My desktop is Linux because it works, it's fast enough, it does what I want, it doesn't restrict me in any way, it's free, it's Free, it doesn't blue-screen, crash, corrupt and die every few months/years, I can leave it running overnight and not worry about if it'll crash before it finishes it's downloads, I can access it remotely (a good thing when you're working behind restrictive child-safe proxies all the time), and I can do things without wizards, dogs and paperclips jumping up to "help me find a file".
My desktop was FreeBSD because all of the above, plus I don't have to spend any time at all dealing with Linux, which has turned into a differently shaped mound of disconnected organs every time I tried it. Oh, not right away, but eventually I'd need to get in and tweak something and pow, there I am, back in the dependencies from hell... no, I can't install this because it needs a new version of that and this other thing breaks on the new API.... Now it's OS X because of all of the above (except it's not free-as-in-beer) PLUS I can actually buy software to do stuff that's too damn annoying and boring for free software people to spend their time on.
Is it ever going to be even remotely as vulnerable as Windows?
It could be, but it would take some really amazingly stupid decisions to do it. And so far Apple's avoided making those decisions when they had the chance.
People, this meme is dead. It should be an ex-meme. Only Microsoft Apologists still argue that it's market share that makes Microsoft a stinking pool of viruses.
will they do a better job at it than say, microsoft?
They're already doing a better job of it than Microsoft.
The reason that Microsoft has all these viruses is real simple. Internet Explorer is designed to let people push native brinary code into your running browser window and execute it. That's what ActiveX in the Microsoft HTML control is all about.
This was Microsoft's World Domination Plan in the late '90s. Everyone was going to use ActiveX components and Active Scripting and nobody else was going to be able to compete with their own browser.
It didn't happen. What *did* happen is that if you can let good people push code into your browser window, then you can't keep bad people from doing the same thing. You can make it harder, with "security zones" and certificates and dialogs and "are you sure". But it only takes a very small percentage of the users saying "OK, infect me" and suddenly you have a HUGE virus problem.
NOBODY ELSE IN THE WHOLE WORLD does this.
Will Apple do something similar? Not yet, they haven't. They've made a few little mistakes in the browser, but nothing like what Microsoft did.
Itanium won't ever be low power for the same reason that G5 and P4 won't ever be low power... the chip is all about long pipelines and running very very fast.
Remember the OS X transition? Within 2 years Jobs is up on stage sticking OS9 into a coffin and killing hardware support for the thing.
Except he didn't. You could still buy a Mac supporting OS 9 last year. If Jobs could just kill OS 9 when he wanted to, it would have been killed back in 1997 when it was called OS 8.
both Apple and ISV software support for PPC is going to start dying off in 2008.
Why? Unlike the 68x-PPC transition or the OS9-OSX transition, there's no cost to building 2-way applications. This one's using a development environment designed from the beginning, almost 15 years ago now, for supporting multiple platforms. It used to build them 4-way: 68k, x86, Sparc, and HPPA. 2-way is trivial.
I wonder if a less priveleged account could exist entirely within a chroot/Jail-type sandbox.
That would be a sandboxed account. Whatever privileges it has inside that sandbox are still actual privileges.
My colo box lives in a FreeBSD jail on someone else's box. I can have root in that jail, but I can't access anything outside it.
See, a sandbox really doesn't fit in the "discretionary access control" model where priviliges apply, it's more of a "mandatory access control" environment where security classifications. A sandboxed process can't even know about anything outside the sandbox (its classification is 'untrusted'), and the only way for it to find out anything about the outside system is for an application outside the sandbox to move objects into it (declassify then).
You really can't build a sandbox just using discretionary access control techniques.
Microsoft just provides a minimal set of options common across all of them,
The Microsoft options take up two of the three rows of tabs on my PC. The ATI-specific options are in the minority. The only "nested window" is the Advanced window itself.
I've never felt the urge to tweak the windows driver to lie about features to various running apps to see if they perform better, I expect when paying $50 for a game that they have tested against the video card I have and have figured the best settings themselves.
It's not the performance of the video card that's the problem. It's the display. Particularly CRT vs LCD. For example, I do find myself tweaking the settings to get the best image on my LCD at the office. At home I've got a really nice Sony Trinitron so it more "just works".
I'd like to see them add an interactive egress filtering interface to IPFW like the one I purchased from Objective Development
I can think of a bunch of easy ways to avoid egress filtering, particularly when most of your apps are in Objective C and Rentszch has documented so well how to insert a thread in a running application.
The firewall's controls are inside the security boundary protected by the firewall, so once you launch code inside the firewall attacking the firewall itself becomes possible. The bad guy would probably need to find a local root exploit first, so this is less of an issue than on Windows (where there's already viruses that disable antivirus software, for example) but it's a general weakness in all egress firewalls running on the firewalled computer itself.
I'd like to have one on a per-user basis, though... it would make your next idea more useful:
and maybe add hooks to Fast User Switching to encourage its use as a sandbox environment.
Any sandbox that isn't secure enough to prevent me from running native code isn't secure enough to prevent me from using your computer in a botnet for spamming or DOS attacks, or to prevent me from using a local exploit to get out of the sandbox... and while local exploits are harder than on Windows (where they're practically unnecessary) they're still too big an exposure.
Something like a FreeBSD "Jail" or a VMware session, where the sandboxed app doesn't have access to any non-volatile state you can't safely delete, would be better. Or chroot combined with the per-user egress firewall, though you need to be really careful setting up the chrooted environment.
I wonder if using MOM to run OS X under OS X would be an option? Like a sacrificial host (your iBook) it doesn't help with the "stupid dialog" problem but it sure gives you a useful tool when you're concerned with a social engineering attack.
the added stuff in the root password request box are not in the form of added stuff to click through, just more info shown in the existing box
Ah. Probably I'm confusing this with the dialog in Dashboard to ask before running native code components.
