IANAL, but this is how corporate lawyers have explained it to me in the past.
You'd better talk to the boss about hiring better lawyers, since they are completely wrong if you're talking about US law. This one falls under both Federal and California law and both have trade secret laws and California's Whistleblower statutes don't apply in this case. 60 seconds with Google will provide the relevant laws.
If they really want to protect trade secrets, maybe they could try to make sure they don't get leaked in the first place?
Which you do by making sure your employees know you'll do what it takes to find them and sue them if they release such information. Apple sued for the names of the leaks, not to shut down the publication. In the end, Apple did not get those names, but the publication shut down, so everyone lost.
When did speculation and reporting on rumors get deemed as private information?
When you're profiting from information you solicited from people who you knew or had a reasonable expectation to know where violating their confidentiality clauses. There are trade secret laws to this affect in almost every state.
All I know is CNN is screwed.
CNN is probably very careful not to do this very thing, except in whistleblower cases, where there is government corruption, a danger to public health, or an overriding public interest for the information to be released. What new gadgets Apple is working on, does not qualify for whistleblower protection.
Trademarked or copyrighted knowledge was released by thinksecret.
This is incorrect. The violations were trade secret violation, not copyright or trademark. In almost every state it is illegal to intentionally reveal trade secrets or to solicit others to reveal them for financial gain. Even in states without trade secret laws, the employees would still have violated their civil contracts with Apple (NDAs).
The actual information apparently concerned a firewire musical instrument, from before 2005, that never was released. So should thinksecret be held liable for releasing a trademark secret? Legally, I don't know the answer.
Legally, ThinkSecret was clearly going to lose the lawsuit.
Even if there was a legitimate way to thwart Apple, would any college student have the resources to undertake such a fight? And from the beginning, wouldn't Apple be aware of its strength in that regard? I'd like to think that if I were faced by a lawsuit from a major corporation I'd have the money to afford a single lawyer for at least a few hours of work. But the truth is, I don't.
Civil suits are clearly weighted in the favor of the party with more money. In this case, however, ThinkSecret didn't really have a leg to stand on. ThinkSecret's leverage was the threat of bad press for Apple. I would note, however, Apple reportedly did not seek any damages or even court costs from ThinkSecret, just the names of the sources (which they were entitled to under the law).
I think that Apple was concerned over a related product, whose secrecy was more important, and whose developing team may have had some overlap with the firewire guitar, or whatever it was. So they wanted to protect some other development.
Actually, if this product was ever going to market, it probably was not important and that is why Apple pressed this case. Apple thrives on secrecy. They make huge profits from the press they get from surprise releases of new products. Journalists actually want to attend their press releases because it is occasionally more than filler material and PR about things everyone with an interest already knows.
Apple pushes this culture really hard and tries to make sure all the employees know they are serious about it, because real money is on the line. So when you were in highschool and the football team was all boozing it up every night and causing trouble, did the coach go after the Quarterback and suspend him from the team, or did he pick a fairly unimportant team member to kick off the team so the others knew he was serious? This is probably the same thing... going after leakers from less important projects to make an example for the rest of the company.
Nick may have acted illegally. His settlement makes him happy because he doesn't have to go to jail or even be arrested.
This was a civil suit. There was no danger of anyone going to jail or being arrested. There was no threat of the publication being shut down. There was no claim to financial damages, although there clearly could have been. Apple filed for one thing only, the identities of the leakers... and they did not get them in the end. Apple lost. Sadly, instead of what they wanted, the publication shut down, which isn't good for the readers or Apple or Nick. He lost too. Pretty much everyone here lost except the leakers, who Nick took all the heat for. It was admirable of him, but not really a good thing for people in general. And who knows, maybe Apple found out the leaker's identities from other sources, and it was a moot point for them. We don't know because all this happened behind closed doors. Basically, a tragedy all around.
I probably have a different take on this development, having done a lot of research at one time into trade secret laws and whistleblower statutes in the U.S., as well as this case in particular. What I find really interesting about this agreement we know so little about, is the only two things we do know are exactly backwards from justice. It seems to me that both Apple and ThinkSecret lost here, since neither was given what they wanted. Let me explain.
First, ThinkSecret had no right to protect the confidentiality of their sources. Apple sued ThinkSecret asking for the identities of those people who had committed a criminal act against them. (Note, whether revealing trade secrets should be a crime, is another discussion). According to the filing, that is all they wanted and it is the one thing they did not get. Despite having no legal right to keep these sources secret, ThinkSecret managed to make a deal to do that, probably out of personal loyalty or a perceived ethical obligation on the part of Nick Ciarelli. He seems to have walked away from this with his reputation as a journalist intact, which is a valuable asset if he's planning on asking sources to trust him in the future. It also speaks quite well of his character.
Second, Apple had no right to shut down this publication, and it was probably in their best interests to avoid doing so. And yet, in a deal to protect those sources, that is exactly what happened. Why and how did such a thing happen? We can only speculate. My best guess is that after dealing with the public relations aspect of this for a while and with mounting court costs that were unlikely to ever be repaid, someone at Apple made the decision that this should "go away" and ham-fistedly ordered the legal team to settle it one way or another and make sure it didn't happen again. As a result, Apple failed to get what they were out for, and stupidly got an agreement to shut the site down instead.
I think my perspective on this is probably a little less reactionary and a little more realistic than what I've seen in other posts here. ThinkSecret was aiding others to break the law and clearly in the wrong on this lawsuit, but having done something wrong, Nick Ciarelli took all the responsibility for other's criminal acts (which he helped incite) upon himself and shielded them. Apple, fumbled the ball, failed to get the leaks identified, and made a typically corporate and shortsighted decision. Everyone lost.
