quote:"The only thing which has kept Mac OS X relatively safe up until now is the fact that the market share is significantly lower than that of Microsoft Windows or the more common UNIX platforms.? If this situation was to change, in my opinion, things could be a lot worse on Mac OS X than they currently are on other operating systems," said Archibald at the time.
Well, I find the conditions of the contest questionable to say the least :
quote:
Participants were given local client access to the target computer and invited to try their luck.
With local access, even as guest, this is DARN EASY on any OS.
Any, Linux box, Unix, you name it.
That said, Steve Jobs's genius is difficult to question - Mac OS 9 the infamous was not his baby,
NextStep and Mac OS X are - and the dynamics of Apple,
the way he subtly conquered back the market, and the dedication of Apple to delivering comprehensive solutions :
he doesn't rely on third party hardware, instead keeps the full control of all his production.
Considering this "return to the front", it's no surprise they have not had time to consider
security THAT deeply, especially with no threats for many years,
but the BSD nature of OSX is a guarantee of excellent quality nonetheless
(BSD licenses have specificities in the development process - 'nother way to phrase it : BSD Licensed ==
a lot of nerds who scanned a lot of tiny details before anything went live).
Business wise, Steve Jobs is a giant, tech and communication wise, and design wise, Apple is the future,
and these are just my personal 2 cents.
Last but not least : "nobody is perfect". AND nothing is perfect either, happy sad world.
Aside Buddah, or Gandhi, or Superman, show me someone who does not have insecurities
quote:With local access, even as guest, this is DARN EASY on any OS.
i doubt that there is much you can do DARN EASILY on a vista machine with local access only.
oh and i wouldnt say that apple is the future. apple is lifestyle, but when it comes to performance (just look at games!) they lack behind A LOT. actually the only system which runs the small share of games which is available for macs is the powermac. and if you spend the same money on a pc, you do get a lot more power than on any mac out there. i just took games as an example since they suck up most of a pcs performance - more than any other application. i work on a mac once a week, and actually this thing hangs up more often than any windows xp or vista ever did. if you open 2 or 3 apps at once you need to get worried about mac style system crash. which means freez.
i agree that nobody is perfect, windows has its security flaws too, but if you compare the amount of attackers of windows with osx, i think microsoft does a pretty good job. and they have a tougher job in protecting their OS than Apple has.
From: Cranleigh, Surrey, England Insane since: May 2003
posted 11-14-2007 19:17
I think this argument is actually slightly petulant: "According to gwerdna, the hacked Mac could have been better protected, but it would not have stopped him because he exploited a vulnerability that has not yet been made public or patched by Apple.". Well...this is true of any system: if there are unpublished, unfixed exploits then it can be compromised....is anyone surprised by this? If the guy had unpatched exploits...what the hell is the significance of 30 minutes?
Of much more relevance is the rate at which exploits are found. So please, contest that. The quoted story has pretty much 0 relevance to....anything. I'm sure there are plenty of unpatched, unpublished exploits for windows.
Besides...if you have local access...there are SO many vectors that I'd be quite disappointed if he hadn't found anything in half an hour.
wrayal: actually i was referring to a certain paragraph of that article, but nevermind. screw it.
quote: wrayal said:
I'm sure there are plenty of unpatched, unpublished exploits for windows.
maybe, but there are definitely not as many as for OSX. but you wouldnt notice that, since apple has a few million user less than windows has. which is the important difference. its easy to claim that you have the safer OS when you have 90% less guys who are trying to hack it.
i just dont understand all these guys whining about windows. windows is so bad, so unsafe, so unstable.... its the same with OSX!
quote: mas said:
quote: "The only thing which has kept Mac OS X relatively safe up until now is the fact that the market share is significantly lower than that of Microsoft Windows or the more common UNIX platforms.? If this situation was to change, in my opinion, things could be a lot worse on Mac OS X than they currently are on other operating systems," said Archibald at the time.
