Apple Releases Security Update 2004-09-07

[Psychic Shopper]

Maybe it's compusa's fault

Could anybody double check the following? I'm trying to access CompUSA's web page (http://www.compusa.com ) after applying the security update and I'm getting a blue page with no workable links

I've verified this error in both a PB G4 and one iMac G4.

Possibly Comp USA was having a big sale on CD-Rs and the webpage guy had to go attend the cash registers, and left the page like this.

 

[MacFan26]

prebindings: Look here and scroll down to the "Update the prebinding" section.

I thought Panther was supposed to take care of prebinding? I remember hearing that that was only really necessary in prior versions of OS X.

 

[nagromme]

I've often heard that pre-binding's no longer needed. Installers do it automatically ("optimizing") and the OS also does it again--invisibly, and only if needed--each time you launch an app. True? I've never done it in my life

I've heard less often that you no longer need to repair permissions (which seems like an obvious thing for an installer to do as well). Unless you have a problem or crash. Repair permissions would then be in the same category as running Verify and Repair--a troubleshooting/recovery measure, not required maintenance. True or not? I still do it every few months... I guess I just feel like I have to do SOME preventive maintenance as a placebo?

Login passwords no longer seem to be stored in the swapfiles.
I do the grep mentioned in the bugtraq and I get a lot of gobbledygook, but no passwords. Yay!

Is this a big deal? I've seen people focus in on that as the reason OS X is (or used to be?) "useless" for business. It's not a subject I'm familiar with.

 

[swissmann]

I think what you're running into is what's called Negative Placebo Effect.

If you knew anything about the majority of the programs being patched, you would know that they aren't core components of MacOS. Furthermore if you notice how simple some of these fixes can be (literally one line of changed code in some cases) you're not going to notice anything different at all.

Come on people, what did you expect, your 1ghz iMac to run like a 2Ghz G5 after installing this update? waaaa "I don't notice a difference." Get Real.

And thank you Apple for staying on top of things.

/dale

I'm not talking about the patch making things work faster. I'm talking about it being slower on the same machine after the patch. I don't expect my G4 to run like my G5 (that's why I bought a G5). I was just wondering if it was more code to go through and slowed it down. I am also glad that Apple is staying on top of things.

 

[longofest]

No change is a good thing

Hey all. I have had no problems. And for those people who are ragging on those who have said that they "haven't noticed any difference"... STOP! All comments are welcome. A comment saying that they haven't noticed a difference is a comment saying that there haven't been any negative side effects that the user can tell.

 

[Apple Hobo]

And that's your fault for using Internet Imploder. If you don't know how to drive a car get off the road. If you don't know how to operate Windows safely get off the platform. And if you are forced to either drive a car or use Windows then LEARN how to use it safely. Easy no?
No one who is interested in a secure environment takes Internet Exploder seriously. That was your first mistake. Second. Do you have a firewall? No? Second mistake. Third. Windows Update? Never did it? Game over man! Game over!!

Not using IE does not mean it's removed from your machine. What if some other app invokes IE?

Do you always have to be arrogant and bitter?

 

[gorkonapple]

Could anybody double check the following? I'm trying to access CompUSA's web page (http://www.compusa.com ) after applying the security update and I'm getting a blue page with no workable links

I've verified this error in both a PB G4 and one iMac G4.

Scroll down some and it appears. I'd be more interested in does it do this on any version of IE. It looks, to me, to be more a issue of the web develper changed the page recently and it got messed up!

That said, I think someone else had stated the Safari update was only for 10.2.8.

 

[jcgerm]

Ok, I installed the security update and it killed my wireless and ethernet. I don't even see them in the network configuration. Fantastic...anyone else have this problem?

 

[SiliconAddict]

So you're saying then, that:

1. It's not Microsoft's fault if an XP user uses Internet Explorer and bad things happen;

Nope never said that. I did say that if you are going to jump on an inherently unsecure platform you better know what you are doing before you get behind the wheel.

2. You must learn to fully and properly use the software before using a computer (this would prohibit 99% of people from using them)

Then so be it. I'm not making up the rules when dealing with Windows I'm just telling you how it is. Don't like it. Use a Mac.

3. The user, not the software manufacturer, is responsible for making the software secure enough to use in real-life applications...

I'd call it 30%/70% Would you suggest that any person be allowed behind the wheel of a car without training? From my house I can see my neighbors:
1. Unprotected WIFI network.
2. Unprotected (read: no password) router.
3. Unprotected (Read: no password on admin) Windows XP box.