I kind of like Ron Paul, but he would make government so small that programs like NASA, SBIR, NSF, etc. would be eliminated.
I agree with some of Ron Paul's platform and disagree with other parts of it. I think he ignores the important benefits socialist programs have brought around the world as well as the correlation between some of these programs and quality of life (of he knows but opposes it on principal anyway). That said, it is a bit of a stretch to say he would make the government small, as if the president had the power to do that. Out system places a lot of power in many different hands and the office of the president is just one of them. If anything, I think an extremist like Ron Paul might help balance out the extremist position of ever bigger, expanding bureaucracy we have today. I wouldn't want Ron Paul as the only decision maker in Washington, but he might make a very good president, despite th fact that I think he is very wrong in principal on some topics.
It does seem a lot more specific and is the only "social science" issue. Still, it is amusing to see candidates try to justify their stances while trying not to let science enter the equation as to what their stance is.
I didn't actualy review each and every vulnerability to see how each one manifests.
Neither did the author of this article, since from spot checking about 1/3 of the ones he lists are simply CVE numbers reserved for future use by someone.
As in the past it wouldn't shock me to find out that one of window critical vulnerabilities is something like you described.
I didn't see any such thing. In fact, I saw possible remote exploitations listed as "low risk" for Windows, while local DoS, were listed multiple times as "high" for OS X.
I agree that many "critical" vulnerabilities difficult to implement, my point was if you are going to sort thru the issues and see which ones are really critical and which ones aren't you have to do it to both OS's.
It is pretty obvious the author did no such thing. It seems he found a category for "Windows XP" and another for "Windows Vista", removed the dupes and published a number. Then he did a search for everything listing "OS X" as a potential platform, including applications that run on OS X and the server version of the OS and lumped them all together, including all the OSS projects that list OS X as a supported platform. He then tried to somehow equate these two numbers despite the fact that many of the vulnerabilities listed ship on neither OS, run on both Windows and OS X, but were only counted against OS X. This whole "article" is the worse kind of misinformed crap. He did exactly what the Website he downloaded the statistics from says is pointless and shouldn't be attempted with their data.
No one has time to look through all of these listings, but it is pretty clear that as provided, they are worthless and do not in any way reflect the same thing for each platform.
Oh Boy! An OS that supports more platforms than it has users.
Oh Boy! Another user that doesn't know what OS's he's using. If your firewall isn't running NetBSD, and your gateway router isn't, and you don't own any appliances that run NetBSD, the chances are your internet packets, at least are making their way through one or more NetBSD boxes. NetBSD has plenty of users, it's just most of them don't know they are users because they use NetBSD systems as black boxes.
Note that the same methodology can be applied to many IE/windows vulnerabilities but unless you give those types of issues a pass it's not valid to do the same to another OS.
Umm, IE vulnerabilities were not counted against Windows in this so-called study. And we're talking about a vulnerability that is a bit more rare than using IE to browse to a site specifically designed to exploit this. In order to be exploited by the Perl library you'd have to, set up your Mac to be a Web server and write a new Web application using the library and allow that Web application to take unverified content from Web users and hand it to the Perl library and have someone discover your Website, somehow know you're using that library, and craft a malicious string and even then it is not clear if it would really do anything since it is only a potential vulnerability that no one has ever tested to see if it could really be used. Yeah, I'm just shaking in my boots with regard to this "highly critical" vulnerability in OS X that was counted as seven separate holes. You never know when I'm going to accidentally write a Web application that parses user entered regular expressions and run it on my workstation.
I wholeheartedly agree that HTML isn't really the optimal format for document exchange, and your first point (that it doesn't handle all the necessary use cases) is quite valid. However, the latter point is not necessarily a big problem. Everybody and their dog has an implementation of zip by now, so something as trivial as a zip file with an index.html file and a resources/ directory with all the needed external stuff would be a pretty open and portable way to address the issue.
So you're saying if only there were a format that was a superset of HTML (like XML) and would provide the needed functions and it and its resources were organized into a standard set of directories and then zipped up that would work? (I'm being a bit sarcastic here, since that is a pretty good description of what ODF is.) Rename a.odf file to.zip and you can unzip it and browse through the "pictures" directory easily.
I don't see why we can't just go with plain old.doc. Sure it isn't as "open" as ODF, but OOo and Office can read them well enough (now if I got to make the plans, it would just be plain.txt, fast and easy to read, who needs formatting) to see what they are saying.
There are too many, different versions of.doc and no, the majority of programs cannot read and write them "well enough" now. Anyone who's ever managed an archive of documents has probably run into.doc files that cannot be opened by any currently available version of Word. One of the things ODF is solving is the security to know in another 5 years you'll still be able to open your files. The.doc format mess does not provide that security.
So why can't they go with.doc?
If the reasons I mentioned above are not enough, it is anti-competitive. It is too burdensome for vendors bidding on writing a new application they want to sell to government contractors to have to reverse engineer a closed format or series of formats and there is no way to be sure it will work in a given instance.
Or better yet HTML?
HTML does not handle all the use cases of office documents smoothly and is a pretty terrible format for exchanging documents since in many cases you'd be exchanging entire directories of files instead of a single file since all the resources in HTML are stored by reference.
...even though ODF is nice, Windows systems with Office need "plugins" to view them.