You left out the part where it said that Vironica and Betty agreed with Archy
This is the kind of quote where someone states their opinion as if it were fact and eveyone else bobble-heads and it gets reapeated enough times that everyone starts to think it's a fact.
It reminds me of the time after Apple first introduced their Graphical User Interface when IBM placed six executives in a room with a number of (I think they were) Lisa's and after eight hour none of the executives could figure out how to work them so IBM declare that the new interface would have no impact on the future of computing
From: Cranleigh, Surrey, England Insane since: May 2003
posted 11-14-2007 21:22
I'm really not fond of these arguments - everyone has a point one way or another. But the fact remains that OSX *is* safer than windows if there are fewer people out there hacking OSX machines, whatever the reason for that may be. Maybe not so in the future, but for the time being, that is the state of play.
Also 'maybe, but there are definitely not as many as for OSX.' - I'd ask for a basis for this belief, except that by definition 'unpublished' means there can't be one.
Oh...and don't confuse safety with stability. Windows is less stable even in the absence of attackers
And on for another, though useless, developer perspective, and *first class expert's* technical insight : Vista at my work place is a steamy pile of bullstuff.
Irony aside, as this is rather a user perspective in the context of my current workplace (my client WS is Vista, my target machines are servers, Linux and Windows 2003),
when I reboot, one of my monitors is always crippled (lil'squares allover), and it refuses to keep my monitor arrangement : it will always swap them after restart, no matter how hard I try.
Cool beans, my work Vista cannot be called stable in the slightest, but hell it is funky.
...Now for the real developer perspective : the core API still is the same. The same as in... Windows 95, the superb Windows API : itself such a steamy pile of nonsense
that it hurts - there aren't two modules that are congruent to one another in the Windows API. It reminds me of the experiments on LSD & drawing in the 70's,
feels like Redmond is a bit of a wild party place.
Now, mas, if you want to be root from guest on your Vista, given this presence of the everlasting "Windows 95 recycling with a new GUI" philosophy (ha-hem),
look into "system messages - code injection", I am willing to bet it works in Vista, still (then again, this one probably works in Unix or Linux as well,
a tad crafty as it requires some application patching, but feasible, and really, not that hard - given some practice, feasible in 10-20 minutes from scratch yeah).
I am trying my luck at this type of vulnerability because it is a consequence of the practices of OS design (or at least was since the dusk of 32 bit systems).
Basically, with that one, ALL you need to have is a textbox in a program which is run with system level privileges.
Aero is exactly what the name says : thin air, blow it away, and you'll see through the holes.
But taste is taste and a personal thing, and challengers are a requirement of evolution and a good thing : go with Vista, please, it'll help keep "our" Steve Jobs
fit o)
i just dont understand all these guys whining about windows. windows is so bad, so unsafe, so unstable.... its the same with OSX!
This is a pretty common error in argument. I have encountered it in many different guises, usually in topics much more volatile than OS security. Take, for example, the issue of racism.
Person A: You know, society B has a real problem with racism.
Person B: Oh yeah? Well, society A is racist too!
Maybe so (in fact, likely so), but that doesn't make society B any less racist! This is known as the tu quoque fallacy (literally, "Thou, also"). The truth of a statement does not depend on who said it. If a thief accuses another person of being a thief, the fact that the accuser is a thief has no bearing on the truth of the accusation.
So posting articles about how unsafe OSX is does nothing to defuse claims of how unsafe Windows is. It might make you feel better, but it does not really address the issue. All it does is establish the fact that all OSs have vulnerabilities--it does make any single one of them safer.
Sorry mas, I don't mean to get on your case, but I see this fallacy every day (it seems to be especially prevalent on the internet) and it bugs the living crap out me.
It might only be my opinion, but the weakest component in any system is the user. I have had the same XP installation on my home PC for over half a decade, and (knock on wood) have not had any serious problems at all.
Of course, I have corrected some serious problems on a colleague's Mac - though, admittedly, not a malware issue.
In the end though, good working practices are more important with Windows than with OSX. I don't believe this makes OSX stronger, but it goes some way toward removing the power to mess things up from the user.
