Got a tip for us?
Let us know
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Breaking News - The Worm Turns
- Thread starter VanMac
- Start date
- Sort by reaction score
iSaint said:
Typically, you don't get to be a Computer Science grad without learning about Unix. There are/have been both viruses and worms for Unix systems -- the original "Internet worm" (the Morris worm) infected Unix machines. Apple certainly takes the potential seriously, otherwise they wouldn't release security updates like they did the other day.
I think there is something to the "small market share" argument, but there is more to the lack of Mac viruses than that. First of all, people write viruses for the platforms they have access to. If virus writers follow the normal distribution of system usage, 97% of them have PCs, therefore at least 97% of viruses should be written for PCs.
I give some credence to the "Windows as abusive relationship" theory. Mac users tend to *like* their computers, and have fewer frustrations and hostile feelings to work out against them. Windows users are used to dealing wtih Windows hassles, and apparently some of them want to create more. Other plaforms that people use because they like them (OS/2, Linux, BeOS), rather than because they are the standard, also saw and see less malware.
Certainly, Apple tries to stay on top of the potential vulnerabilities in its product. MacOS X may have fewer inherent vulnerabilities than Windows for this reason, and because the BSD Unix it's based on has a reputation for solid code and decent security from design through execution and decades of debugging.
I also think there is an advantage in offering a product that has the reputation of being expensive, even if in reality it's little or no more expensive than comparable options. When I was a starving student and learning about hacking, I was buying PCs. Now that I'm not starving any more and I'm using Macs, I also have a better perspective on how valuable my time is and I'm less likely to waste it writing malware.
If you're interested in writing a virus or worm, you want it to propagate. Regardless of the inherent security or insecurity of the respective platforms, you're going to want to target the one that has 97% of the market because there are more systems to provide your code with "critical mass".
I think a lot of factors play into the lack of Mac viruses. I think market share is a big one, but I think psychology and demographics are at least as important.
Crikey
That article was dumb. The idea that linux accounts for more security breaches than windows is simply ridiculous. Security aside, there simply aren't enough linux boxes out there. They could all be breached 5 times and there still wouldn't be as many as windows.VanNess said:
That said, macs do benefit very much from security by obscurity. Not only is there little benefit in targetting the platform because there aren't many users, a worm could never spread itself over the internet because there isn't a critical mass of machines to target (as was just pointed out).
Claiming that "the Unix base of OS X" gives you an automatic shield from all harm is silly. The name "UNIX" (as Apple marketing likes to throw around so much) isn't some magic wand that gives you perfect reliability and security. Sure, it's a better model than windows where the average user is running with admin privileges all the time, but if someone is determined they can hack just about anything. Again, it's just not worth anybody's time to hack os x when there are plenty of windows vulnerabilities with free exploit code.
The attraction to hacking something is not glory, as you're all supposing. There is a very serious industry based on delivering adware and spyware to the desktops of computer illiterate people. Again, security by obscurity: crack every mac out there and you have a few million victims, crack a small percentage of windows machines and you have many more which = more profit.
It's all fine and good to gloat that we're sitting safe behind our macs (because we are very safe, comparatively speaking), but please don't claim that the differences in engineering between mac osx and windows are the only (or even primary) reason. A reasonably savvy windows user who uses a good firewall and applies patches when they are supposed to and doesn't use IE will be just as safe as us.
patrick0brien
macrumors 68040
berkleeboy210 said:
-berkleeboy210
Oh dear GOD!
"It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world..."
patrick0brien said:
lol, that ride annoys me the most. I'd hate to be stuck on that with the music playing over and over again 😱
Of course, everyone is forgetting this is Windows 2000 being affected - not XP, the most recent release.
Xapplimatic
macrumors 6502
Man, you are just starting.. 😉 but a good one.