And this is one of the very things adoption of ODF as a standard in large government agencies will change. MS can only hold out so long on making ODF use with MS Office difficult. When they start losing enough sales because their product is not doing what customers want, they'll change it. I'd also note that when the government provides a spec and take bids from vendors, when one vendor tells them "no" and sys they'll have to make do with something that does not meet the spec, then tries to lobby government officials in order to change the spec to one that is inferior for their customer and will cost more in the long run, well maybe it is time to rethink doing business with that vendor at all.
I maintain, if Apple, Microsoft or any other company bundles flawed utilities with their OS it is their responsibility to provide support in the event vulnerabilities are found.
No one is arguing about support. Apple is supporting these tools and patching them. The point is, since they aren't needed, or part of the OS, or used on 99.99% of systems and are not presenting a security risk on those systems, why are they being counted multiple times as high risk security flaws? In this "comparison" not even IE bugs are being counted against Windows, which is software also included, but in addition enabled by default and actually used by most users.
They want to sell more of their product so they take something else out of the front window.
I don't know about that. They're presumably paying the licensing fee to offer ThinkFree to their internet customers, instead of offering OpenOffice for free. Also, we're not talking about the "front window" by any means. They just have a cache of software they provide from their own servers without charging you for the data transfer costs (since they don't have to pay transit). It would cost them basically nothing to leave OpenOffice on that server. I might even buy into a MS backroom deal conspiracy theory here, as it only supports MSOffice formats, but it does not support OOXML and exports to PDF so maybe not. I wonder what the Australian government agencies that are standardizing on ODF will think of this.
I think you're misunderstanding the grandparent post. He was talking about Apple providing ALAC for users that did not like AAC. ALAC is "Apple Lossless Audio Codec" and is an Apple, proprietary technology, not another name for AAC or an MPEG standard.
Aside from that, being a lossless format, it is already possible to convert it to any other format losslessly with existing freeware and several software players have reverse engineered it and play it just fine. Lock-in is not really a concern.
I live north of the equator. Exactly how big is this ISP that they can afford to develop their own office suite?
They're very big, you might know them by the name Telestra. BigPond is a subsidiary and the dominant ISP in Australia. They didn't develop it, they just rebranded ThinkFree after licensing it from Haansoft.
And what is the business plan behind this? Especially since it competes on one side with Microsoft Office and on the other with openoffice.org.
Partly I think it is value added to compete with the other ISPs (they actually have some competition still). They may be selling support and addition services to the business market in the future.
Apple can cater to the portion of the market that has rejected AAC, while simultaneously ensuring lock-in by using their proprietary codec that isn't interoperative with other players.
Umm, the OSS libavcodec has played ALAC for over a year and Mplayer and VLC both can play it as a result. That's not a lot of lock-in.
Win for Apple, and lossy everyone else, including customers. (Inless[sic] they have the wisdom to just say no and keep buying CDs. And iTunes store's popularity suggests lots of people don't.)
I've bought a couple of songs from iTunes Music Store, when they were not easily found elsewhere. Getting rid of the DRM was not hard, even without burning a CD or losing quality. Apple is moving away from DRM as well, as fast as the studios will let them. They don't care about the music. They just want it easy for people to use iPods and they seem pretty content to let the iPod compete based upon merits and momentum. Do you really think freeware won't batch convert ALAC to FLAC? In fact, Google tells me Foobar and DBPowerAmp both do it today with free codec plug-ins. I guess I'm not buying your "lock-in" theory.
Certainly, but it providing these applications as core part of their OS, surely Apple is in charge of the QA.
They're not including it as a "core part" though, just as some free developer tools.
If certain parts of the OS depend on this, then they should do the necessary QA.
Umm, for the example I listed, the OS does not depend upon it at all. You can remove it with no problems at all and even among developers who know what this is, very few would use it especially exposed publicly. The only way I see this being exposed is if a Web developer was writing a really complex tool with a Web interface that needed users to input regular expressions for complex sorting of data, and they hosted a development copy on their workstation and then exposed the Web server so some people in a remote location with a malfunctioning VPN could try it out.
When a flaw is discovered they have two options, either get the latest patch from the module developers, or if it is not available work with them to ensure that a fix is provided.
They did get the fix from the vendor and patched it in the next update. The issue is: should a bug that is a potential hole in a free tool, which they happen to include and which will realistically never even be exposed let alone exploited, be considered with the same weight as a hole in a service actually running and exposed on Windows? What about a hole in IE, which MS includes, but whose vulnerabilities were not included in this "study' as counting against Windows?
For me this is like a car manufacturer, which discovers that the tires have a design flaw, after it gets to the customer. Sure it might not be directly their fault, but they are responsible for ensuring the fix gets to the customer. It doesn't matter if it is their problem or their suppliers problem, what matters is it gets to the customer.
Oh boy, a car analogy. How about if it was something a bit less critical than the tires, say some misspellings on a map that came in the emergency kit. Should that be listed and given the same of more weight than a leaky gas line in competing product? Should each misspelling count the same as a mechanical fault in the competitor's vehicle? There were 8 "Highly Critical" vulnerabilities counted against OS X because the OSS project that writes the module listed every bug in it as a potential security problem, despite the fact that there is no evidence anyone on OS X ever actually exposed that component to hackers, no exploit was ever found, and it is not even certain it is exploitable.
Would you care to bet there are thousands of analogous bugs in IIS components that MS has not bothered to fix, let alone report to the public?
Really? How many vendors of proprietary applications have their source repositories sitting on the Internet with a visible public interface and developers who may never have even met each other logging in from all over the world?
Considering the trend for outsourcing, probably more than you'd think. A lot more yet simply ship the code off to India or Latvia or somewhere, get it back, perform no real reviews of the code, and ship it out.
I also like how you blanket-troll all vendors of proprietary applications as if none posses basic ethics.
