thing close to an interaction that I've had with you was reading a comment that didn't come off as particularly well reasoned. If I knew any more about you, I might decide that, say, the car you drive isn't for me, or that any particularly ideology you embrace isn't worthwhile, but that wouldn't be fair, even if I posted-scripted the second-guessing of said generalized observation in a downright snotty fashion.

Re:You'd think it was a traumatic experience...

[Anonymous Coward]

Come on now, you know this goes far beyond a single incident. This is slashdot for god's sake, anyone who's spent a week here knows the game. You're acting like we haven't been around the block a few (dozen) times with this same exact result.

If a user who only knew a non-Windows OS got directed to www.microsoft.com when asking about what version of windows they should get to see how it works was pissed because of the bad responce I would fully agree with them too. And as I did state in my post I did go out and find a couple of distros to try, no thanks to anyone in the linux community, ultimately.

And I certainly did not say that linux was a suck OS that isn't worth investigating. As I stated I found it alright but it had nothing for me to make me want to switch. It's not like I'm snickering at people who use Linux, I'm just not one of them.

But I will say that, for a support community who claims to have tons of talent and a desire to build a bigger user base, the advocates out there are doing a pretty poor job in helping a n00b. Being open minded and honest about knowing nothing about Linux got me nowhere. And it's not like I'm a total idiot here; I know windows, I have a working knowledge of unix but when it comes to which flavor of Linux is best just to get someones foot in the door I have no clue. I'd hate to see what they do to a Joe Sixpack who has no real knowledge of anything outside of XP home.

Re:Free software is not supposed to be 'much bette

[jimstapleton]

"based on" is never "is", based on implies changes to varying degrees.

Also, I thought earlier versions of OS X, at some point prior to X.4, they still had a microkernel. I know threads were actually added to the Kernel in X.4.

Having used both, I know OS X is not the same as FreeBSD, I much prefer the FreeBSD system to be honest, but that's just my not-so-humble oppinion.

What part of FreeBSD did Apple use I wonder? I thought userland was still pretty generic across BSD with only minor changes, the filesystem structure resembles that of FreeBSD less than Linux's, and as I said, FreeBSD never used Mach or any other microkernel to my knowledge.

It seems to me it's more of a sibling than a child.

Re:Free software is not supposed to be 'much bette

[Weedlekin]

This does not seem to apply to the kernel, however. Apple's kernel programmer documentation (which claims to have been updated on 2006-11-07) says:

"Darwin is based on proven technology from many sources. A large portion of this technology is derived from FreeBSD, a version of 4.4BSD that offers advanced networking, performance, security, and compatibility features. Other parts of the system software, such as Mach, are based on technology previously used in Apple's MkLinux project, in Mac OS X Server, and in technology acquired from NeXT. Much of the code is platform-independent. All of the core operating-system code is available in source form."

Link here:

http://developer.apple.com/documentation/Darwin/Co nceptual/KernelProgramming/index.html

If this document is wrong, then Apple are to blame for that, not me.

No difference

[bobdehnhardt]

Perhaps, security-wise, the OS choice really boils down to a 'pick-your-poison X user-base' equation?I'd propose that it makes no difference in the long run. All OSes (or apps in general) have bugs and vulnerabilities. Security-wise, your job is to accept the fact, manage the risk, and make sure it doesn't get out of hand. Dealing with 500 Windows boxen vs. 500 Linux boxen vs. 500 Macs just changes what you need to watch for. You're still sitting on 500 targets, and if the information on those targets is attractive enough, the OS you're running won't matter. You'll still get slammed.

Bugs not fixed fast enough for

[frdmfghtr]

From the CNet article:

However, Apple's update does not address all publicly known flaws in the operating system. Over the past few weeks bug hunters, as part of an initiative called the Month of the Kernel Bugs, have published details on several new vulnerabilities in Mac OS X. One of those was tagged "highly critical" by security-monitoring company Secunia.

"Apple hasn't fixed any of the bugs published during the Month of Kernel Bugs, except for the AirPort issue," said "LMH," the code name of the security researcher who started the Month of the Kernel Bugs. "Apple users are still exposed to any potential risks related to those unpatched issues."