I feel lucky.. My entire family switched two years back.. and except for my mental sister-n-law that nobody listens to who thinks a 100 MHz Compaq Presario on dialup was a good time, nobody misses Winblows at all.. 🙂
zflauaus said:
I feel lucky.. My entire family switched two years back.. and except for my mental sister-n-law that nobody listens to who thinks a 100 MHz Compaq Presario on dialup was a good time, nobody misses Winblows at all.. 🙂
VanNess
macrumors 6502a
kamper said:
Well, if you think the article was "dumb" you can't possibly know who mi2g is. (Hint: they are acknowledged world-wide as digital risk specialists).
And the "security through obscurity" rationale as the exclusive reason Mac's haven't seen virtually a single instance of virus infections/trojans/spyware/malware, et al., just doesn't pass the smell test. The installed based numbers compared to windows might seem small - comparatively - but the Mac user base isn't that insignificant. You need only ask, ironically, Microsoft. Bill Gates himself said earlier this year that Office for the Mac has been very profitable for Microsoft. Suddenly, it seems it's not a such a small installed base after all, if Microsoft can easily justify developing for it. All in all, the market share exclusion theory just doesn't explain why there has been virtually nothing in the way of viruses, trojans or spyware to date on the platform. There is certainly a large enough target (millions and thus, newsworthy) of a rather notorious installed user base to ring at least one malware author's bell, but there's been nothing.
And the glory-seekers, are in fact still out there, happily coexisting with Spyware Marketing Solutions, Inc. Sven Jaschan, author of the Sassar and Netsky worms (two of of most disruptive viruses ever written), was a teenager arrested sitting at his Mom's home computer. His reason, according to investigators, was to "gain fame as a programmer"
The fact is, the are very real differences between OS X and Microsoft Windows of any version. Whereas Microsoft designed it's OS architecture to be interdependent with Explorer, Word, WMP, et al., the Mac OS X system and inclusion of the Unix architecture was designed with security at the forefront, not application interdependency. That alone raises the barrier to unauthorized, malicious entry. OS X requires an administrator password to install software, update the system, make certain configuration changes, and so on. The differences between OS X and Windows are much more significant than market share. No one is claiming the Unix foundation of OS X is a guarantee of immunity; no OS will ever be hack-proof, but OS X is proof that an ounce of prevention is still worth a pound of cure.
By the way, I wish CNN, ABC, the US Government, and countless other large corporations knew that "reasonably savvy windows user
iMeowbot
macrumors G3
Well yeah, consider the source. mi2g are well known for sensationalism and, at times, outright fabrication.kamper said:
Hysteria roll call: mi2g
Security Through Soundbyte: The 'Cybersecurity Intelligence' Game
Why is mi2g so unpopular?
Xapplimatic
macrumors 6502
For the last time, there is nothing "obscure" about security.
That couldn't be farther from the truth. Wether or not it's "security through obscurity" is irrelevant. That phrase shouldn't even be used in an honest forum because it smacks of anti-Apple bias since there's nothing "obscure" about the Macintosh platform, Mac OS, or Apple... As much as Microsoft has traditionally tried to pretend that Apple is obscure, it isn't anymore obscure than the press decides it is.. Mac usership hasn't changed that much, but has remained relatively stable over the long haul now on the increase. The iPod decided for the press that Apple was nolonger "obscure". How quaint.
As you know, there are no true viruses on Mac OS X. The only purported trojan horse was a stunt by a security firm ("Integro" if memory serves) to sell Mac users their anti-malware which basically only focuses on keeping Windows viruses out of emails sent from Macs to Windows machines. That exploit was fixed within less than a month by Apple itself. Compare that to literally several new real viruses every day on Windows.. over 100,000 known viruses in the wild, do the math. Obscurity if valid couldn't even begin to account for that stark of a contrast. Truth be told: It doesn't matter if you use Internet Exploiter or FireFox, it's still Intel code under a sketchy Windows OS. Pure engineering explanation. Windows has already exploited flaws that still exist unpatched. Some things go unpatched for months, even years on Windows. Mac OS X's only known exploits aren't generally known pretty much until the patches are already released for them detailing what the exploits were.