He does paint with a bit of a broad brush; but he also has a point. Commercial, closed source vendors are running a business and their primary motivation is money. Sadly, that often means hiding security breaches from users, even when that places those users at risk. OSS projects may have commercial motivations as well, but because of the process they cannot easily hide this type of problem... which is good for users.
The bigger question is how those vulnerabilities were handled, from point of discovery to solution, and that is where MS always breaks down.
I'd argue what really matters is how these vulnerabilities were discovered and what vulnerabilities have not been discovered, how these vulnerabilities have been reported and what vulnerabilities have not been reported, what the risk to normal users from vulnerabilities is, and (in the case of this article) which of these "vulnerabilities" are real and which are reserved numbers, only potential vulnerabilities, duplicates, and vulnerabilities that realistically cannot or will not ever be exploited.
In my opinion MS broke down when they did not perform the same level of code review, did not find as many potentially security related bugs, did not fix half the bugs they did find, and did not report either the bugs they found or even all the bugs they fixed. And then, or course, the speed with which those bugs they found, fixed, and announced were actually patched.
If it ships with the OS it should be patched by the OS company. If Apple shipped something with a flaw, Apple gets to patch it. Same for Microsoft.
Agreed, although not all the "vulnerabilities" listed in this so-called study do ship from Apple, many are third-party applications that just run on OS X. Also, OS X includes a lot of cool tools with their OS, because they are free. 99.99% of the time, these tools are never used, let alone exposed to the outside world. For example, almost a third of the first 30 CVE's listed in this study apply to the same Perl, regular expression evaluator. Now how many users do you suppose turn on Apache and this module and make use of it on a Web page they're hosting from their home computer? I mean these tools are great for Web developers that want to test stuff on their workstation, but that is likely about all they are used for, in the very rare cases that they are used. That particular module accounts for 8 of the "vulnerabilities" in OS X listed.
It is fine to list these as vulnerabilities, but for a comparison to vulnerabilities in Windows, well they're pretty useless because of the use case as well as the dozens of other things wrong with this study. I mean, the OSS team developing this module lists each and every potential hole they an find on a public Website and it is counted by Secunia. Their list for MS includes only holes that have been discovered by the public and which MS has acknowledged. Since MS does not publish most of the bugs they find, none of those are counted against MS, including the ones they don't bother to fix (more than 50% according to an ex-MS developer I know).
Secunia knows this. Every respectable security expert knows this. The only problem is, random bloggers don't seem to know this, and write "articles" about it which get widespread readership, misinforming large numbers of people and leading them to make incorrect decisions that end up causing problems for everyone.
"Handling ODF files" is separate from "saving money on licensing," you know.
Yes, I know. I never implied otherwise. That is why I said a large number of companies doing one enables other companies to do the second. You see how that works?
Conflating separate things and making conflicting claims (e.g. "ODF is a standard" vs. "switch to OpenOffice to use ODF") when it suits them is a tactic Microsoft uses, not us. We should be better than that.
I never conflate those items at all. Where are you getting this? I said that if most companies can handle ODF, the main reason to avoid using certain software packages that are cheaper than MS Office (like OpenOffice) has been removed. You never answered my question. If almost all companies have a way to handle ODF, what is the disadvantage to switching to it internally and buying cheaper software packages for some or all of your internal needs?
So I took a look at a few sample vulnerabilities and it leaves me Flabbergasted. The person who wrote this article and composed the data should be beaten. The ones listed as OS X vulnerabilities are primarily holes in software that runs on OS X, much of which does not even ship with OS X by default. A lot of it is holes in various Web server modules, some of which do ship with OS X, but are disabled by default. Some of them are NOT EVEN VULNERABILITIES... like CVE-2007-3876 which is a number reserved for use by an organization for the next time they report a vulnerability, but they haven't assigned it to anything yet. Whole ranges of numbers listed are like that. I mean did the author even click on the links he's providing? I tried, I was more than twenty items into the list of "highly critical OS X vulnerabilities" before I found one that actually affected a default install of OS X, and it was a potential denial of service for SSL Web sites if you have a machine in the middle. Of the first 30, 12 were reserved for future use and not real vulnerabilities, 7 were holes in the same Perl library, and 5 were holes in tcpdump. Only one was a real, hole that could be exploited on a default install without additional software being added, or it being reconfigured as Web server or something.
Another question is, for the real vulnerabilities to the OS's, how do they decide what the danger level is for a vulnerability? For example, one low rated one for WinXP (CVE-2007-2228) was a possible remote exploit, whereas a Highly cCritical one for OS X (CVE-2007-0267) was a denial of service on a machine, requiring a local user account. Does this make any sense to anyone?
I'm all for pointing out security problems in OS X and other OS's and doing comparisons of relative security, but this is just a sad joke. Please, can we at least get articles by someone with the tiniest bit of a clue instead of the number game from someone who might be able to count, but apparently can't be bothered to read his subject matter.
Your list is propaganda not supported by actual facts. Yes these countries are LOOKING at ODF, but contrary to what you say, NONE have actuallsic] MANDATED EXCLUSIVE USE for anything. It's pure FUD you are spreading.
I try not to respond to AC's, but since I still have my Google mining page open, here are references for all those I listed. Some people might find these useful if they're researching this topic themselves. Some have mandated ODF for some uses or within a given locality or agency. Others have simply standardized on OpenOffice. Some are acts of law and some of policy. I was pretty clear for each case I thought.
Which of these European Union countries have kicked the Microsoft habit? Which ones, please? Exactly none.