THe big problem with OS/2 is that IBM started out doing it in partnership with Microsoft with the intent that it would basically be "the 32-bit version of Windows", and Microsoft pulled out in the middle of the game and went off with their own 32-bit Windows plans.
BeOS and OS/2 are just two examples of why I believe commercial operating systems that don't go by the name of Windows currently cannot work in the x86 mass-user field, thanks to Microsoft.
The conclusion may be valid, but BeOS and OS/2 both had bigger problems to deal with than just not being Windows. And remember, Schiller also said "Who knows what the future holds?"
Normally I'd agree with you, but your "displays" example doesn't really hold water.
go find a Mac and look at the "Display" control panel. Then compare this to the windows equivalent clusterfuck
Hmm. On my Mac I have "Displays" and "ATI Displays". On my PC I have a "Display" control panel that seems to combine the Mac "Screen Effects", "Desktop", and "Displays" panels... and in Panther Apple for some weird reason merged "Screen Effects" and "Desktop" into "Desktop and Screen Saver" making the Mac and Windows experience more similar.
Going back to my PC, the equivalent of the "Displays" control panel is the "Settings" pane on the "Display" control panel. It's absolutely identical on every PC I've used, and provides about the same basic controls as the "Displays" control panel with a slightly different layout.
Then there's an "Advanced" button. This brings up a dialog provides more features. Some of these features are common to all PC video drivers, others only show up for certain models of cards (for example, a card that doesn't support OpenGL or DirectX doesn't have settings that only make sense on those kinds of cards), but when they're there they're pretty much the same whether it's an nVidia or ATI card that's got those features. There's also a set of tabs with an ATI logo on them. These correspond to the tabs on the "ATI Displays" control panel, but they're a superset of the ones I have on the Mac.
That last bit is interesting, because even when I had the PC version of this video card, the control panel still gave me access to more features than the Mac control panel does. And, it has the same hardware as the PC version of the card: it's actually possible to use the ROM image from my card to flash the PC version and make it work in a Mac. Why can't I tune the Mac video card the way I can tune the PC one?
Well, I can do a bit more tweaking by editing the.plist file for the kernel extension under/System..., but not much.
This is only possible because Apple, not some random vendor, defines the UI to meet the needs of their users across their limited supported hardware vendors.
Or to put it another way, this is only possible because Apple defines the UI to provide access to the limited feature set they think I need, and doesn't even provide ATI a hook to add new tabs to the Displays control panel the way that can on Windows... so I have two separate control panels where Windows has one, and I need to edit obscure text files to tweak my OpenGL settings the way I want them.
I don't think this is just because Apple doesn't support as many different video cards.
They tracked down the Tiger 8A294 seed through the torrent site that hosted it. Not through any form of fingerprint.
You got a URL so I can file that one with "the CPU in the XBox is a 3.2 GHz G5" meme?
Since the seed is delivered as DMG* from the web site, there is no means of fingerprinting it...
Not being in the developer I don't know the details of how they distribute it. It was reported that Apple fingerprinted the seeds... and since Apple does have the technology to efficiently serve fingerprinted documents already (from iTMS, which has a LOT more customers), you can see how that's not hard to believe.
And for this project? Lots of small publishers (musicians, software developers,...) custom-burn every disk. I've done it, and it's no more hassle than hand-packing and hand-labelling in your spare time. Apple's only shipping these computers to select developers, so they could easily afford to cut a custom CD for each box.
Would they? Well, if it were me I'd do it. But I'm sure as hell no Steve Jobs, so maybe I'm just being overly cautious.
10.3 added notifications of apps being launched for the first time under certain circumstances
10.4 seeks confirmation on the first launch of a Dashboard Widget
They've also added a bit to the root password prompt telling you what privelege is being sought
This kind of approach is one of the first things that Microsoft tried to alleviate the risks created by their approach to Active X security in the HTML control. The problem is that usually these dialog boxes are "crying wolf", so people become used to automatically answering "yes" to them like they answer "yes" to "do you really want to overwrite this file" or "do you really want to leave this secure website".
Even Firefox's XPI installer bothers me, and that requires about 5 clicks to whitelist a site, then you have to click on the link again and wait through a countdown before you can OK it. If you need to put that many warning layers in front of a potentially dangerous action, maybe that's a sign that you shouldn't be doing it.
But IE? Oh, man, I have had users come to me multiple times saying "Peter, I'm sorry, I clicked OK again, and now I think I have a virus". And, yeh, they do. Same people. These are the people who provide the pools of infected machines that keep Windows viruses alive.
There's a better approach.
I've never had someone come to me twice with a story like "I downloaded an attachment to my desktop and opened it and now I'm infected". It's easy to learn not to be "social engineered" this way, because there's no urgency, there's no pressure to click on SOMETHING on the dialog box just to get it out of your way to get back to work.
So...
Don't automatically open, execute, install, launch, or activate any object you click on in a web browser, unless you're opening or otherwise running it under a sandbox that you have a good reason to believe is designed to be as secure as the browser itself. Don't ask the user "should I do a potentially dangerous thing", just don't do it.
That's the pre-internet-explorer standard. With very few exceptions (and I've touched on one, and I'll get to others) this is the standard for every browser but Internet Explorer. Back in the early '90s, there was a joke going around about the "Good Times" virus. The "Good Times" virus was a virus that could run just by opening an email message. Everyone knew it was a joke because nobody would ever be stupid enough to put that kind of capability in a mail reader. If it happened accidentally, it would be treated as a bug and removed as soon as anyone noticed. I mean, this was obviously impossible.