Good engineering deploys high levels of public scrutiny to find flaws and provide feedback for corrections. Microsoft lacks this step in product development. Their code review is all inhouse, closed door. So from a purely engineering point of view, UNIX is always going to be more secure and less bug-plagued than Windows anything until Microsoft changes their closed-source practices.. Any *nix is going to be more secure than Windows because anybody (including all the independent security firms) out there can review the collective sourcecode of all the various apps that comprise the system and report flaws/potential exploits privately to the parties concerned to generate a patch before a hacker finds out about it on some website. While its true that hackers also have more access to find things too to exploit, the reality is that it rarely works this way. Usually if a hacker spots a problem for malicious exploit, by the time they see it, someone with more well-meaning intent has also found it and reported it for prompt patching. WIth Windows, only hackers will have the source code for it because genuine security firms aren't legally allowed to use copies of "stolen Windows source code". That's not a good situation at all.
Windows users must wait 100% on Redmonds to do everything for them. Redmonds has to become aware of the flaw, decide that it's worth fixing, and then handle generating the patch code 100% on their own since their OS isn't based upon open source projects at any level. Apple on the other hand may find most of its OS flaws are already corrected for them by the open source community by the time management becomes aware of the need for a patch. They simply incorporate the new versions of code into their code tree for OS X and voila, patches are in place without much effort on Apple's part. The advantage of that is obvious. The open source community and all its resources and millions of eyes and brains are a resource shut off from Redmonds.. Microsoft will shun the favor of public review while Apple welcomes it. Smart move for Apple.
Windows will never have the advantage of peer review because Redmonds forbids access to nearly everyone outside to review their source code (save for court order that is). Furthermore, they don't even let any one department examine the entire source tree for Windows (Bill Gates is ultra paranoid didn't you know), as each department manages its own segment of Win code. That way (Gates thinks) no one engineer can be paid off by an outside company to steal the source code for Windows because nobody save a priveleged few have access to all of it.. geeeez.. and people wonder why Windows still has so many security holes, bugs, and why Longhorn is taking years to complete.. It's because its like the tower of Babel over there! How is a setup like that ever going to agree on anything or effectively create a cohesive, coherent product? Please.. don't ever tell me that engineering doesn't have a primary role in this problem, because buzz words and "obscurity" side-show distractions aside, engineering still plays the major role in this disastor or there would have been at least one good success at targetting Macs by now.
Obviously advertising dollars does not dictate why Macs aren't targetted. This is also a really off-base assessment of the issue at center because not all hackers hack for money. In fact, most of the ones hacking for money, contrary to your implication about advertising, are in fact getting paid by means of EXTORTION.. Banks have been handing over millions of dollars every month, black mailed by hackers to keep quiet about the credit and account information stolen from them. (Bank of America comes to mind). Many hackers hack systems just because they can. For some it is a form of art to prove their own sophistication. Some do it to take revenge on their ex-employers. Others may have more terrorist ideas in mind. There are lots of reasons why there are hackers. Targetted economics as a defacto reason is an extreme oversimplification and an attempt to support the obscurity argument with blinders when in fact that argument itself obscures the deeper truth that engineering really is the core of the security issue (and ultimately therefore the management which decided to deploy that failed system of engineering). Always has been. Always will be. Dollar bills can't blow holes through cement.. Engineer a tough enough OS and no amount of hacker-for-hire employment can change the fact that it is tougher to hack.
If you still don't believe that engineering is the key issue.. do you remember OS 9 and before? Let's take a trip down memory lane! The Mac had viruses before System X came around.. it had hundreds! They weren't nearly of the class and caliber of what Windows users suffer, but they did exist. What was the only difference between OS 9 and OS X? Wasn't obscurity! It was engineering! One (System 9) was closed source 100% just like Windows. Now with that in mind, it kind of takes the air out of the sales of the "obscurity" argument now doesn't it? Obscure would be deploying some has-been like STOS, Amiga OS or BeOS.. Otherwise you are calling Unix as a whole obscure, because Mac OS is based upon unix source code. The parts that aren't (like the user interface) don't matter much because they usually have little to do with security.