So far:
Belguim - By law, from September 2007 on every federal government department must be able to read OpenDocument documents. From September 2008 on, all exchanges of revisable documents (texts, presentations, spreadsheets) between federal government agencies must occur in ODF.
Finland - the Ministry of Justice has chosen Open Office and thus the OpenDocument format as their main document format from the beginning of 2007. The decision has been made after deep research of ODF possibilities. Other ministries may follow.
Germany - about half of government offices use StarOffice or OpenOffice and ODF although no law or rule requires it.
Netherlands - From beginning of 2009 onwards OpenSource-software and the ODF will be the standard for reading, publishing and the exchange of information for all governmental organizations.
Australia - ODF is mandatory for the national archives
Argentina - one province has mandated ODF for all government use.
India - the national court system has mandated ODF as the format for all document exchange.
Japan - government hiring policy gives preference to programs that use ODF.
South Africa - ODF, ASCII, or UTF-8 is mandatory for all document exchange within the Dept. of Public Service.
Vietnam - all government systems are switching to OpenOffice and removing MSOffice (currently underway).
Those are the ones I know about from a quick Google mining. I'd say it is a bit more than "none." It isn't a huge movement, yet, but each one makes the next easier.
I'm not sure why anyone should care very much. Anyone can install OpenOffice for free, so I'm not sure what's gained by actually having it execute online.
For home users, you're probably, mostly right. For some organizations, however (like schools) this can be a big plus. With OpenOffice you can already give students a free copy for home, but the Mac version is pretty lousy and a real performance dog. The advantage this brings is that you can also host an online service version for users who have a really old, second hand computer at home, or a three year old Mac,or do their homework on public terminals at the city library. This means they can also access the same files from any terminal in the school, from home, from the library (where they can't install software), and from their grandparent's house where they spend weekends. This is a big win for such environments. It probably would even mesh with the OLPC project if it was deployed by a school in the US.
Slashdot Mirror
You'd better talk to the boss about hiring better lawyers, since they are completely wrong if you're talking about US law. This one falls under both Federal and California law and both have trade secret laws and California's Whistleblower statutes don't apply in this case. 60 seconds with Google will provide the relevant laws.
Which you do by making sure your employees know you'll do what it takes to find them and sue them if they release such information. Apple sued for the names of the leaks, not to shut down the publication. In the end, Apple did not get those names, but the publication shut down, so everyone lost.
When did speculation and reporting on rumors get deemed as private information?When you're profiting from information you solicited from people who you knew or had a reasonable expectation to know where violating their confidentiality clauses. There are trade secret laws to this affect in almost every state.
All I know is CNN is screwed.CNN is probably very careful not to do this very thing, except in whistleblower cases, where there is government corruption, a danger to public health, or an overriding public interest for the information to be released. What new gadgets Apple is working on, does not qualify for whistleblower protection.
This is incorrect. The violations were trade secret violation, not copyright or trademark. In almost every state it is illegal to intentionally reveal trade secrets or to solicit others to reveal them for financial gain. Even in states without trade secret laws, the employees would still have violated their civil contracts with Apple (NDAs).
The actual information apparently concerned a firewire musical instrument, from before 2005, that never was released. So should thinksecret be held liable for releasing a trademark secret? Legally, I don't know the answer.Legally, ThinkSecret was clearly going to lose the lawsuit.
Even if there was a legitimate way to thwart Apple, would any college student have the resources to undertake such a fight? And from the beginning, wouldn't Apple be aware of its strength in that regard? I'd like to think that if I were faced by a lawsuit from a major corporation I'd have the money to afford a single lawyer for at least a few hours of work. But the truth is, I don't.Civil suits are clearly weighted in the favor of the party with more money. In this case, however, ThinkSecret didn't really have a leg to stand on. ThinkSecret's leverage was the threat of bad press for Apple. I would note, however, Apple reportedly did not seek any damages or even court costs from ThinkSecret, just the names of the sources (which they were entitled to under the law).
I think that Apple was concerned over a related product, whose secrecy was more important, and whose developing team may have had some overlap with the firewire guitar, or whatever it was. So they wanted to protect some other development.Actually, if this product was ever going to market, it probably was not important and that is why Apple pressed this case. Apple thrives on secrecy. They make huge profits from the press they get from surprise releases of new products. Journalists actually want to attend their press releases because it is occasionally more than filler material and PR about things everyone with an interest already knows.
Apple pushes this culture really hard and tries to make sure all the employees know they are serious about it, because real money is on the line. So when you were in highschool and the football team was all boozing it up every night and causing trouble, did the coach go after the Quarterback and suspend him from the team, or did he pick a fairly unimportant team member to kick off the team so the others knew he was serious? This is probably the same thing... going after leakers from less important projects to make an example for the rest of the company.
Nick may have acted illegally. His settlement makes him happy because he doesn't have to go to jail or even be arrested.This was a civil suit. There was no danger of anyone going to jail or being arrested. There was no threat of the publication being shut down. There was no claim to financial damages, although there clearly could have been. Apple filed for one thing only, the identities of the leakers... and they did not get them in the end. Apple lost. Sadly, instead of what they wanted, the publication shut down, which isn't good for the readers or Apple or Nick. He lost too. Pretty much everyone here lost except the leakers, who Nick took all the heat for. It was admirable of him, but not really a good thing for people in general. And who knows, maybe Apple found out the leaker's identities from other sources, and it was a moot point for them. We don't know because all this happened behind closed doors. Basically, a tragedy all around.