This reads to me that Apple hasn't fixed flaws found in November. As a reminder, the month isn't over yet; bugs can't be fixed instantly. The first impression is somebody whining "we found it, is it fixed yet why isn't it fixed yet we told you about it a whole week ago what's taking so long is it done yet?"

That's just my impression.

Fixes take time and testing; would you prefer that a half-assed fix be put in place?

Re:Eh?

[ScaryFroMan]

31 vulnerabilities are 31 less vulnerabilities OSX has vs XP.

What? This has nothing to do with windows. All this tells us is that OSX has 31 fewer vulnerabilities than it did yesterday.

Unbelievable....

[EXTomar]

for security, you have already lost the battle. Staying(relatively) secure involves a few simple steps that most people still won't listen to:

1. Run a firewall and only open what you need to be opened
2. Most importantly: DONT CLICK ON STUPID SHIT! Don't run seedy programs etc. It's amazed how many Windows users get infected like that

Those obviously won't protect against 100% of threats, but very few things in life are guarenteed.Emphisis is mine where I find it unbelievable people think that this is "advice". The way the modern computer operating system HMI works is "users click on things". Windows and MacOS are designed to present the user with an interface to click on things. What in the world kind of advice is it is to say "don't click on stuff!"??

Browsing files is normal operation. Browsing web pages is normal user activity. Looking at email is a normal user activity. Clicking on objects presented by the shell is a normal user activity. All of these activites are things users do normally and yet are "dangerous by default" in some systems and require a high level of diligence or more (sometimes expensive) software to handle. Stating stuff like "don't click on bad stuff" shifts the blame away from the vendor and onto the user. I'm not saying the user isn't to fault but lets not forget the vendor here since they are equally culpable.

How about this instead: Your computer shouldn't self destruct doing normal user activies. If your computer does self destruct doing normal user activities then it is a bug. Bugs happen in any complex piece of software. What isn't excusable is when the vendor refuses to address the issue. The vendor should fix the flaw. And before you ask, no amount of confirmation dialogs counts as a fix. No amount of "blame the user" is sufficient either.

More specifically: The operating system should handle browsing files without destroying itself. The operating system should be able to handle browsing to web pages without destroying itself. Your operating system should handle looking at email without destroying itself. Your operating system should handle "clicking on stupid stuff" without destroying itself. If the operating system can't handle these nominal activies without a high degree of confidence then it needs to be redesigned and engineered to do. This is not an issue with "users being stupid" but a flaw in the design and engineering.

Baring things like "wear", most people would consider a machine that breaks from normal usage as "flawed". But all too often in Operating Systems when the machine breaks down when the user performances a normal activity it isn't the system but the user's fault. How in the world did we get to this state where the responsibility for function is not on the system designer but on the users??

I do get what you mean in that there should be some "common sense" but on the other hand lets not let the vendors get off the hook because of a lack thereof. The user should have some common sense **and** the vendor should provide a system that is robust, just in case the user's judgement slips.

Re:Unbelievable....

[drsmithy]

How about this instead: Your computer shouldn't self destruct doing normal user activies.

What's "normal" ? How do you propose "normal" is defined in a way that is both flexible enough for real-world usage, but strict enough to be defined programmatically ?

The devil is always in the details

[udamahan]

I love this idea of the "vector for mass-propagation".

A good friend of mine went through the Masters of Public Health program at our local university a few years ago. The one big thing that I learned from him is that the severity of a disease on a population is a function of a lot of factors added together. No one factor can be held up as the most important. The bird flu is very deadly, but is very difficult to catch from another person (so far-- knock on wood). The regular, run-of-the-mill flu will kill more people this year than the bird flu ever has. Why? It spreads easily.

What's the difference between the bacteria in yogurt and the bacteria in uncooked meat? Why does my body care? Why am I confident that neither one will make me sick (as long as I'm cooking for myself)? No two bugs/exploits are alike.