As for undocumented security holes - I'm certain that with the increase in OSX's user base, plenty more of these will be exposed...
Although I just noticed a rather embarrassing mistake in my post. The last clause in the second to last paragraph should read "it doesn't make any single one of them safer." Oops. Nothing like saying the exact opposite of what you intend.
Well said Suho. Of course, I think for most people the real point, and the purpose of these kind of arguments, is the huge PR campaign by apple touting how secure their systems are, and their tiresome "I'm a mac. I'm a PC" ads that portray Windows as virus ridden insecure software.
It's more of an argument to show that Mac is no better than it is an argument that tries to validate Windows.
i doubt that there is much you can do DARN EASILY on a vista machine with local access only.
Don't know... I would consider putting a livecd (et al.) in, mounting the FS and doing anything I pleased with the data pretty easy. But obviously I wouldn't consider this a crack/hack.
Any OS is only as secure as the sysadmin makes it. You'll notice, if you check, that the cracker culture goes back a long way, and Unix systems are still the prize, because they are typically more secure. The bottom line is that your average Unix sysadmin is going to be better than your average Windows or Mac OS (desktop) sysadmin, and the software immediately available to him is going to help him more. In the case of the average desktop computer (regardless of OS), the "sysadmin" (whoever setup the box) is an ignoramus compared to your average cracker; and few OS's default setups are even remotely secure.
From: there...no..there..... Insane since: May 2001
posted 11-16-2007 02:16
might be a bit off topic, but I really hate the "pointing of fingers" that other OS users have. Linux users are the worlds worse for this. Microshaft and what not. Who cares. I run linux, big deal. I still run Windows. I'd run OSX if I could afford an iBook.
There are some good point here though.
quote: reisio said:
Any OS is only as secure as the sysadmin makes it.
very good point. I still know people on cable internet that don't have router/firewalls and as many times as I try to tell them how they need it, they cring at having to spend ~$80 for it. Beats having to buy a new computer or having your checking account hacked into.
Hmmm. Just something about security in general, and I am not pointing fingers myself,
merely reporting my experience with Vista so far. I think I made it clear enough that I consider taste as a personal matter :
The sysadmin doesn't have that much impact on the security of a system, in the end, I don't mean to "nitpick" but it's
not a proper evaluation of what he can/cannot do.
Think about an OS as a building, a bank for the case at hands.
And the sysadmin is - not even the builder, he is in charge for dispatching resources and accesses in the building.
Now, the building has a weak point, weak wall, where a bomb will allow thiefs in in a matter of minutes. What's the sysadmin to do about it?
Can prevent -some- of it, can report to the architect.
Cannot do much if the thieves get themselves a bigger bomb and the architect has not come up with a fix.
Every building has such a security flaw, even Fort Knox. Every OS too.
This is not even due to software design : this is the very nature of -security- itself - nothing, I mean nothing, is unbreakable.
That said, Mac OSX is a very recent buidling based on a Fort Knox kind of foundation.
And it's kept "simple and to the point" : functional as needed, no more, no less.
For Vista, the outside is shiny and new, but the core is a cabin built back in 95 (pre-internet-history in
information science, somehow). And it's jam packed with bizarre and useless, and never visited wings : the "USB keys acting like a cache" concept
for example. Nice try. Wrong result for many reasons out of the scope of this discussion.
...the rest is essentially taste, but I personally feel more secure, and more comfortable, working in the first of these two.
Well that's just odd. I'm sure I posted a reply, but now it's not here.
Anyway, the gist of it was in reply to DL's post. I do see the point of shooting down the "Mac is better than Windows" argument, which is why I felt a little bad about harping on the point in the first place. It can be very easy to jump from that to tu quoque, though. It's really amazing how easily these things get conflated. But yes, you are right--as a simple counterargument to the "Mac is superior" claims, it is certainly a valid approach (I don't know enough about cracking to say how valid this particular argument is).
posted 11-14-2007 13:36
*first class expert's* 