I probably have a different take on this development, having done a lot of research at one time into trade secret laws and whistleblower statutes in the U.S., as well as this case in particular. What I find really interesting about this agreement we know so little about, is the only two things we do know are exactly backwards from justice. It seems to me that both Apple and ThinkSecret lost here, since neither was given what they wanted. Let me explain.
First, ThinkSecret had no right to protect the confidentiality of their sources. Apple sued ThinkSecret asking for the identities of those people who had committed a criminal act against them. (Note, whether revealing trade secrets should be a crime, is another discussion). According to the filing, that is all they wanted and it is the one thing they did not get. Despite having no legal right to keep these sources secret, ThinkSecret managed to make a deal to do that, probably out of personal loyalty or a perceived ethical obligation on the part of Nick Ciarelli. He seems to have walked away from this with his reputation as a journalist intact, which is a valuable asset if he's planning on asking sources to trust him in the future. It also speaks quite well of his character.
Second, Apple had no right to shut down this publication, and it was probably in their best interests to avoid doing so. And yet, in a deal to protect those sources, that is exactly what happened. Why and how did such a thing happen? We can only speculate. My best guess is that after dealing with the public relations aspect of this for a while and with mounting court costs that were unlikely to ever be repaid, someone at Apple made the decision that this should "go away" and ham-fistedly ordered the legal team to settle it one way or another and make sure it didn't happen again. As a result, Apple failed to get what they were out for, and stupidly got an agreement to shut the site down instead.
I think my perspective on this is probably a little less reactionary and a little more realistic than what I've seen in other posts here. ThinkSecret was aiding others to break the law and clearly in the wrong on this lawsuit, but having done something wrong, Nick Ciarelli took all the responsibility for other's criminal acts (which he helped incite) upon himself and shielded them. Apple, fumbled the ball, failed to get the leaks identified, and made a typically corporate and shortsighted decision. Everyone lost.
I agree with some of Ron Paul's platform and disagree with other parts of it. I think he ignores the important benefits socialist programs have brought around the world as well as the correlation between some of these programs and quality of life (of he knows but opposes it on principal anyway). That said, it is a bit of a stretch to say he would make the government small, as if the president had the power to do that. Out system places a lot of power in many different hands and the office of the president is just one of them. If anything, I think an extremist like Ron Paul might help balance out the extremist position of ever bigger, expanding bureaucracy we have today. I wouldn't want Ron Paul as the only decision maker in Washington, but he might make a very good president, despite th fact that I think he is very wrong in principal on some topics.
It does seem a lot more specific and is the only "social science" issue. Still, it is amusing to see candidates try to justify their stances while trying not to let science enter the equation as to what their stance is.
Neither did the author of this article, since from spot checking about 1/3 of the ones he lists are simply CVE numbers reserved for future use by someone.
As in the past it wouldn't shock me to find out that one of window critical vulnerabilities is something like you described.I didn't see any such thing. In fact, I saw possible remote exploitations listed as "low risk" for Windows, while local DoS, were listed multiple times as "high" for OS X.
I agree that many "critical" vulnerabilities difficult to implement, my point was if you are going to sort thru the issues and see which ones are really critical and which ones aren't you have to do it to both OS's.It is pretty obvious the author did no such thing. It seems he found a category for "Windows XP" and another for "Windows Vista", removed the dupes and published a number. Then he did a search for everything listing "OS X" as a potential platform, including applications that run on OS X and the server version of the OS and lumped them all together, including all the OSS projects that list OS X as a supported platform. He then tried to somehow equate these two numbers despite the fact that many of the vulnerabilities listed ship on neither OS, run on both Windows and OS X, but were only counted against OS X. This whole "article" is the worse kind of misinformed crap. He did exactly what the Website he downloaded the statistics from says is pointless and shouldn't be attempted with their data.
No one has time to look through all of these listings, but it is pretty clear that as provided, they are worthless and do not in any way reflect the same thing for each platform.
Oh Boy! Another user that doesn't know what OS's he's using. If your firewall isn't running NetBSD, and your gateway router isn't, and you don't own any appliances that run NetBSD, the chances are your internet packets, at least are making their way through one or more NetBSD boxes. NetBSD has plenty of users, it's just most of them don't know they are users because they use NetBSD systems as black boxes.
Umm, IE vulnerabilities were not counted against Windows in this so-called study. And we're talking about a vulnerability that is a bit more rare than using IE to browse to a site specifically designed to exploit this. In order to be exploited by the Perl library you'd have to, set up your Mac to be a Web server and write a new Web application using the library and allow that Web application to take unverified content from Web users and hand it to the Perl library and have someone discover your Website, somehow know you're using that library, and craft a malicious string and even then it is not clear if it would really do anything since it is only a potential vulnerability that no one has ever tested to see if it could really be used. Yeah, I'm just shaking in my boots with regard to this "highly critical" vulnerability in OS X that was counted as seven separate holes. You never know when I'm going to accidentally write a Web application that parses user entered regular expressions and run it on my workstation.
So you're saying if only there were a format that was a superset of HTML (like XML) and would provide the needed functions and it and its resources were organized into a standard set of directories and then zipped up that would work? (I'm being a bit sarcastic here, since that is a pretty good description of what ODF is.) Rename a .odf file to .zip and you can unzip it and browse through the "pictures" directory easily.
There are too many, different versions of .doc and no, the majority of programs cannot read and write them "well enough" now. Anyone who's ever managed an archive of documents has probably run into .doc files that cannot be opened by any currently available version of Word. One of the things ODF is solving is the security to know in another 5 years you'll still be able to open your files. The .doc format mess does not provide that security.
So why can't they go withIf the reasons I mentioned above are not enough, it is anti-competitive. It is too burdensome for vendors bidding on writing a new application they want to sell to government contractors to have to reverse engineer a closed format or series of formats and there is no way to be sure it will work in a given instance.