The devil is in the details, and with computer exploits and viruses it seems very similar. The idea of "disease vectors" applied to OSes and software seems so appropriate.

Re:Free software is not supposed to be 'much bette

[Weedlekin]

"Also, I thought earlier versions of OS X, at some point prior to X.4, they still had a microkernel."

It never had a microkernel. The confusion about the OS X kernel comes from that fact that it incorporates elements from Mach 3, which was a microkernel. Apple did not however ever use it as a true microkernel AFAIK, but linked in a whole bunch of other stuff which operates in the same address space, thereby ending up with a sort of hybrid that combines various aspects of both microkernels and monolithic kernels.

"Having used both, I know OS X is not the same as FreeBSD, I much prefer the FreeBSD system to be honest, but that's just my not-so-humble oppinion."

FreeBSD does have some advantages, but IMO Apple are to be lauded for putting an OS with sound UNIX underpinnings onto millions of desktops in a fairly short period of time.

"What part of FreeBSD did Apple use I wonder? "

This list of kernel differences is lifted from Apple's own developer docs:

"Although the BSD portion of Mac OS X is primarily derived from FreeBSD, some changes have been made:

-The sbrk() system call for memory management is deprecated. Its use is not recommended in Mac OS X.
-The Mac OS X runtime model uses a different object file format for executables and shared objects, and a different mechanism for executing some of those executables.
-The primary native format is Mach-O. This format is supported by the dynamic link editor (dyld).

The PEF binary file format is supported by the Code Fragment Manager (CFM).

The kernel supports execve() with Mach-O binaries. Mapping and management of Mach-O dynamic shared libraries, as well as launching of PEF-based applications, are performed by user-space code.

- Mac OS X does not support memory-mapped devices through the mmap() function. (Graphic device support and other subsystems provide similar functionality, but using different APIs.) In Mac OS X, this interface should be done through user clients. See the Apple I/O Kit documents for additional information.
- The swapon() call is not supported; macx_swapon() is the equivalent call from the Mach pager.
- The Unified Buffer Cache implementation in Mac OS X differs from that found in FreeBSD.
- Mach provides a number of IPC primitives that are not traditionally found in UNIX. See "Boundary Crossings" for more information on Mach IPC. Some System V primitives are supported, but - their use is discouraged in favor of POSIX equivalents.
- Several changes have been made to the BSD security model to support single-user and multiple-administrator configurations, including the ability to disable ownership and permissions on a volume-by-volume basis.
- The locking mechanism used throughout the kernel differs substantially from the mechanism used in FreeBSD.
- The kernel extension mechanism used by Mac OS X is completely different. The Mac OS X driver layer, the I/O Kit, is an object-oriented driver stack written in C++. The general kernel programming interfaces, or KPIs, are used to write non-driver kernel extensions. These mechanisms are described more in "I/O Kit Overview" and KPI Reference, respectively.

In addition, several new features have been added that are specific to the Mac OS X (Darwin) implementation of BSD. These features are not found in FreeBSD.

- enhancements to file-system buffer cache and file I/O clustering
- adaptive and speculative read ahead
- user-process controlled read ahead
- time aging of the file-system buffer cache
- enhancements to file-system support
- implementation of Apple extensions for ISO-9660 file systems
- multithreaded asynchronous I/O for NFS
- addition of system calls to support semantics of Mac OS Extended (HFS+) file systems
- additions to naming conventions for pathnames, as required for accessing multiple forks in Mac OS Extended file systems

"I thought userland was still pretty generic across BSD with only minor changes"

The main change that has any impact is the use of MACH-

Why Windows security is terrible and OSX is better

[arete]

Personally I interpret the article summary as anti-Apple FUD. Everyone has security problems, and everyone can do better. I'm not - at all - trying to say that Apple shouldn't be better. They should. But there are two huge problems that make Windows worlds worse than anything else, and will continue to do so until they're actually fixed... Until then, comparing Windows to OS X in desktop* security is merely FUD.