Microsoft was that stupid. And Microsoft was not only that stupid, they were arrogant enough to place their plans for world domination by locking people in to Active X over applying the obvious fix. And the result? In the late '90s, email viruses went from "a minor annoyance for people who were smart enough not to believe they really won a million dollers in a Nigerian lottery" to a plague.
OK, that's Microsoft.
I don't think Apple's problems in the same area are big enough to make viruses more than a minor annoyance on OS X, no matter what the market share, but I could be wrong... and in any case I'd rather they not even get that far. So, what are the problems and what does Apple have to do to fix them?
1. There are no such things as "safe files". Turn off "open safe files after downloading" by default, and don't bring up the "I'm about to do something stupid" dialog until someone turns it on again. That'll give people an incentive not to let Safari be stupid, without making things any more annoying for the people who trust "safe files" than they are now.
2. There's no problem with Dashboard. It's not necessary to try and fix the Dashboard sandbox, because there's no way to effectively give Dashboard a real sandbox without losing the capabilities that make Dashboard useful. Just treat Dashboard as a regular scripting environment for OS X like Apple
how will it deal with an increase in viruses, worms, and trojans.
Currently there are zero "live" worms or viruses for OS X.
So any at all would be a "dramatic increase", but it'd take a lot more than a "dramatic increase" to get to the point where it's even a minor annoyance for anyone who's smart enough to figure out that they didn't REALLY win a million dollar lottery in Nigeria.
See, the biggest potential holes that have been found in Mac OS X aren't one-step exploits like the nasty ones that really kicked off the big flood of Outlook worms back in the '90s... they're more like accelerators for social engineering attacks, you still have to convince the victim to open a file or attachment. Even if you catch someone you can still drop a Dashboard widget on, they still have to run it.
Not that these holes are OK, but they're only tiny steps down the road to Internet Exploiter.
Now, assuming that the dev kit *will* time-bomb, this would be a brilliant move. Of course, it might still be hacked, but the fact of the matter is that only a very, very small subset of the potential market will bother will figuring out the hack to keep it running.
All it takes is one "forensic programmer" to break any copy protection or time bomb Apple has on this software, and the broken version or the recipe will be all over the place. It's called the "smart cow" problem (eg: last line of this story).
And all those thinking this will benefit Apple, are smoking from the same Crack Pipe.
Windows and Office benefited enormously from "Pirate Domain" distribution, over the long term. Would Apple benefit the same way? I don't know. Whether Apple did this deliberately? Probably not, but it's not impossible: Steve Jobs is pretty savvy about this kind of stuff (according to Cory Doctorow anyway) and he's hardly a babe in the woods when it comes to the computer underground.
Good reason: buffer overflows are easier on x86 than RISC because the instruction set is denser. This does lower the bar a bit, but it won't make any difference to most of us for a year.
Bad reason: "the only reason OS X doesn't have as many viruses as Windows is because it's not as popular". This one has been disproved a bunch of times, but it's still a popular meme among Microsoft apologists.
That little fantasy you all have of buying "Mac OS X for x86", running it on some homebuilt shitbox you cobbled together from spare parts, and having it work as well as a G5 runs Panther today will NEVER come to pass.
I don't care about G5 performance. If I could get Mac mini performance on a Thinkpad instead of having to buy one of Apple's s***box laptops to get a laptop running OS X, even if it cost as much as a Mac mini just to buy that copy of OS X, I'd buy it.
Interesting. That may be why they're dragging their feet on the release. The way to tell would be to install it, then look through the files with "strings" or some other dumper for references to symbols starting with "_NS" or containing "objc".
maybe a sign for Cocoa on Windows?
Not necessarily for anyone but Apple. But if this means they're going to be able to do a Cocoa version of iTunes that's good news.
Maybe even a Cocoa Finder, so Metallifizer will work on it? Or is that "crazy talk"?
The original poster (not me) said "limited user" - which is the existing windows XP home term for a non-administrator user, so i assumed that was what he meant. I don't know if it's currently possible to run IE as a limited user
Ah, sorry, I didn't notice you were someone new. My bad.
Yes, it is possible to run IE as a non-administrator, but of course if you're running as an administrator it's going to run with whatever your rights are, so you could both be right and what this is is something like having the IE executable running setuid.
If that's what he meant, that's little help. A virus or other malicious software doesn't need to have administrator rights to do damage, hide undetectably, or propogate.
There is a user right (assigned to administrators and... i believe also backup operators by default) called "bypass traverse checking"
There's always been a lot of software that breaks if "bypass traverse checking" isn't on. One of the many little fiddly details that makes people just go "the hell with it, I'll make me Local Administrator". NTFS has a mechanism to automatically propogate permissions from parent directories, but of course this doesn't stop you from overriding it and ending up giving people unexpected access to files they shouldn't be looking at.
There's a difference between 30 years of bad design, none of which has ever been discarded, and a 30 year old design that's been refined, repaired, with bad ideas like multiplexed files and System V networking and maybe a hundred different IOCTL and FCNTL calls discarded and replaced.
In 1975 the PDP-11 had a complex instruction set and 8 16-bit data registers. That was actually pretty advanced for a processor: in 1975 Intel's top of the line CPU had a relatively simple instruction set and 3 16-bit register pairs for data. In 1980 the x86 had a complex instruction set and had upgraded to 4 16-bit data registers, while the VAX (which replaced the PDP-11 as the most common UNIX platform) had a complex instruction set and 16 32-bit data registers. By 1995 the x86 had a complex instruction set and 8 32-bit data registers, while a typical RISC processor running UNIX had 32 to 64 data registers, 32-64 bits wide. In 2005 the x86 still has 8 32-bit data registers, and the main reason the Opteron (x86-64) gets better performance than Intel processor is that it's got 16 of them... like the VAX did in 1980.
Which is why little companies or unimportant divisions of big companies can spend a fraction of the resources on their processors and still keep up with and often surge ahead of Intel's heroic efforts to make the x86 go fast.
