Slashdot Mirror
Mac Developer Mulls Zero-day Security Response
1.6 Beta writes "Landon Fuller, the Mac programmer/Darwin developer behind the 'month of Apple fixes' project, plans to expand the initiative to roll out zero-day patches for issues that put Mac OS X users at risk of code execution attacks. The former engineer in Apple's BSD Technology Group has already shipped a fix for a nasty flaw in Java's GIF image decoder and hints an an auto-updating mechanism for the third-party patches. The article quotes him as saying, 'Perhaps [it could be] the Mac OS equivalent to ZERT,' referring to the Zero-day Emergency Response Team."
The former engineer in Apple's BSD Technology Group has already shipped a fix for a nasty flaw in Java's GIF image decoder and hints an an auto-updating mechanism for the third-party patches.
Windows has an auto-updating mechanism for "third-party patches". It's called Internet Explorer.
The theory of relativity doesn't work right in Arkansas.
I love the idea of zero day patches, it's very... at the risk of being labeled a fanboi, Apple-ish. I know a lot of people are going to be calling for Microsoft to do something similar, but that's not going to happen just because of the sheer number of patches M$ has to put out. That makes the idea of a zero-day response team even more advantageous to Apple because it would give them yet another advantage over Microsoft that Gates just can't match. Definitely a good move on Apple's part, both for its users and for its marketing.
quiet night tonight... not one mac fan boy or anti-mac troll has popped up yet, though im sure its just a matter of time
I started out with nothing and still have most of it left.
Apple isn't doing this, and Landon Fuller doesn't have anything to do with Apple, other than having worked there. (And no, conspiracy theorists, he's not doing this at Apple's behest or as part of some coordinated fanboy effort to "make Apple look good".)
What Apple should be doing is developing a much more comprehensive and responsive security response group, which is lacking now. Apple needs to be patching issues in a much more timely manner. Hopefully the outcome of MOAB, things like Fuller's proposal, and other related things will be a real discourse on Apple security response and Mac OS X security.
No wonder Mac sales are stagnant and Apple is starting to distance themselves from being strongly associated with computers with their corporate name change recently. A few years ago every single Windows user I knew was in some stage of planning on moving to Apple hardware due to the almost constant virus/spyware outbreaks on their systems.
Windows XP SP2 and now Vista have put a complete end to all that talk from the Windows people I know. It has to be well over a year, maybe two, that I had to deal with or heard about one of my Windows using friends talking about their system getting hit.
Apple has really gone downhill in their OS efforts ever since they got dumped by IBM. Security problems that Mac users have never had before, lackluster progress with OS X, and even the much lauded Mac hardware has problems comparable to other x86 OEM boxes. One has to wonder at what point does Apple just throw in the towel on the whole niche OS that is about to explode in userbase any day now and just sell off the useful parts of OS X to Microsoft or some Linux company so they can focus on what they seem to really care about these days - iPods.
Looking at their computers, I can mostly see outdated technologies. For instance, the Mac mini uses the Core Duo which is about a year old. I'm surprised that Intel still produces it in fact, unless Apple overstocked it! Also, keep in mind that the iPhone has been quite a failure, with sales around 0 so far.
That, and considering Vista and the Zune, AAPL is a SELL.
Linux violates 235 Microsoft patents.
Nobody uses Java anymore. It's this big heavyweight ball and chain.
"That, and considering Vista and the Zune, AAPL is a SELL."
AAPL is a sell, but Vista has little to do with the fact. And Zune would actually be a pretty good reason to buy - if the stock was so overbought already. Funny thing about Zune, it was supposed to be subsidized by 360 'profits'. But with the obvious marketplace disaster Microsoft has on their hands with the 360, worse sales than the first Xbox and insanely costly hardware defect problems, Zune was forced to be priced much higher than they ever planned on.
AAPL had a nice run where the street was expecting a massive switch to Macs, didn't happen, and a branching out with digital lifestyle products like the iPhone, which has turned into very public fiasco for Apple so far. Apple has nothing to look forward to spur growth over the slow spring/summer months in either the computer or iPod lines. AAPL is going to go through a slow stead profit taking decline for the rest of the year until Apple can show some life in the computer line or something to expand outside of the current iPod refresh cycle.
Dumping the Mac hardware would most likely be the best move for Apple to get growth and margins growing again.
Almost all of the MOAB bugs have already been patched, including OS fixes by Apple. Some of the application fixes were released within hours of the public announcement of the bug. Yet NONE of those fixes have been linked on the MOAB website.
The normal processes are working. What is NOT working is the MOAB process. If they used the normal procedure of notifying the developers privately, these bugs could have been fixed in days or even hours, before any public disclosure. But that wouldn't achieve what the MOAB hackers wanted. MOAB isn't about security, it's about publicity whoring.
Hello Mr. Enderle, your analysis is scintillating as always.
Although I agree that a Mac OS X worm would be bad publicity for Apple, and that Apple could improve the way they handle response to reported security defects, I think they have produced a reasonable track record over the past five years regarding the basic security of Mac OS X. Apple's security track record is due much more to the relatively weaker security of Windows systems than to Windows market dominance. Windows is low hanging fruit, crack-wise. If it were harder to own Windows systems, crackers would switch to Mac OS X in a flash. Crackers don't need to own 20 million systems, they really only need a few thousand at a time.