Or better yet HTML?HTML does not handle all the use cases of office documents smoothly and is a pretty terrible format for exchanging documents since in many cases you'd be exchanging entire directories of files instead of a single file since all the resources in HTML are stored by reference.
...even though ODF is nice, Windows systems with Office need "plugins" to view them.And this is one of the very things adoption of ODF as a standard in large government agencies will change. MS can only hold out so long on making ODF use with MS Office difficult. When they start losing enough sales because their product is not doing what customers want, they'll change it. I'd also note that when the government provides a spec and take bids from vendors, when one vendor tells them "no" and sys they'll have to make do with something that does not meet the spec, then tries to lobby government officials in order to change the spec to one that is inferior for their customer and will cost more in the long run, well maybe it is time to rethink doing business with that vendor at all.
No one is arguing about support. Apple is supporting these tools and patching them. The point is, since they aren't needed, or part of the OS, or used on 99.99% of systems and are not presenting a security risk on those systems, why are they being counted multiple times as high risk security flaws? In this "comparison" not even IE bugs are being counted against Windows, which is software also included, but in addition enabled by default and actually used by most users.
I don't know about that. They're presumably paying the licensing fee to offer ThinkFree to their internet customers, instead of offering OpenOffice for free. Also, we're not talking about the "front window" by any means. They just have a cache of software they provide from their own servers without charging you for the data transfer costs (since they don't have to pay transit). It would cost them basically nothing to leave OpenOffice on that server. I might even buy into a MS backroom deal conspiracy theory here, as it only supports MSOffice formats, but it does not support OOXML and exports to PDF so maybe not. I wonder what the Australian government agencies that are standardizing on ODF will think of this.
I think you're misunderstanding the grandparent post. He was talking about Apple providing ALAC for users that did not like AAC. ALAC is "Apple Lossless Audio Codec" and is an Apple, proprietary technology, not another name for AAC or an MPEG standard.
Aside from that, being a lossless format, it is already possible to convert it to any other format losslessly with existing freeware and several software players have reverse engineered it and play it just fine. Lock-in is not really a concern.
They're very big, you might know them by the name Telestra. BigPond is a subsidiary and the dominant ISP in Australia. They didn't develop it, they just rebranded ThinkFree after licensing it from Haansoft.
And what is the business plan behind this? Especially since it competes on one side with Microsoft Office and on the other with openoffice.org.Partly I think it is value added to compete with the other ISPs (they actually have some competition still). They may be selling support and addition services to the business market in the future.
Umm, the OSS libavcodec has played ALAC for over a year and Mplayer and VLC both can play it as a result. That's not a lot of lock-in.
Win for Apple, and lossy everyone else, including customers. (Inless[sic] they have the wisdom to just say no and keep buying CDs. And iTunes store's popularity suggests lots of people don't.)I've bought a couple of songs from iTunes Music Store, when they were not easily found elsewhere. Getting rid of the DRM was not hard, even without burning a CD or losing quality. Apple is moving away from DRM as well, as fast as the studios will let them. They don't care about the music. They just want it easy for people to use iPods and they seem pretty content to let the iPod compete based upon merits and momentum. Do you really think freeware won't batch convert ALAC to FLAC? In fact, Google tells me Foobar and DBPowerAmp both do it today with free codec plug-ins. I guess I'm not buying your "lock-in" theory.
They're not including it as a "core part" though, just as some free developer tools.
If certain parts of the OS depend on this, then they should do the necessary QA.Umm, for the example I listed, the OS does not depend upon it at all. You can remove it with no problems at all and even among developers who know what this is, very few would use it especially exposed publicly. The only way I see this being exposed is if a Web developer was writing a really complex tool with a Web interface that needed users to input regular expressions for complex sorting of data, and they hosted a development copy on their workstation and then exposed the Web server so some people in a remote location with a malfunctioning VPN could try it out.
When a flaw is discovered they have two options, either get the latest patch from the module developers, or if it is not available work with them to ensure that a fix is provided.They did get the fix from the vendor and patched it in the next update. The issue is: should a bug that is a potential hole in a free tool, which they happen to include and which will realistically never even be exposed let alone exploited, be considered with the same weight as a hole in a service actually running and exposed on Windows? What about a hole in IE, which MS includes, but whose vulnerabilities were not included in this "study' as counting against Windows?
For me this is like a car manufacturer, which discovers that the tires have a design flaw, after it gets to the customer. Sure it might not be directly their fault, but they are responsible for ensuring the fix gets to the customer. It doesn't matter if it is their problem or their suppliers problem, what matters is it gets to the customer.Oh boy, a car analogy. How about if it was something a bit less critical than the tires, say some misspellings on a map that came in the emergency kit. Should that be listed and given the same of more weight than a leaky gas line in competing product? Should each misspelling count the same as a mechanical fault in the competitor's vehicle? There were 8 "Highly Critical" vulnerabilities counted against OS X because the OSS project that writes the module listed every bug in it as a potential security problem, despite the fact that there is no evidence anyone on OS X ever actually exposed that component to hackers, no exploit was ever found, and it is not even certain it is exploitable.
Would you care to bet there are thousands of analogous bugs in IIS components that MS has not bothered to fix, let alone report to the public?
Considering the trend for outsourcing, probably more than you'd think. A lot more yet simply ship the code off to India or Latvia or somewhere, get it back, perform no real reviews of the code, and ship it out.
