Slashdot Mirror
Apple's Gatekeeper Still Broken (csoonline.com)
itwbennett writes: This weekend, Apple security expert Patrick Wardle will detail a vulnerability in Apple's Gatekeeper that makes it possible to bypass the anti-malware defense. This is the same vulnerability that was disclosed last April, which Apple said it patched later. Wardle was able to easily bypass Apple's fixes. He says "all Apple did was blacklist the signed apps he was abusing, but didn't fix the underlying issue, which is that, essentially, Gatekeeper functions as a guard that doesn't check" software already on the whitelist.
To be honest, Apple is arguably better at this point than Microsoft was at a similar point in it's lifecycle, from a tech standpoint. Rootless MacOSX is a thing. Gatekeeper, though major holes, is a thing. It's just that back then, the Internet was not as much of a source of riches. There's never been a Slammer work for MacOSX. Nor a "I love you" virus.
You know who else had really bad security reputation? Redhat was horrible in the beginning. You know what famous developer doesn't pay enough attention to security? Linus Torvalds.
Not to skewer MS. Not to skewer Linus or Linux. But realize we're comparing relative bad here. The best OS from a security standpoint is just the least horrible OS on a security standpoint.
Security is hard. How do i patch an infinite state machine against people who can make a lot of money breaking it. It's not a trivial task.