In 1975 the big OS for personal computers was this new thing called CP/M. In 1980 IBM came out with a new personal computer, and Microsoft bought a clone of CP/M and improved it a bit and called it MS-DOS. Within a year you had a choice of real CP/M or this clone of CP/M to run on it.
In 1983 Bill Gates released MS-DOS 2.0, which incorporated features from Microsoft's high-end OS, Xenix, Microsoft's port of UNIX to the 8086. There were obvious differences, for example CP/M had used "/" as an option character because the folks at Digital Research and Microsoft were used to DEC's mainframe and mini OSes which used "/" that way... so MS-DOS 2 used "\" for the path separator so old CP/M software would still run, although it did make it more of a pain to use file names in Microsoft's newly-released C compilers because "\" was the escape character.
Microsoft abandoned Xenix within a couple of years because Macintosh and Windows became his new big idea. So they never regularised the path separators, and people are still finding security holes in Windows programs today because of this decision made in CP/M 30 years ago.
But... MS-DOS now had Xenix file handles and error codes. Now it happened that both MS-DOS and UNIX returned an error code of 2 when you tried to open a file that didn't exist. And in both MS-DOS and UNIX file handle 2 was standard error, where error messages were written. But... in Xenix, the return from an "open" when an error occurred was -1, and an error code was returned as a separate value in a variable called "errno" (these days "errno" is usually a macro or a function that returns the error from the current thread). In MS-DOS there was a separate error flag, and the return value from the call was either the file handle or the error number.
This turned out to be a problem: one MS-DOS program made a mistake parsing a file name and tried to open a zero-length string as a file. It failed to check the error flag on opening a file and treated what it returned as a file handle, so by chance it wrote a message to file handle 2 when it got an error code of 2, and the combination of these two bugs meant the program seemed to work. In Windows 95, the return code changed to a 3 and the program quit working.
When someone at Microsoft figured this out, rather than say "fix your program" Microsoft changed Windows to return error code 2 when this particular combination of events occured. This special case code is still in Windows today. Windows is full of special cases like this, so that some 25 year old program that probably nobody uses any more won't hang. Microsoft co
tricking it into privilege escalation is a step that no-one has ever had to do in a compromise before.
Every single cross-zone attack is a privilege escalation. Whether it's the browser or the OS implementing the protection boundary, the fact that a mechanism exists to allow an object on the low-security side to request the right to execute on the high-security side makes it a privilege escalation.
And Windows uses just too complex an API and privilege mechanism to ever trust. I mean I figured out a way to get LOCALSYSTEM privilege on NT five minutes after I first sat down at one, by trying a variant of a cron exploit that had been fixed on UNIX years before.
no longer forcing people to run as root cannot be anything but a good thing
Whoa, hold on, you were talking about a lower-than-normal-user privilege level for IE7. Now you're just talking about not running it as Administrator or Power User? Normal user privilege is already WAY too open for IE.
If I was going to run IE on UNIX, here's what I'd do to it: I'd have it chrooted into a filesystem with NOEXEC and NODEV enabled, and run it as a UID that had no write access except to a subtree that was purely cache, so I could wipe it without losing configuration.
And even then I'd be worried, because IE has to be able to make outgoing TCP/IP connections, so even in that environment it could be used in a botnet.
I don't see a credible way to even implement that kind of protection on NT. NT doesn't have a concept of chroot, it doesn't do traverse checking, and there's no analog of the "execute" bit so it'd still be able to hide executable code in its writable space.
People make way too much of the whole "don't run as root" thing. There's lots of things a piece of malware can do that can cause just as much damage to the net or to your own real life if it gets a chance to run code on your machine.
THe only acceptable way to build a browser is to arrange things so there is no mechanism implemented for untrusted code to request execution except in a fully interpreted hardcoded sandbox. Even if you think you can't trick the escaltion path into passing it, the existence of an escalation path in a browser is unacceptable.
Even relatively benign things like Safari's "open safe executables" to Firefox's "XPI install" mechanism bother me, and there isn't even any live viruses that use them. I don't care what Microsoft might do to "defang" ActiveX and Active Content and and all the rest of the words they use for the holes in their sandbox: nothing less than completely removing the holes counts as anything but a token effort for PR purposes.
I'm using Palm Desktop too. I tried switching to iSync and iCal, and I tried using Outlook and a Pocket PC, but I ended up with duplicated entries when I synced my Palm at work and at home... only Palm Desktop really handles syncing multiple places and multiple devices at all well... and it's really not all that good.
What's needed is a calendar that separates the repository from its own calendar, so it syncs changes from all sources equally, intelligently, tagging every bit of information with where it came from and what it was sent to and how it was tagged whether or not its own database is organised the same way... and treating its own displayed data as just one of many sources for information in the repository.
making limited user accounts feasible for everyday use is important for more reasons than just internet security
I wouldn't say "important". I'd say "possibly useful", even for internet security. The complexity of the Windows API and its complex privilege model makes it hard for me to trust that there's no way to trick it into privilege escalation.
What's important is breaking down the criminally stupid way the Microsoft HTML control works. What's important is that this attempt at creating a sandbox that STILL allows local code execution tells me that Microsoft has no intention of backing down.
you left out the "no-execute" support from your reply
Well, yeh. My reply was a list of things I consider worthless or worse, or at least that I'd need some convincing to take them out of that category. Things to remove from the list on the grounds that they're bad ideas. No-execute support isn't one of those things. It's useful even though it doesn't absolutely eliminate buffer overflow attacks... it does make them a lot harder.