I. ActiveX. ActiveX is DESIGNED to give a web server full control over your machine. With Flash or Java, even if they're enabled a website can only do stuff if they also exploit a - very rare - flaw in your Virtual Machine. In ActiveX, if you let that control run it can basically do anything. They have some checks to try to block the probably-worst applets, but in the end it runs the code unprotected. Until ActiveX is limited to a VM, it should be totally disabled.

I'd personally guess that this alone accounts for more regular attacks than everything-else-put-together. Don't use ActiveX. And if you're not using ActiveX, there's little reason to use IE...

II. Administrator use is chronic. Basically nobody runs OSX in root or sudo-d mode. LOTS of people run Windows routinely in Administrator mode, for a few main reasons: 1) Lots of software only runs that way, and switching is a pain. NO user app should need to be root to run. 2) LOTS of software is very hard to install so a nonAdmin can use it properly, for starters because it only works on the account it was installed into.

I will completely admit that if all the ISVs behaved perfectly 1 & 2 wouldn't be a problem - but it is VERY plausible for Microsoft to exert enough control to make this better for the vast majority of users. Also, I don't believe all these ISVs do it just to be stupid - my guess is that the structure of Windows makes it MUCH easier to do it that way.

  3) Lots of software that shouldn't even need admin privs to install does for no good reason. (I presume because of the way DLLs and the registry work they need to modify system folders even if they're only going to run as a local user - but that's definitely a Windows problem that it's structured that way.) And once you give those pieces of software admin privs, they can do anything - like installing themself as System so you can't kill them even WITH admin privs. All software should be installable with the MINIMUM possible privs. (Obviously system software or a virus checker needs admin privs.)

There are plenty of smaller reasons to be unhappy with Windows security, and I'm not trying to say I love their track record. I didn't address at all the fact that it comes out of the box extremely remote exploitable, (average of ~20 minutes for an unpatched box to be exploited on the internet - and several hours to download the patches!) But those are problems other OSes at least sometimes have and you can make reasonable comparisons. Until the two above are fixed, you shouldn't even COMPARE Windows desktop* security to OS X or Linux.

*Note that I said desktop. While there are some problems, neither of the above super-problems is a server problems. In fact, if you have to choose a server OS, you should probably choose based on what your admin is experienced in - better to have a well administered box than ANY badly admined box.

Why would they?

[Llywelyn]

"""Most of the OSX people that I know do not even run antivirus....."""

Why are smallpox vaccines not given out en masse the way they once were?

Two reasons, one is that smallpox is not an issue for the vast majority of people.

The second is that the vaccine causes more damage over the years and has more side effects than smallpox causes in the same timeframe without vaccinations (particularly throwing into account the question of whether the vaccine would even still work if there were an outbreak today).

Antivirus programs are the same way. In the windows world, the risk of damage from the antivirus program is relatively small compared to the risk of a virus. In the mac world, there have been demonstrated problems with the antivirus programs that are available causing all sorts of nastiness, data loss, and slowdowns on people's systems to a much greater degree and number than has happened by people actually being hit by viruses (or who are likely to be hit by viruses, worms, or trojans in the foreseeable future). This becomes particularly true with the features being added in 10.5.

Why run antivirus when the odds of it doing harm are more likely than the odds of it doing good?

Re:Free software is not supposed to be 'much bette

[poopdeville]

That quote doesn't really deny my claim. FreeBSD branched from 4.4BSD, and that's all the quote seems to say.

Re:Attacks Still Low in Fantasy World

[Gary W. Longsine]

It just makes me so mad, and makes me rant like this every time I read some jack hole on /. spreading FUD about Windows boxes getting owned all over the place.

In the world that everyone else lives in, you can walk into well-administered networks in large corporations with dozens of qualified systems administers and thousands of Windows PC systems, as many as 20% of which in some organizations are running adware, spyware, botnets or worms, and rather effectively Owned by Them (0wn3d b1 Th3m).

If you understand computer security, you know that nothing is 100% secure.

Excellent point. Suppose your network is 99% secure. That means nearly four days a year all your boxen could be owned by them. Alternatively, 1% of your boxen at any given time are owned by them and you don't even know it. The phrase "nothing is 100% secure" should be abandonned. It says nothing useful whilst attempting to intimidate those who disagree.