I don’t care who you are a computer is not a VCR or a toaster. There is some responsibility involved in using a PC. Less so on a Mac due to its inherent secure state. If you are going to use a PC you better deal with its insecure state. Many ISP’s are taking proactive measures by disabling certain ports that adware and virus infected systems are pouring spam out of. So what happens? ISP’s have to play cleanup for an untrained user. Again I don’t fully blame the user and I don’t fully blame MS. There is a percentage of responsibility here and AGAIN if you can’t deal with taking responsibility for your computer then IMHO you shouldn’t be using the platform or shouldn’t be using a computer. Harsh yes. But I deal with the IT side of things day in and day out. I’m just getting tired of this crap. Personally I would love to see a license program happen. Before you are allowed to buy an IBM PC clone you need to attend Bob’s basic computer training course and get a license.

I've never had a page hijack my browser simply because I dared use the software that came installed

Then you aren't in a large enough PC environment. I would say of the 178 PC's I admin 30% have some form of spy/adware and of that 10% are critical enough to warrant a reimage of the user's system. (I've done 10 in the last 4 months about to start on my 11th prob before the end of the week.)
Not to intentionally get out of the bounds of good taste, I can't find a better analogy, but browsing with IE is like having sex without a condom. You may not get an STD for a while but your luck WILL run out depending on who you are with or in this case what site you go to. With that I will leave you with this pretty picture that I have as a reminder of how bad it can get. Try and count the adware. This isn’t just an MS flaw its also a user flaw. Using a computer, be it Windows or Mac, takes a brain. Clicking on every popup that occurs takes a serious level of stupid that is “special”

 

[MacFan26]

I've often heard that pre-binding's no longer needed. Installers do it automatically ("optimizing") and the OS also does it again--invisibly, and only if needed--each time you launch an app. True? I've never done it in my life

Yeah, I heard it was part of that "optimizing" process. The optimizing thing is kind of annoying to me because I never really know what it's doing Anyway, I did the update and all's well

 

[SiliconAddict]

Not using IE does not mean it's removed from your machine. What if some other app invokes IE?

Do you always have to be arrogant and bitter?

Where are you getting arrogant from? I’m being realistic. I deal with this crap all day long. If you are confusing experience with arrogant sorry.

As for another app calling out to IE. It’s possible. However there are several factors keeping this from happening. One. From what I understand, I’m hardly a programmer, the API’s that can be invoked by external apps can’t be called from an alternative browser, the scope of the discussion. I know for a fact that there is a whole heck of a lot that can be called from IE. FireFox? Not so much.

If I come off bitter it’s from dealing with more and more outbreaks of severe adware on people’s computers in my office. As a test I’ve installed FireFox on 12 systems in the office as an alternative browser but not a replacement since there are internal apps the were developed out of corp that require IE. All 12 users are adware and Trojan free. Coincidence? Possibly. But I doubt it. The rest of the systems? I get to go to at least a handful every day with users swearing up and down they didn’t do anything. Even though when I go to their browser history I see them going to www.bobssupercoolstampcollection.com or some other WAY off website that prob gets its bandwidth money from adware distributors. While I get to spend an hour attempting to clean someone’s system of spy\adware because they don’t know enough not to click on the popup. Yes I’m a bit bitter or possibly a bit burned out. Not sure which at this point.

 

[jrober]

OOh we are a grumpy lot today.

Ooh we are a grumpy lot in this thread today. I will leave the IE arguement to others that is why I have a Mac

I have installed security updates as and when they appear for the last 4 years from Apple on 2 machines G3 iMac and G4 Powerbook (Just out of Nursery Skool) and only ever had minor issues e.g. Would not sleep properly.

Apple don't seem to be abusing their nice software update feature. Steady updates to ensure their users have the latest and best, combined with acknowledging who found the weakness seems very fair to me. The downloads are quick and painless in most cases.

Life is too short to get wound up about a software update which makes your beloved Mac stay ahead of the game. Chill be cool and look forward to the weekend.

 

[AmigoMac]

Scary...

Hello? Where am I? the last post (This one, before editing it) said "Tepi " no fu****ng idea what it means and no idea who wrote that I just went out a bit and came back to see new post but I found one from my self , one I never wrote... I changed passwords, just in case but, holycr*p ... that scared me a lot !!!

 

[MacFan26]

Hey everyone look on the bright side, the Red Sox are in first for the wild card!


(I know, totally unrelated)

 

[kaylee]

... And have installed about 5 virus checkers which all tell me that I have x and y viruses but than ask for $z to remove them.

Panda Activescan is a really good free online virus scanner, although if its a really nasty virus you may have to scan then restart and repeat.

And if you want some AV software AVG antivirus is free for personal use.

 

[ssamani]

Thankyou to Apple for providing detailed information on the security update changes

I have to agree. I hadn't bothered to look at the Kbase info for updates before now, because it didn't give you much extra information above what is in Software Update. It seems as if since June, the policy has changed to be more fully open about exactly what, why and how they are fixing security issues. I think this is a fantastic improvement by Apple.