Slashdot Mirror
My desktop is Linux because it works, it's fast enough, it does what I want, it doesn't restrict me in any way, it's free, it's Free, it doesn't blue-screen, crash, corrupt and die every few months/years, I can leave it running overnight and not worry about if it'll crash before it finishes it's downloads, I can access it remotely (a good thing when you're working behind restrictive child-safe proxies all the time), and I can do things without wizards, dogs and paperclips jumping up to "help me find a file".
My desktop was FreeBSD because all of the above, plus I don't have to spend any time at all dealing with Linux, which has turned into a differently shaped mound of disconnected organs every time I tried it. Oh, not right away, but eventually I'd need to get in and tweak something and pow, there I am, back in the dependencies from hell... no, I can't install this because it needs a new version of that and this other thing breaks on the new API.... Now it's OS X because of all of the above (except it's not free-as-in-beer) PLUS I can actually buy software to do stuff that's too damn annoying and boring for free software people to spend their time on.
Is it ever going to be even remotely as vulnerable as Windows?
It could be, but it would take some really amazingly stupid decisions to do it. And so far Apple's avoided making those decisions when they had the chance.
People, this meme is dead. It should be an ex-meme. Only Microsoft Apologists still argue that it's market share that makes Microsoft a stinking pool of viruses.
will they do a better job at it than say, microsoft?
They're already doing a better job of it than Microsoft.
The reason that Microsoft has all these viruses is real simple. Internet Explorer is designed to let people push native brinary code into your running browser window and execute it. That's what ActiveX in the Microsoft HTML control is all about.
This was Microsoft's World Domination Plan in the late '90s. Everyone was going to use ActiveX components and Active Scripting and nobody else was going to be able to compete with their own browser.
It didn't happen. What *did* happen is that if you can let good people push code into your browser window, then you can't keep bad people from doing the same thing. You can make it harder, with "security zones" and certificates and dialogs and "are you sure". But it only takes a very small percentage of the users saying "OK, infect me" and suddenly you have a HUGE virus problem.
NOBODY ELSE IN THE WHOLE WORLD does this.
Will Apple do something similar? Not yet, they haven't. They've made a few little mistakes in the browser, but nothing like what Microsoft did.
Itanium won't ever be low power for the same reason that G5 and P4 won't ever be low power ... the chip is all about long pipelines and running very very fast.
Remember the OS X transition? Within 2 years Jobs is up on stage sticking OS9 into a coffin and killing hardware support for the thing.
Except he didn't. You could still buy a Mac supporting OS 9 last year. If Jobs could just kill OS 9 when he wanted to, it would have been killed back in 1997 when it was called OS 8.
both Apple and ISV software support for PPC is going to start dying off in 2008.
Why? Unlike the 68x-PPC transition or the OS9-OSX transition, there's no cost to building 2-way applications. This one's using a development environment designed from the beginning, almost 15 years ago now, for supporting multiple platforms. It used to build them 4-way: 68k, x86, Sparc, and HPPA. 2-way is trivial.
I wonder if a less priveleged account could exist entirely within a chroot/Jail-type sandbox.
That would be a sandboxed account. Whatever privileges it has inside that sandbox are still actual privileges.
My colo box lives in a FreeBSD jail on someone else's box. I can have root in that jail, but I can't access anything outside it.
See, a sandbox really doesn't fit in the "discretionary access control" model where priviliges apply, it's more of a "mandatory access control" environment where security classifications. A sandboxed process can't even know about anything outside the sandbox (its classification is 'untrusted'), and the only way for it to find out anything about the outside system is for an application outside the sandbox to move objects into it (declassify then).
You really can't build a sandbox just using discretionary access control techniques.
Microsoft just provides a minimal set of options common across all of them,
The Microsoft options take up two of the three rows of tabs on my PC. The ATI-specific options are in the minority. The only "nested window" is the Advanced window itself.
I've never felt the urge to tweak the windows driver to lie about features to various running apps to see if they perform better, I expect when paying $50 for a game that they have tested against the video card I have and have figured the best settings themselves.
It's not the performance of the video card that's the problem. It's the display. Particularly CRT vs LCD. For example, I do find myself tweaking the settings to get the best image on my LCD at the office. At home I've got a really nice Sony Trinitron so it more "just works".
I'd like to see them add an interactive egress filtering interface to IPFW like the one I purchased from Objective Development
I can think of a bunch of easy ways to avoid egress filtering, particularly when most of your apps are in Objective C and Rentszch has documented so well how to insert a thread in a running application.
The firewall's controls are inside the security boundary protected by the firewall, so once you launch code inside the firewall attacking the firewall itself becomes possible. The bad guy would probably need to find a local root exploit first, so this is less of an issue than on Windows (where there's already viruses that disable antivirus software, for example) but it's a general weakness in all egress firewalls running on the firewalled computer itself.
I'd like to have one on a per-user basis, though... it would make your next idea more useful:
and maybe add hooks to Fast User Switching to encourage its use as a sandbox environment.
Any sandbox that isn't secure enough to prevent me from running native code isn't secure enough to prevent me from using your computer in a botnet for spamming or DOS attacks, or to prevent me from using a local exploit to get out of the sandbox... and while local exploits are harder than on Windows (where they're practically unnecessary) they're still too big an exposure.
Something like a FreeBSD "Jail" or a VMware session, where the sandboxed app doesn't have access to any non-volatile state you can't safely delete, would be better. Or chroot combined with the per-user egress firewall, though you need to be really careful setting up the chrooted environment.
I wonder if using MOM to run OS X under OS X would be an option? Like a sacrificial host (your iBook) it doesn't help with the "stupid dialog" problem but it sure gives you a useful tool when you're concerned with a social engineering attack.
the added stuff in the root password request box are not in the form of added stuff to click through, just more info shown in the existing box
Ah. Probably I'm confusing this with the dialog in Dashboard to ask before running native code components.