There were a few reasons why Apple dropped its closed-source OS for a new OS based upon open-source BSD. One of them was security. Clearly open-source stimulates faster discovery, reporting, and patching of exploitable code problems. Open source gives any company smart enough to use it a much larger virtual engineering department to work with than any one private company would ever have the resources to employ on its own. This makes their OS more secure, and bolsters their bottom line. Open source is cheaper after-all. It makes financial sense and engineering sense to use it. Why do you think "little ol' Apple" was able to maintain a seperate source code for OS X on Intel the entire time since OS 10.0.0? Because it doesn't take as many resources when a large portion of the OS is already written for you by the open source community for nearly every processor type imaginable..
Microsoft (and its supporters) still just don't get it. Even now after the disappointing Dell Downturn and Harrowing Prediction at HP, Microsoft tries to blame its lackluster XP upgrade sales on piracy.. whatever. How about people don't want to shell out money for a half-broken product. If Microsoft had something respectable to offer the public, more people would be willing to pay for it. Perhaps they (like take a queue from Apple eh?) should worry less about piracy and more about product security and performance.. Microsoft will spend untold amounts upon engineering complicated and cumbersome validation and activation schemes that are nearly instantly hacked the second they are put out and don't deter anyone except potential customers who don't want to be bothered with such nonsense, but just isn't putting out significant effort to solve security problems with Windows.
I will lay it out like this.. the only way for Microsoft to end its security problems is to do exactly what they don't want to, and that is to rebuild Windows as a Microsoft GUI on top of a Unix base much like OS X.. Doing that they could gain respect, retain customers, improve their product, and solve the security morass they are stuck in. Nothing else they can do will ever lead to all of that.. Even if they open-sourced Windows itself, the code is probably in such a mess from segmentation between departments that most people won't even be able follow it, which is probably precisely the reason they won't open source it because they couldn't stand the public ridicule that would ensue when such dirty laundry is aired. It would be quite an event.. and even then, would anyone be able to write effective patches (other than Microsoft) for such a spaghetti mess? HMm...
kamper said:
That couldn't be farther from the truth. Wether or not it's "security through obscurity" is irrelevant. That phrase shouldn't even be used in an honest forum because it smacks of anti-Apple bias since there's nothing "obscure" about the Macintosh platform, Mac OS, or Apple... As much as Microsoft has traditionally tried to pretend that Apple is obscure, it isn't anymore obscure than the press decides it is.. Mac usership hasn't changed that much, but has remained relatively stable over the long haul now on the increase. The iPod decided for the press that Apple was nolonger "obscure". How quaint.
As you know, there are no true viruses on Mac OS X. The only purported trojan horse was a stunt by a security firm ("Integro" if memory serves) to sell Mac users their anti-malware which basically only focuses on keeping Windows viruses out of emails sent from Macs to Windows machines. That exploit was fixed within less than a month by Apple itself. Compare that to literally several new real viruses every day on Windows.. over 100,000 known viruses in the wild, do the math. Obscurity if valid couldn't even begin to account for that stark of a contrast. Truth be told: It doesn't matter if you use Internet Exploiter or FireFox, it's still Intel code under a sketchy Windows OS. Pure engineering explanation. Windows has already exploited flaws that still exist unpatched. Some things go unpatched for months, even years on Windows. Mac OS X's only known exploits aren't generally known pretty much until the patches are already released for them detailing what the exploits were.