I don't think that PC heads really appreciate the level at which security updates on Mac's are working. They are worrying about whether enabling security by default (SP2, doh! ) will have an impact whilst we're worrying about whether some obscure set of conditions might open a security opening, if we have chosen to take down some security to allow us to, say, FTP files to/from our machines.

Sanj

 

[ssamani]

Yeah, I heard it was part of that "optimizing" process. The optimizing thing is kind of annoying to me because I never really know what it's doing Anyway, I did the update and all's well

That's true for installs that use the Installer application. Its never completely clear whether they are doing a full prebinding update, or just on what has been installed.

Where the prebinding needs to be considered is where over time you have installed a number of apps with the drag-into-/Applications-and-drop method. In theory they should get pre-bound when they are first run and the pre-binding should get updated whenever you install updated libraries using the Installer. However with any of this sort of thing, things are likely to get out of sync, and it does no harm and can potentially improve performance of your machine.

I highly recommend Panther Cache Cleaner for doing all the tasks (daily / weekly / monthly, prebinding, fixing permissions, etc.)

Sanj

 

[will]

Good to see Apple taking security seriously

I am pleased to see Apple releasing updates such as this (with credits and CVE-ID), and applying them to Jaguar (10.2) too. Many non-technical and home users will still be running 10.2, and it's important they're kept as secure as possible too.

We need to adjust to the security environment we face. All operating systems suffers from defects and security issues, openly tackling them is the most effective way of dealing with the problem.

Would you rather there were less updates and your machine was less secure? Is ignorance really bliss? I don't think so.

 

[davecuse]

I just looked at the CompUSA page, very odd. It seems to work fine in FireFox, although there is a big delay before the content gets loaded.

 

[Lancetx]

I just looked at the CompUSA page, very odd. It seems to work fine in FireFox, although there is a big delay before the content gets loaded.

Same story with the Fedex.com and BestBuy.com websites.

 

[Baron58]

Just wanted to kinow....why are there folks repairing permissions after every flipping update? I mean you'd hope Apple would have the permissions right when they did the update package right?

Yes, BUT...

1. Apple made 'dual booting' OS X and OS 9 possible to ease the transition for early adopters, and

2. Apple made the 'Classic' environment possible, and pre-installed on all systems, and

3. There are a lot of whiners going "waaaa, I want my type-and-creator metadata",

THEREFORE

Apple chose to use HFS+ as the filesystem instead of UFS (or JFS/XFS/ext3/reiserfs) to accomodate 1 - 3 above.

HFS+ is the most unstable filesystem I've ever seen. Remember repairing 'bundle bits' and 'catalog btree' on old pre-OS-X systems? That is HFS+ eating itself. On OS it tends to lose the permission flags. Hence, the need for regular repair.

 

[AmigoMac]

Fedex works ok ... about bestbuy and compusa ... is apple taking marketing tactics up? ... ... Apple must be working on that...

 

[jossblowing]

I don't see much of a change given the history...

http://docs.info.apple.com/article.html?artnum=61798
http://docs.info.apple.com/article.html?artnum=25631



More folks then ever are using Mac OS X hence more developers, etc. playing around finding issues as well as Mac OS X is including more and more functionality (Apples own and third-party). Also Apple is being relatively proactive about getting patches out quickly more so then in the beginning of Mac OS X. I don't think is shows much of a quality issue...

I think you are a little misguided actually. The reason patches are coming out quickly is due to Apple using Open Source software components which are present in Linux, BSD and Unix, etc. systems around the world. It's more down to increased usage of these softwares that these fixes are being created, than anything to do with Mac usage (which I believe is actually falling a little?). Look at most of the fixes, I can only see Safari, Quicktime and CoreFoundation (Darwin? Open?) that are actually closed and controlled by Apple - the rest is freely available and widely used.




joss

 

[wordmunger]

Glad to see this update works with 10.3.4 -- 10.3.5 was unstable for me. FWIW, the Compusa site runs fine on my Ti400 with the security update and 10.3.4.

 

[7on]

I think you are a little misguided actually. The reason patches are coming out quickly is due to Apple using Open Source software components which are present in Linux, BSD and Unix, etc. systems around the world. It's more down to increased usage of these softwares that these fixes are being created, than anything to do with Mac usage (which I believe is actually falling a little?). Look at most of the fixes, I can only see Safari, Quicktime and CoreFoundation (Darwin? Open?) that are actually closed and controlled by Apple - the rest is freely available and widely used.
joss

yeah, say the BSD people find something amiss with their OS. They fix it and tell Apple about it so Apple fixes and probably waits a while to gather enough fixes to qualify for a security update.