What happened to OS/2? It never took off,
THe big problem with OS/2 is that IBM started out doing it in partnership with Microsoft with the intent that it would basically be "the 32-bit version of Windows", and Microsoft pulled out in the middle of the game and went off with their own 32-bit Windows plans.
BeOS and OS/2 are just two examples of why I believe commercial operating systems that don't go by the name of Windows currently cannot work in the x86 mass-user field, thanks to Microsoft.
The conclusion may be valid, but BeOS and OS/2 both had bigger problems to deal with than just not being Windows. And remember, Schiller also said "Who knows what the future holds?"
Normally I'd agree with you, but your "displays" example doesn't really hold water.
.plist file for the kernel extension under /System..., but not much.
go find a Mac and look at the "Display" control panel. Then compare this to the windows equivalent clusterfuck
Hmm. On my Mac I have "Displays" and "ATI Displays". On my PC I have a "Display" control panel that seems to combine the Mac "Screen Effects", "Desktop", and "Displays" panels... and in Panther Apple for some weird reason merged "Screen Effects" and "Desktop" into "Desktop and Screen Saver" making the Mac and Windows experience more similar.
Going back to my PC, the equivalent of the "Displays" control panel is the "Settings" pane on the "Display" control panel. It's absolutely identical on every PC I've used, and provides about the same basic controls as the "Displays" control panel with a slightly different layout.
Then there's an "Advanced" button. This brings up a dialog provides more features. Some of these features are common to all PC video drivers, others only show up for certain models of cards (for example, a card that doesn't support OpenGL or DirectX doesn't have settings that only make sense on those kinds of cards), but when they're there they're pretty much the same whether it's an nVidia or ATI card that's got those features. There's also a set of tabs with an ATI logo on them. These correspond to the tabs on the "ATI Displays" control panel, but they're a superset of the ones I have on the Mac.
That last bit is interesting, because even when I had the PC version of this video card, the control panel still gave me access to more features than the Mac control panel does. And, it has the same hardware as the PC version of the card: it's actually possible to use the ROM image from my card to flash the PC version and make it work in a Mac. Why can't I tune the Mac video card the way I can tune the PC one?
Well, I can do a bit more tweaking by editing the
This is only possible because Apple, not some random vendor, defines the UI to meet the needs of their users across their limited supported hardware vendors.
Or to put it another way, this is only possible because Apple defines the UI to provide access to the limited feature set they think I need, and doesn't even provide ATI a hook to add new tabs to the Displays control panel the way that can on Windows... so I have two separate control panels where Windows has one, and I need to edit obscure text files to tweak my OpenGL settings the way I want them.
I don't think this is just because Apple doesn't support as many different video cards.
They tracked down the Tiger 8A294 seed through the torrent site that hosted it. Not through any form of fingerprint.
...) custom-burn every disk. I've done it, and it's no more hassle than hand-packing and hand-labelling in your spare time. Apple's only shipping these computers to select developers, so they could easily afford to cut a custom CD for each box.
You got a URL so I can file that one with "the CPU in the XBox is a 3.2 GHz G5" meme?
Since the seed is delivered as DMG* from the web site, there is no means of fingerprinting it...
Not being in the developer I don't know the details of how they distribute it. It was reported that Apple fingerprinted the seeds... and since Apple does have the technology to efficiently serve fingerprinted documents already (from iTMS, which has a LOT more customers), you can see how that's not hard to believe.
And for this project? Lots of small publishers (musicians, software developers,
Would they? Well, if it were me I'd do it. But I'm sure as hell no Steve Jobs, so maybe I'm just being overly cautious.
10.3 added notifications of apps being launched for the first time under certain circumstances
10.4 seeks confirmation on the first launch of a Dashboard Widget
They've also added a bit to the root password prompt telling you what privelege is being sought
This kind of approach is one of the first things that Microsoft tried to alleviate the risks created by their approach to Active X security in the HTML control. The problem is that usually these dialog boxes are "crying wolf", so people become used to automatically answering "yes" to them like they answer "yes" to "do you really want to overwrite this file" or "do you really want to leave this secure website".
Even Firefox's XPI installer bothers me, and that requires about 5 clicks to whitelist a site, then you have to click on the link again and wait through a countdown before you can OK it. If you need to put that many warning layers in front of a potentially dangerous action, maybe that's a sign that you shouldn't be doing it.
But IE? Oh, man, I have had users come to me multiple times saying "Peter, I'm sorry, I clicked OK again, and now I think I have a virus". And, yeh, they do. Same people. These are the people who provide the pools of infected machines that keep Windows viruses alive.
There's a better approach.
I've never had someone come to me twice with a story like "I downloaded an attachment to my desktop and opened it and now I'm infected". It's easy to learn not to be "social engineered" this way, because there's no urgency, there's no pressure to click on SOMETHING on the dialog box just to get it out of your way to get back to work.
So...
Don't automatically open, execute, install, launch, or activate any object you click on in a web browser, unless you're opening or otherwise running it under a sandbox that you have a good reason to believe is designed to be as secure as the browser itself. Don't ask the user "should I do a potentially dangerous thing", just don't do it.
That's the pre-internet-explorer standard. With very few exceptions (and I've touched on one, and I'll get to others) this is the standard for every browser but Internet Explorer. Back in the early '90s, there was a joke going around about the "Good Times" virus. The "Good Times" virus was a virus that could run just by opening an email message. Everyone knew it was a joke because nobody would ever be stupid enough to put that kind of capability in a mail reader. If it happened accidentally, it would be treated as a bug and removed as soon as anyone noticed. I mean, this was obviously impossible.
Microsoft was that stupid. And Microsoft was not only that stupid, they were arrogant enough to place their plans for world domination by locking people in to Active X over applying the obvious fix. And the result? In the late '90s, email viruses went from "a minor annoyance for people who were smart enough not to believe they really won a million dollers in a Nigerian lottery" to a plague.