Boxes get owned because admins are failing to do their jobs properly.

If you provide a retainer, I'll be glad to come to your organization and uncover a few reasons that you could use to justify firing yourself. Preferably, you would learn these things before your manager learns them in the aftermath of your first experience of being 0wn3d.

Pulled?

[99BottlesOfBeerInMyF]

I don't normally reply to my own posts, but I thought it might be interesting to note that apparently Apple pulled the mention of this feature from their Website. I don't know if that means it is not going to be in Leopard or if they're just keeping it all secret.

Re:Attacks Still Low in Fantasy World

[dave562]

Excellent point. Suppose your network is 99% secure. That means nearly four days a year all your boxen could be owned by them. Alternatively, 1% of your boxen at any given time are owned by them and you don't even know it.

You're right, they good be. Snort doesn't seem to think so. The AV software doesn't seem to think so. The users whose computers are working fine don't seem to think so. But ya, you're right... they could be pwnt right now. Hell, right now I'm reading Slashdot with IE... you could be owning my box at this very moment.

If you provide a retainer, I'll be glad to come to your organization and uncover a few reasons that you could use to justify firing yourself. Preferably, you would learn these things before your manager learns them in the aftermath of your first experience of being 0wn3d.

Okay. Then after that, how about you give me the keys to your house, and I'll let you have your first experience with being robbed? =) And on the way out, I'll stop by your garage and borrow your car... don't worry about the keys for that one, I'll make it work.

Re:Attacks Still Low in Fantasy World

[Gary W. Longsine]

Okay. Then after that, how about you give me the keys to your house, and I'll let you have your first experience with being robbed? =) And on the way out, I'll stop by your garage and borrow your car... don't worry about the keys for that one, I'll make it work.

Are you implying that in exchange for valuable security consulting which could save your career you would arrange to have my personal posessions stolen by violating my trust? I don't think I need any clients like that!

Re:Why Windows security is terrible and OSX is bet

[tshak]

Until ActiveX is limited to a VM, it should be totally disabled.

Your problems should be solved in Vista: IE7 Security in Brief. From the blog post:

In IE7, we built a containment wall around IE by running it in Protected Mode. In this mode, IE can browse the web but cannot install software (good or bad) or change settings on the user's computer without explicit user consent. Because the foundation work to make this possible is in Windows Vista, this feature is not available on the XP version of IE7.

Re:Attacks Still Low in Fantasy World

[dave562]

Are you implying that in exchange for valuable security consulting which could save your career you would arrange to have my personal posessions stolen by violating my trust?

Not at all. All I'm implying that me inviting you into my network to do an audit is sort of like me auditing your home security by asking you for the keys to your house.

Not as bad as you think

[sacrilicious]

if I was prompted about (and had to subsequently approve) every outbound network connection on my PC, my productivity would probably halve

It's really not that big an impact. A product like ZoneAlarm (a windows product) produces exactly the situation where outbound connections require user approval... but the user has the option to approve them permanently, i.e. "ALWAYS let MyNiftyEmailClient open connections on port 25". About ten approvals after installation of zonealarm, you never get bugged again, until some virus tries to do something nasty, at which point you're REALLY HAPPY you have this information coming your way.

Re:Not as bad as you think

[drsmithy]

About ten approvals after installation of zonealarm, you never get bugged again, until some virus tries to do something nasty, at which point you're REALLY HAPPY you have this information coming your way.

I think you meant to say "at which point you just click allow like you did the ten times beforehand so the damn thing will work".

The vast majority of end users lack the necessary fundamental knowledge to make educated decisions about whether or not to do things like "allow $PROGRAM to make an outbound network connection".

Re:Not as bad as you think

[sacrilicious]

I think you meant to say "at which point you just click allow like you did the ten times beforehand so the damn thing will work".

Actually I did *not* mean to say that, I meant what I wrote... but I won't niggle, as I do get your point.