Good engineering deploys high levels of public scrutiny to find flaws and provide feedback for corrections. Microsoft lacks this step in product development. Their code review is all inhouse, closed door. So from a purely engineering point of view, UNIX is always going to be more secure and less bug-plagued than Windows anything until Microsoft changes their closed-source practices.. Any *nix is going to be more secure than Windows because anybody (including all the independent security firms) out there can review the collective sourcecode of all the various apps that comprise the system and report flaws/potential exploits privately to the parties concerned to generate a patch before a hacker finds out about it on some website. While its true that hackers also have more access to find things too to exploit, the reality is that it rarely works this way. Usually if a hacker spots a problem for malicious exploit, by the time they see it, someone with more well-meaning intent has also found it and reported it for prompt patching. WIth Windows, only hackers will have the source code for it because genuine security firms aren't legally allowed to use copies of "stolen Windows source code". That's not a good situation at all.
Windows users must wait 100% on Redmonds to do everything for them. Redmonds has to become aware of the flaw, decide that it's worth fixing, and then handle generating the patch code 100% on their own since their OS isn't based upon open source projects at any level. Apple on the other hand may find most of its OS flaws are already corrected for them by the open source community by the time management becomes aware of the need for a patch. They simply incorporate the new versions of code into their code tree for OS X and voila, patches are in place without much effort on Apple's part. The advantage of that is obvious. The open source community and all its resources and millions of eyes and brains are a resource shut off from Redmonds.. Microsoft will shun the favor of public review while Apple welcomes it. Smart move for Apple.
Windows will never have the advantage of peer review because Redmonds forbids access to nearly everyone outside to review their source code (save for court order that is). Furthermore, they don't even let any one department examine the entire source tree for Windows (Bill Gates is ultra paranoid didn't you know), as each department manages its own segment of Win code. That way (Gates thinks) no one engineer can be paid off by an outside company to steal the source code for Windows because nobody save a priveleged few have access to all of it.. geeeez.. and people wonder why Windows still has so many security holes, bugs, and why Longhorn is taking years to complete.. It's because its like the tower of Babel over there! How is a setup like that ever going to agree on anything or effectively create a cohesive, coherent product? Please.. don't ever tell me that engineering doesn't have a primary role in this problem, because buzz words and "obscurity" side-show distractions aside, engineering still plays the major role in this disastor or there would have been at least one good success at targetting Macs by now.
Obviously advertising dollars does not dictate why Macs aren't targetted. This is also a really off-base assessment of the issue at center because not all hackers hack for money. In fact, most of the ones hacking for money, contrary to your implication about advertising, are in fact getting paid by means of EXTORTION.. Banks have been handing over millions of dollars every month, black mailed by hackers to keep quiet about the credit and account information stolen from them. (Bank of America comes to mind). Many hackers hack systems just because they can. For some it is a form of art to prove their own sophistication. Some do it to take revenge on their ex-employers. Others may have more terrorist ideas in mind. There are lots of reasons why there are hackers. Targetted economics as a defacto reason is an extreme oversimplification and an attempt to support the obscurity argument with blinders when in fact that argument itself obscures the deeper truth that engineering really is the core of the security issue (and ultimately therefore the management which decided to deploy that failed system of engineering). Always has been. Always will be. Dollar bills can't blow holes through cement.. Engineer a tough enough OS and no amount of hacker-for-hire employment can change the fact that it is tougher to hack.
If you still don't believe that engineering is the key issue.. do you remember OS 9 and before? Let's take a trip down memory lane! The Mac had viruses before System X came around.. it had hundreds! They weren't nearly of the class and caliber of what Windows users suffer, but they did exist. What was the only difference between OS 9 and OS X? Wasn't obscurity! It was engineering! One (System 9) was closed source 100% just like Windows. Now with that in mind, it kind of takes the air out of the sales of the "obscurity" argument now doesn't it? Obscure would be deploying some has-been like STOS, Amiga OS or BeOS.. Otherwise you are calling Unix as a whole obscure, because Mac OS is based upon unix source code. The parts that aren't (like the user interface) don't matter much because they usually have little to do with security.