OK, that's Microsoft.
I don't think Apple's problems in the same area are big enough to make viruses more than a minor annoyance on OS X, no matter what the market share, but I could be wrong... and in any case I'd rather they not even get that far. So, what are the problems and what does Apple have to do to fix them?
1. There are no such things as "safe files". Turn off "open safe files after downloading" by default, and don't bring up the "I'm about to do something stupid" dialog until someone turns it on again. That'll give people an incentive not to let Safari be stupid, without making things any more annoying for the people who trust "safe files" than they are now.
2. There's no problem with Dashboard. It's not necessary to try and fix the Dashboard sandbox, because there's no way to effectively give Dashboard a real sandbox without losing the capabilities that make Dashboard useful. Just treat Dashboard as a regular scripting environment for OS X like Apple
how will it deal with an increase in viruses, worms, and trojans.
Currently there are zero "live" worms or viruses for OS X.
So any at all would be a "dramatic increase", but it'd take a lot more than a "dramatic increase" to get to the point where it's even a minor annoyance for anyone who's smart enough to figure out that they didn't REALLY win a million dollar lottery in Nigeria.
See, the biggest potential holes that have been found in Mac OS X aren't one-step exploits like the nasty ones that really kicked off the big flood of Outlook worms back in the '90s... they're more like accelerators for social engineering attacks, you still have to convince the victim to open a file or attachment. Even if you catch someone you can still drop a Dashboard widget on, they still have to run it.
Not that these holes are OK, but they're only tiny steps down the road to Internet Exploiter.
Now, assuming that the dev kit *will* time-bomb, this would be a brilliant move. Of course, it might still be hacked, but the fact of the matter is that only a very, very small subset of the potential market will bother will figuring out the hack to keep it running.
All it takes is one "forensic programmer" to break any copy protection or time bomb Apple has on this software, and the broken version or the recipe will be all over the place. It's called the "smart cow" problem (eg: last line of this story).
Because we all know that Apple uses serial numbers, copy protection and fingerprinting all over their place in Mac OS X. Not.
On developer seeds they do. That's how they track down people who post developer releases.
And all those thinking this will benefit Apple, are smoking from the same Crack Pipe.
Windows and Office benefited enormously from "Pirate Domain" distribution, over the long term. Would Apple benefit the same way? I don't know. Whether Apple did this deliberately? Probably not, but it's not impossible: Steve Jobs is pretty savvy about this kind of stuff (according to Cory Doctorow anyway) and he's hardly a babe in the woods when it comes to the computer underground.
Good reason: buffer overflows are easier on x86 than RISC because the instruction set is denser. This does lower the bar a bit, but it won't make any difference to most of us for a year.
Bad reason: "the only reason OS X doesn't have as many viruses as Windows is because it's not as popular". This one has been disproved a bunch of times, but it's still a popular meme among Microsoft apologists.
That little fantasy you all have of buying "Mac OS X for x86", running it on some homebuilt shitbox you cobbled together from spare parts, and having it work as well as a G5 runs Panther today will NEVER come to pass.
I don't care about G5 performance. If I could get Mac mini performance on a Thinkpad instead of having to buy one of Apple's s***box laptops to get a laptop running OS X, even if it cost as much as a Mac mini just to buy that copy of OS X, I'd buy it.
Or bootnet, or sandalnet.
Homer was the first software pirate.
QuickTime 7 is Cocoa, and it has a Windows Port.
Interesting. That may be why they're dragging their feet on the release. The way to tell would be to install it, then look through the files with "strings" or some other dumper for references to symbols starting with "_NS" or containing "objc".
maybe a sign for Cocoa on Windows?
Not necessarily for anyone but Apple. But if this means they're going to be able to do a Cocoa version of iTunes that's good news.
Maybe even a Cocoa Finder, so Metallifizer will work on it? Or is that "crazy talk"?
The original poster (not me) said "limited user" - which is the existing windows XP home term for a non-administrator user, so i assumed that was what he meant. I don't know if it's currently possible to run IE as a limited user
Ah, sorry, I didn't notice you were someone new. My bad.
Yes, it is possible to run IE as a non-administrator, but of course if you're running as an administrator it's going to run with whatever your rights are, so you could both be right and what this is is something like having the IE executable running setuid.
If that's what he meant, that's little help. A virus or other malicious software doesn't need to have administrator rights to do damage, hide undetectably, or propogate.
There is a user right (assigned to administrators and... i believe also backup operators by default) called "bypass traverse checking"
There's always been a lot of software that breaks if "bypass traverse checking" isn't on. One of the many little fiddly details that makes people just go "the hell with it, I'll make me Local Administrator". NTFS has a mechanism to automatically propogate permissions from parent directories, but of course this doesn't stop you from overriding it and ending up giving people unexpected access to files they shouldn't be looking at.
There's a difference between 30 years of bad design, none of which has ever been discarded, and a 30 year old design that's been refined, repaired, with bad ideas like multiplexed files and System V networking and maybe a hundred different IOCTL and FCNTL calls discarded and replaced.
In 1975 the PDP-11 had a complex instruction set and 8 16-bit data registers. That was actually pretty advanced for a processor: in 1975 Intel's top of the line CPU had a relatively simple instruction set and 3 16-bit register pairs for data. In 1980 the x86 had a complex instruction set and had upgraded to 4 16-bit data registers, while the VAX (which replaced the PDP-11 as the most common UNIX platform) had a complex instruction set and 16 32-bit data registers. By 1995 the x86 had a complex instruction set and 8 32-bit data registers, while a typical RISC processor running UNIX had 32 to 64 data registers, 32-64 bits wide. In 2005 the x86 still has 8 32-bit data registers, and the main reason the Opteron (x86-64) gets better performance than Intel processor is that it's got 16 of them... like the VAX did in 1980.