I'm perfectly fine with the idea that such software should be easily disabled if any given user finds it annoying or confusing, and I'm even fine with the idea that its default setting be "OFF". But clearly there are users who find the described functionality useful, and on that basis I agree with the idea that OS makers (e.g. Apple, Microsoft) should make it a priority to include such functionality as native to the OS's they distribute. Given a default setting of OFF and/or an easy way to turn it off, there's no reason not to include it; the engineering is simple, so the cost is not a reasonable deterrent to Apple or Microsoft. It's highly needed in the battleground that the internet has become. And I think you'd be surprised how many users who -- despite their finding it confusing at first -- would nontheless want the opportunnity to educate themselves by exploring such functionality. And again, they could always turn it off.

Re:Not as bad as you think

[shmlco]

Again, that's why I said "in English". If a program is attempting to make a port 25 connection, you can easily say "send an email" instead of "make an outbound network connection". And if it strikes you odd that tic-tac-toe.exe is attempting to send an email...

Further, someone like Apple could avoid the 10 prior questions by preconfiguring the firewall to "know" that Safari wants to make web connections, Mail wants to POP and and SMTP, and so on. Further, they could avoid even more false positives and do the same preconfiguration with the major applications from MS, Adobe, and Intuit.

Re:Not as bad as you think

[drsmithy]

Again, that's why I said "in English". If a program is attempting to make a port 25 connection, you can easily say "send an email" instead of "make an outbound network connection". And if it strikes you odd that tic-tac-toe.exe is attempting to send an email...

The problem is it *won't* strike most people as odd that $SOME_PROGRAM is making $SOME_SECURITY_REQUEST. All it will do is annoy the hell out of them they need to do so much fiddling to get comet cursor installed.

Re:Not as bad as you think

[shmlco]

So? Some will get it and some won't. The ones that did you helped, and the ones that didn't could be beyond help anyway.

Or are you in the "if it can't be 100% perfect all the time then do nothing camp?" For that matter, are you a botnet writer/owner, and don't want people protecting their computer at all???

Re:Not as bad as you think

[drsmithy]

But clearly there are users who find the described functionality useful, and on that basis I agree with the idea that OS makers (e.g. Apple, Microsoft) should make it a priority to include such functionality as native to the OS's they distribute. Given a default setting of OFF and/or an easy way to turn it off, there's no reason not to include it; the engineering is simple, so the cost is not a reasonable deterrent to Apple or Microsoft.

I have to disagree that the engineering is simple. Especially when you take wrapping the choices in a good UI (a _critical_ aspect of making the functionality useful) into the equation. If it were simple, it would have been done a long time ago.

Re:Not as bad as you think

[sacrilicious]

I have to disagree that the engineering is simple. Especially when you take wrapping the choices in a good UI (a _critical_ aspect of making the functionality useful) into the equation.

The hooks into the protocol stack are easy (I say this having been a protocol stack engineer for Apple back in the day). As for UI, I think ZoneAlarm is a reasonable baseline, nothing complicated.

If it were simple, it would have been done a long time ago.

The classic "dollar on the sidewalk" fallacy. Someone walks along the street, sees a dollar bill fluttering in the gutter, and thinks, "there can't be a dollar there, because somebody would surely have picked it up." Walks on.

Re:No duh! (correctly formatted, this time)

[dn15]

I know plenty of Mac users who have to do clean installs all the time because their machines get so clogged up with worms and viruses. All of these whiners talk like that's not true!

Should have used the Preview button. D'oh.
Macs can and do have problems, like all computers -- no argument here. But these problems to *not* include worms or virus infections. I have been working as a Mac tech professionally for about five years now, and I have *never*, and I repeat *never* seen a Mac infected with any virus other than MS Office macro virus.

Re:Attacks Still Low in Fantasy World

[Anonymous Coward]

Not the same. He asked for clearance to attempt to violate your network, you asked for access to his house (key). One implies that if your competent your safe, the other says "let me in" with no relevance to competency at all.

30-minute Mac Mini was a stunt.