I also like how you blanket-troll all vendors of proprietary applications as if none posses basic ethics.He does paint with a bit of a broad brush; but he also has a point. Commercial, closed source vendors are running a business and their primary motivation is money. Sadly, that often means hiding security breaches from users, even when that places those users at risk. OSS projects may have commercial motivations as well, but because of the process they cannot easily hide this type of problem... which is good for users.
I'd argue what really matters is how these vulnerabilities were discovered and what vulnerabilities have not been discovered, how these vulnerabilities have been reported and what vulnerabilities have not been reported, what the risk to normal users from vulnerabilities is, and (in the case of this article) which of these "vulnerabilities" are real and which are reserved numbers, only potential vulnerabilities, duplicates, and vulnerabilities that realistically cannot or will not ever be exploited.
In my opinion MS broke down when they did not perform the same level of code review, did not find as many potentially security related bugs, did not fix half the bugs they did find, and did not report either the bugs they found or even all the bugs they fixed. And then, or course, the speed with which those bugs they found, fixed, and announced were actually patched.
Agreed, although not all the "vulnerabilities" listed in this so-called study do ship from Apple, many are third-party applications that just run on OS X. Also, OS X includes a lot of cool tools with their OS, because they are free. 99.99% of the time, these tools are never used, let alone exposed to the outside world. For example, almost a third of the first 30 CVE's listed in this study apply to the same Perl, regular expression evaluator. Now how many users do you suppose turn on Apache and this module and make use of it on a Web page they're hosting from their home computer? I mean these tools are great for Web developers that want to test stuff on their workstation, but that is likely about all they are used for, in the very rare cases that they are used. That particular module accounts for 8 of the "vulnerabilities" in OS X listed.
It is fine to list these as vulnerabilities, but for a comparison to vulnerabilities in Windows, well they're pretty useless because of the use case as well as the dozens of other things wrong with this study. I mean, the OSS team developing this module lists each and every potential hole they an find on a public Website and it is counted by Secunia. Their list for MS includes only holes that have been discovered by the public and which MS has acknowledged. Since MS does not publish most of the bugs they find, none of those are counted against MS, including the ones they don't bother to fix (more than 50% according to an ex-MS developer I know).
Secunia knows this. Every respectable security expert knows this. The only problem is, random bloggers don't seem to know this, and write "articles" about it which get widespread readership, misinforming large numbers of people and leading them to make incorrect decisions that end up causing problems for everyone.
Yes, I know. I never implied otherwise. That is why I said a large number of companies doing one enables other companies to do the second. You see how that works?
Conflating separate things and making conflicting claims (e.g. "ODF is a standard" vs. "switch to OpenOffice to use ODF") when it suits them is a tactic Microsoft uses, not us. We should be better than that.I never conflate those items at all. Where are you getting this? I said that if most companies can handle ODF, the main reason to avoid using certain software packages that are cheaper than MS Office (like OpenOffice) has been removed. You never answered my question. If almost all companies have a way to handle ODF, what is the disadvantage to switching to it internally and buying cheaper software packages for some or all of your internal needs?
So I took a look at a few sample vulnerabilities and it leaves me Flabbergasted. The person who wrote this article and composed the data should be beaten. The ones listed as OS X vulnerabilities are primarily holes in software that runs on OS X, much of which does not even ship with OS X by default. A lot of it is holes in various Web server modules, some of which do ship with OS X, but are disabled by default. Some of them are NOT EVEN VULNERABILITIES... like CVE-2007-3876 which is a number reserved for use by an organization for the next time they report a vulnerability, but they haven't assigned it to anything yet. Whole ranges of numbers listed are like that. I mean did the author even click on the links he's providing? I tried, I was more than twenty items into the list of "highly critical OS X vulnerabilities" before I found one that actually affected a default install of OS X, and it was a potential denial of service for SSL Web sites if you have a machine in the middle. Of the first 30, 12 were reserved for future use and not real vulnerabilities, 7 were holes in the same Perl library, and 5 were holes in tcpdump. Only one was a real, hole that could be exploited on a default install without additional software being added, or it being reconfigured as Web server or something.
Another question is, for the real vulnerabilities to the OS's, how do they decide what the danger level is for a vulnerability? For example, one low rated one for WinXP (CVE-2007-2228) was a possible remote exploit, whereas a Highly cCritical one for OS X (CVE-2007-0267) was a denial of service on a machine, requiring a local user account. Does this make any sense to anyone?
I'm all for pointing out security problems in OS X and other OS's and doing comparisons of relative security, but this is just a sad joke. Please, can we at least get articles by someone with the tiniest bit of a clue instead of the number game from someone who might be able to count, but apparently can't be bothered to read his subject matter.
I try not to respond to AC's, but since I still have my Google mining page open, here are references for all those I listed. Some people might find these useful if they're researching this topic themselves. Some have mandated ODF for some uses or within a given locality or agency. Others have simply standardized on OpenOffice. Some are acts of law and some of policy. I was pretty clear for each case I thought.
So far:
Those are the ones I know about from a quick Google mining. I'd say it is a bit more than "none." It isn't a huge movement, yet, but each one makes the next easier.
For home users, you're probably, mostly right. For some organizations, however (like schools) this can be a big plus. With OpenOffice you can already give students a free copy for home, but the Mac version is pretty lousy and a real performance dog. The advantage this brings is that you can also host an online service version for users who have a really old, second hand computer at home, or a three year old Mac ,or do their homework on public terminals at the city library. This means they can also access the same files from any terminal in the school, from home, from the library (where they can't install software), and from their grandparent's house where they spend weekends. This is a big win for such environments. It probably would even mesh with the OLPC project if it was deployed by a school in the US.