If you mod me down, I shall become more powerful than you could possibly imagine.
The claim that the "Mac community is arrogant" mystified me until I realized that people who make this claim are probably masking an inferiority complex of some sort. Most Macintosh users don't know enough about computers to be arrogant. They are, if anything, rather meek on the whole. I suspect that IT professionals whose experience is limited to Windows (which is, after all, most of them) resent the honestly dumbfounded looks they get from these fawn-eyed Mac users who innocently say things like, "Why is my computer at work so flakey? I've never had a problem like this on my Mac at home."
It seems more likely to me that the professional IT community, which has backed the wrong horse, is resentful.
If you mod me down, I shall become more powerful than you could possibly imagine.
Uhm... in case you hadn't noticed, everyone who uses a cell phone in the United States is talking about the Apple iPhone. I'd say the current status of the iPhone is more like: "the most insanely successful publicity coup that has ever been executed by a corporation for a single product."
If you mod me down, I shall become more powerful than you could possibly imagine.
The former engineer in Apple's BSD Technology Group
Not sure I'd trust zero-day patches from a guy who couldn't hack it working for Avie.
Just sayin'.
What does Fuller do for his day job? This is so ludicrous it's not funny. Where are the Apple programmers? I have not laughed so hard in so long. What a bunch of clowns. And Dave Schroeder? It's time to own up, boy. And apologise to that sweet wife of yours. Anyone can see from a mile off how gay you are, so why not just come out and join your friends, Dave? There's nothing wrong with being a gay tool.
Landon Fuller is such a tool. And Apple has forever written itself into computer history as the company that fucked up one time too many. First it releases a Macintosh Unix which still has the industry laughing uncontrollably, and now it's letting its tool fix all its security vulnerabilities. I will venture that in the corridors of One Infinite Loop those morons are so confused right now no one knows what to do, and no one dares say a word, for fear of getting his/her head chopped off by Steve Jobs.
I seriously think Apple just cooked its goose. And I don't think it was the intention of MoAB to do this. I think Apple did it all on its own.
And I think there's one more tool in this scenario: Slashdot. This story is not newsworthy. It seems obvious Apple PR is calling in favors. As in where did Rob get his PowerBook anyway? There is no way this stupid PLANTED story merits attention on Slashdot. Aside from Apple telling Rob to plant it.
auto-updating mechanism for the third-party patches.
He's going to port apt-get to OS X?
"We are all geniuses when we dream"
- E.M. Cioran
On this and the MOAB claims that Apple doesn't fix bugs that are reported thru the official channels.
Show us specific, documented examples of bug reports sent to Apple that they have refused to address.
If MOAB doesn't like the attitudes of some users, then go kick some tires. But exhaust the official channels with Apple or 3d party developers, be professional, or you're going to be dismissed by professionals as dangerous and immature.
Instead, they've come out swinging at not only the Mac community that apparently makes them upset, but also - and more specifically and personally (some quite sick) at the professionals who have been addressing and provising solutions. They've even denigrated Apple for the time taken to provide fixes for the QT issues. Apple has to certify a fix to an OS and underlying technology - not just put fingers in eyes.
"Win treats sysadmins better than users. Mac treats users better than sysadmins. Linux treats everyone like sysadmins."
With the first link, the chain is forged.
I don't see why this shouldn't be done. In fact, it makes a lot of sense for all platforms. Create a third party mechanism by which users/admins can patch Zero day/unpatched flaws that relies on a community effort to provide the patches. Simple. Except it really needs the support of the OS vendor, because at some point, when the vendor releases the patch, you'd want to be able to "turn off" the temporary one. You'd also need an agreed upon "Master List" of vulns, for tracking purposes.
You'd think that this kind of hand-in-hand cooperation would be a no-brainer, but I doubt it. Companies (here's looking right at Apple) still just haven't wrapped their heads around the open exchange of ideas; they are afraid that admitting flaws makes them -look- bad. Ewwww, poor coders. But in reality I think everyone who uses computers by this point in time KNOWS flaws happen...it isn't that they will happen, it has become what are you gonna do about it? And it is pure arrogance by the OS vendors to think that neither the community has the ability to create these patchs nor that the users/admins are interested in them.
Really this is a thing that OS vendors should aspire to, integrating this kind of response mechanism into their existing Software Update suite would be a Good Thing.
Scott
"Hokey religions and ancient weapons are no match for a good blaster at your side, kid."
Yeah... Although I think it's mostly Artie MacStrawman who's responsible for the Mac community's bad image.
And that, folks, is the good side of virus writing.
If you're going to do this, please put a sleep statement in between your 'attacks'. Welchia worked but made no attempt to throttle network connections, swamping every network segment where it was active, and Microsoft's sites as well. If it had taken on one machine every fifteen minutes on a segment, nobody probably would have noticed.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
Well, let's see. The Apple TV product starts shipping this month. The Apple 802.11n base station with multiple shared network disks and printers connected via USB 2.0 is already shipping. Apple's iPhone is a product known by everyone and it is not even scheduled for release until June. Apple's stock reached an all-time high in Apple's history just a little over 2 weeks ago and is holding steady at a reasonable 15% decline after profit taking. No, I would say you desperately want Apple's stock to do poorly for some reason, but you can't really come up with a compelling scenario.