[Kadin2048]

I remember when that happened; it was widely ridiculed as a meaningless stunt. It wasn't the sort of hack you couldn't just apply to any Mac that's sitting on the Internet, it was more of a privilege escalation challenge that you could apply to a machine that you already had a user account on. So either you'd need to have an account on the machine, or you'd need to have some sort of phishing/bruteforce/social-engineering attack to get a user's password. The take-home lesson was "don't give user accounts to people you really don't trust, duh." It was not a true remote-root or zombification.

I also remember after the press release about 'Hack My Mac Mini,' some fairly high-profile Mac sysadmin (for some uni, IIRC he posts here on Slashdot) announced a challenge in response under more typical circumstances where the machine was exposed to the internet and was running typical services. I never heard about it again, which makes me suspect it wasn't hacked. (If anyone knows what happened to that, I'd love to know.)

Not that the plural of anecdote is data, but I have had a Mac OS X machine sitting with a few ports (usually only 22 for sshd but sometimes also 80 for apache and 25 for postfix) exposed to the Internet for years, and the only thing I've ever had happen to it is that it gets regular bruteforce attempts via SSH. If OS X were as insecure as the '30 minute' claims would have you believe, surely I'd have been thoroughly pwned by now. (In the same amount of time, I've had several Windows machines without any exposed services turn into spam zombies by virtue of IE's ActiveX controls.)

Re:30-minute Mac Mini was a stunt.

[Brendor]

I also remember after the press release about 'Hack My Mac Mini,' some fairly high-profile Mac sysadmin (for some uni, IIRC he posts here on Slashdot)

You're talking about Dave Schroeder from U Wisc. Madison who hosted This Challenge of Mac Security. It got taken down before the challende ended because it was not sanctioned by the university.

Re:Free software is not supposed to be 'much bette

[Weedlekin]

It says nothing about what FreeBSD branched from, but what Darwin branched from (Apple have no control over, or influence on, FreeBSD). The Apple document you cite is a piece of marketing bumph that does not say which parts of Tiger are derived from BSD 5, so it could be just a couple of userland utilities, or a much larger portion -- there's no way of knowing. This technical document on the other hand _specifically_ claims that the kernel is derived from 4.4, and other technical documents say the same about the networking stack and various other bits of core OS X technologies, so unless Apple have neglected to update their documentation for Tiger (doubtful when one considers that other parts have already been updated for Leopard, which isn't out yet), then it would indeed seem to deny your claim.

NB: most Slashdotters give more weight to technical documentation written by the people who are doing the actual programming than advertising material put together by marketers who know little if anything about the technology they're trying to sell.

Re:No duh! (correctly formatted, this time)

[Infonaut]

Macs can and do have problems, like all computers -- no argument here. But these problems to *not* include worms or virus infections.

I agree. I was actually making fun of those who pretend that there are no security differences between OSes.

Reading comprehension time.

[porkchop_d_clown]

Sheesh.

I've been writing C code for almost 25 years now. Including device drivers for OS X.

Did you have your sense of humor shot off in the war?

Re:Attacks Still Low in Fantasy World

[dave562]

You're right. I should have said, "Gimme your address and I'll let you have mine." And then, "I bet it takes me less time to audit your home security than it takes you to audit my network security."

Re:Free software is not supposed to be 'much bette

[demon]

"4.4BSD" is not the same as "FreeBSD 4.4". "4.4BSD", specifically "4.4BSD-Lite", was the last Berkeley Software Distribution release of the OS, after the ATT v. UC-Berkeley case was decided, where the last of the ATT-copyrighted code was excised and rewritten. FreeBSD and NetBSD (as well as BSDi, I believe) used 4.4BSD-Lite as the starting point for their development. NeXT also used BSD (originally earlier iterations in the 4BSD line - 4.2BSD, I think) as its starting point, and was the codebase which the first versions of MacOS X used, though OS X has used developments (mostly in userspace, to my understanding) from both FreeBSD and NetBSD to incorporate into Darwin, and by proxy, OS X.

Off topic, but...

[tlambert]

Off topic, but...