Which is why little companies or unimportant divisions of big companies can spend a fraction of the resources on their processors and still keep up with and often surge ahead of Intel's heroic efforts to make the x86 go fast.
In 1975 the big OS for personal computers was this new thing called CP/M. In 1980 IBM came out with a new personal computer, and Microsoft bought a clone of CP/M and improved it a bit and called it MS-DOS. Within a year you had a choice of real CP/M or this clone of CP/M to run on it.
In 1983 Bill Gates released MS-DOS 2.0, which incorporated features from Microsoft's high-end OS, Xenix, Microsoft's port of UNIX to the 8086. There were obvious differences, for example CP/M had used "/" as an option character because the folks at Digital Research and Microsoft were used to DEC's mainframe and mini OSes which used "/" that way... so MS-DOS 2 used "\" for the path separator so old CP/M software would still run, although it did make it more of a pain to use file names in Microsoft's newly-released C compilers because "\" was the escape character.
Microsoft abandoned Xenix within a couple of years because Macintosh and Windows became his new big idea. So they never regularised the path separators, and people are still finding security holes in Windows programs today because of this decision made in CP/M 30 years ago.
But... MS-DOS now had Xenix file handles and error codes. Now it happened that both MS-DOS and UNIX returned an error code of 2 when you tried to open a file that didn't exist. And in both MS-DOS and UNIX file handle 2 was standard error, where error messages were written. But... in Xenix, the return from an "open" when an error occurred was -1, and an error code was returned as a separate value in a variable called "errno" (these days "errno" is usually a macro or a function that returns the error from the current thread). In MS-DOS there was a separate error flag, and the return value from the call was either the file handle or the error number.
This turned out to be a problem: one MS-DOS program made a mistake parsing a file name and tried to open a zero-length string as a file. It failed to check the error flag on opening a file and treated what it returned as a file handle, so by chance it wrote a message to file handle 2 when it got an error code of 2, and the combination of these two bugs meant the program seemed to work. In Windows 95, the return code changed to a 3 and the program quit working.
When someone at Microsoft figured this out, rather than say "fix your program" Microsoft changed Windows to return error code 2 when this particular combination of events occured. This special case code is still in Windows today. Windows is full of special cases like this, so that some 25 year old program that probably nobody uses any more won't hang. Microsoft co
tricking it into privilege escalation is a step that no-one has ever had to do in a compromise before.
Every single cross-zone attack is a privilege escalation. Whether it's the browser or the OS implementing the protection boundary, the fact that a mechanism exists to allow an object on the low-security side to request the right to execute on the high-security side makes it a privilege escalation.
And Windows uses just too complex an API and privilege mechanism to ever trust. I mean I figured out a way to get LOCALSYSTEM privilege on NT five minutes after I first sat down at one, by trying a variant of a cron exploit that had been fixed on UNIX years before.
no longer forcing people to run as root cannot be anything but a good thing
Whoa, hold on, you were talking about a lower-than-normal-user privilege level for IE7. Now you're just talking about not running it as Administrator or Power User? Normal user privilege is already WAY too open for IE.
If I was going to run IE on UNIX, here's what I'd do to it: I'd have it chrooted into a filesystem with NOEXEC and NODEV enabled, and run it as a UID that had no write access except to a subtree that was purely cache, so I could wipe it without losing configuration.
And even then I'd be worried, because IE has to be able to make outgoing TCP/IP connections, so even in that environment it could be used in a botnet.
I don't see a credible way to even implement that kind of protection on NT. NT doesn't have a concept of chroot, it doesn't do traverse checking, and there's no analog of the "execute" bit so it'd still be able to hide executable code in its writable space.
People make way too much of the whole "don't run as root" thing. There's lots of things a piece of malware can do that can cause just as much damage to the net or to your own real life if it gets a chance to run code on your machine.
THe only acceptable way to build a browser is to arrange things so there is no mechanism implemented for untrusted code to request execution except in a fully interpreted hardcoded sandbox. Even if you think you can't trick the escaltion path into passing it, the existence of an escalation path in a browser is unacceptable.
Even relatively benign things like Safari's "open safe executables" to Firefox's "XPI install" mechanism bother me, and there isn't even any live viruses that use them. I don't care what Microsoft might do to "defang" ActiveX and Active Content and and all the rest of the words they use for the holes in their sandbox: nothing less than completely removing the holes counts as anything but a token effort for PR purposes.
I'm using Palm Desktop too. I tried switching to iSync and iCal, and I tried using Outlook and a Pocket PC, but I ended up with duplicated entries when I synced my Palm at work and at home... only Palm Desktop really handles syncing multiple places and multiple devices at all well... and it's really not all that good.
What's needed is a calendar that separates the repository from its own calendar, so it syncs changes from all sources equally, intelligently, tagging every bit of information with where it came from and what it was sent to and how it was tagged whether or not its own database is organised the same way... and treating its own displayed data as just one of many sources for information in the repository.
making limited user accounts feasible for everyday use is important for more reasons than just internet security
I wouldn't say "important". I'd say "possibly useful", even for internet security. The complexity of the Windows API and its complex privilege model makes it hard for me to trust that there's no way to trick it into privilege escalation.
What's important is breaking down the criminally stupid way the Microsoft HTML control works. What's important is that this attempt at creating a sandbox that STILL allows local code execution tells me that Microsoft has no intention of backing down.
you left out the "no-execute" support from your reply
Well, yeh. My reply was a list of things I consider worthless or worse, or at least that I'd need some convincing to take them out of that category. Things to remove from the list on the grounds that they're bad ideas. No-execute support isn't one of those things. It's useful even though it doesn't absolutely eliminate buffer overflow attacks... it does make them a lot harder.