The primary reason AI is seen as unsuccessful is because as soon as some aspect of the problem has been solved and the code works, we rename it to something else: speech synthesis, speech recognition, character recognition, motion capture, genetic algorithms, neural nets, edge finding, adaptive control systems, fuzzy logic, etc. etc..

AI research has been very successful, in general, but in specific it has about as much chance as being recognized as successful as a nuclear power plant has of completing construction under the same regulations environment it was designed in, or a four year lame duck president seeing his "five year plan" followed through to completion.

-- Terry

another data point

[Joseph_Daniel_Zukige]

I've been using a _client_ Mac OS X box as my personal website server for several years now, 80 for apache. I have basically the same results, lots of brute force attempts, no successes.

Re:Free software is not supposed to be 'much bette

[poopdeville]

As demon said in a previous reply, 4.4BSD is not the same thing as FreeBSD. 4.4BSD was the last Berkeley produced BSD distro. FreeBSD branched from it. Here is the quote again:

A large portion of this technology is derived from FreeBSD, a version of 4.4BSD that offers advanced networking, performance, security, and compatibility features.

Emphasis and link mine. Your quote says that OS X uses FreeBSD technologies, and explains that FreeBSD is a 4.4BSD fork. It says nothing about which version of FreeBSD is used in Darwin. Therefore, the quote does not deny my claim.

I will, however, grant that the quote I provided is not particularly informative. But it does explicitly say that FreeBSD 5.0 is in use, unlike your quote, which is completely irrelevant to the issue at hand.

N.B. I'm getting really sick of people with poor reading comprehension. Especially when they don't know what they're talking about. Condescension under such circumstances is particularly irksome.

Re:Free software is not supposed to be 'much bette

[Weedlekin]

"As demon said in a previous reply, 4.4BSD is not the same thing as FreeBSD."

Demon was correct, and I was wrong.

"Therefore, the quote does not deny my claim."

Indeed it does not. Please accept my apologies.

Re:Free software is not supposed to be 'much bette

[poopdeville]

Indeed it does not. Please accept my apologies.

Of course. Please accept mine for my rudeness at the end of my last post.

IE7 Protected Mode is NOT a fix

[arete]

According to your post:

IE7 Protected Mode lets you browse without installing any controls. Which is great. Somewhat better than just turning ActiveX off entirely in an earlier version of IE.

But that does NOT fix the problem. Because with it off things won't work, and it's not going to ship off by default because people will then think it's "broken" Microsoft created the problem with ActiveX security. They can only fix the problem in two ways:

1. Force ActiveX into a tight, tight virtual machine. Which will be a real pain, and the occasional applet will still fail.

2. Turn ActiveX off by default and do it to SO MANY machines that people are forced to replace it on their websites with something else.

(Note, for the purposes of this discussion, it doesn't matter if "something else" is "ActiveX2.0" - as long as THAT _IS_ in a sandbox. Or it can be Flash or Java or Javascript - all of which have potential flaws but all of which are not wide open.)

Re:IE7 Protected Mode is NOT a fix

[tshak]

In Protected Mode ActiveX is not allowed to install software, touch system settings, etc. This is the sandbox you're looking for. Why is this not enough? I didn't read anywhere that indicated that the user can even disable Protected Mode, rather, it's implied that this is the out of the box experience.

Re:IE7 Protected Mode is NOT a fix

[arete]

So, my first point is that I hadn't done a bunch of independent research on Protected Mode - I was using the quote you gave. I then did a little research, and it does seem better than that quote led me to believe.

I have my fears that in the name of installable DRM (protecting the MPAA's rights) or compatibility that they're going to either allow bad things to happen without prompt or - almost as bad - get people so used to the prompt that it's meaningless.

For instance, I ALREADY have to click something to get ActiveX controls to install fairly often. Am I still going to have to click on those? Does that mean they're going to defeat the sandbox, and I can't run them IN the sandbox? Or does that mean that because they can't install I'm going to have to click ok every time I load that page? Do pages that are supposed to be dealing with DRMd music get special privs to make sure you're not ripping the stream? None of these are acceptable... They've left themselves a minefield of problems, but I'll admit that on further research I can't find one they've definitively stepped on.