There were a few reasons why Apple dropped its closed-source OS for a new OS based upon open-source BSD. One of them was security. Clearly open-source stimulates faster discovery, reporting, and patching of exploitable code problems. Open source gives any company smart enough to use it a much larger virtual engineering department to work with than any one private company would ever have the resources to employ on its own. This makes their OS more secure, and bolsters their bottom line. Open source is cheaper after-all. It makes financial sense and engineering sense to use it. Why do you think "little ol' Apple" was able to maintain a seperate source code for OS X on Intel the entire time since OS 10.0.0? Because it doesn't take as many resources when a large portion of the OS is already written for you by the open source community for nearly every processor type imaginable..
Microsoft (and its supporters) still just don't get it. Even now after the disappointing Dell Downturn and Harrowing Prediction at HP, Microsoft tries to blame its lackluster XP upgrade sales on piracy.. whatever. How about people don't want to shell out money for a half-broken product. If Microsoft had something respectable to offer the public, more people would be willing to pay for it. Perhaps they (like take a queue from Apple eh?) should worry less about piracy and more about product security and performance.. Microsoft will spend untold amounts upon engineering complicated and cumbersome validation and activation schemes that are nearly instantly hacked the second they are put out and don't deter anyone except potential customers who don't want to be bothered with such nonsense, but just isn't putting out significant effort to solve security problems with Windows.
I will lay it out like this.. the only way for Microsoft to end its security problems is to do exactly what they don't want to, and that is to rebuild Windows as a Microsoft GUI on top of a Unix base much like OS X.. Doing that they could gain respect, retain customers, improve their product, and solve the security morass they are stuck in. Nothing else they can do will ever lead to all of that.. Even if they open-sourced Windows itself, the code is probably in such a mess from segmentation between departments that most people won't even be able follow it, which is probably precisely the reason they won't open source it because they couldn't stand the public ridicule that would ensue when such dirty laundry is aired. It would be quite an event.. and even then, would anyone be able to write effective patches (other than Microsoft) for such a spaghetti mess? HMm...
Savage Henry
macrumors 65816
I don't normally post mere 'dittos' but after reading Xapplimatic's post I thought I'd go against the grain.dmw007 said:
Good read.
camomac
macrumors 6502a
Okay first off WOW. I mean I will usually skim REALLY long post like yours, but WOW that was an amazing explanation of the problem Microsoft truly faces with all their closed code projects.
Thank you.
However if Microsoft were to do that the whole IT industry would drop, or at least be downsized tremendously.
Thank you.
However if Microsoft were to do that the whole IT industry would drop, or at least be downsized tremendously.
emw
macrumors G4
we were impacted at the office - apparently routers were affected, along with e-mail servers, etc. Most personal computers were okay, even the PCs, but the servers somehow got infected.
We were down on and off for most of the day, so having a Mac helped in that I didn't have to install any patches, but I still couldn't get much work done.
We were down on and off for most of the day, so having a Mac helped in that I didn't have to install any patches, but I still couldn't get much work done.
Dreadnought
macrumors 68020
Ok, I've had to cut this post in half because it's too long for the forum. Please read the second half before responding...
I'll admit, I don't know the market share percentages. Please cite some real statistics if you know them. I'd honestly be surprised if it's more than 5% on the desktop. That, coupled with the fact that osx is more secure than windows, makes it nearly impossible for a hypothetical mac virus to spread randomly over the internet the way the real windows ones do. If we were talking 50/50 it'd be a very different story (albeit, still in osx's favour).
Anyways, I'm well aware of the benefits of open source vs. proprietary software. I think Apple's decision to adopt Mach and FreeBSD is one of the coolest things that has happened in the computer industry in recent memory and it's the single biggest reason I'm using a mac today. However, that's not the whole story. It's quite possible to develop secure software in a proprietary environment, microsoft just happens to be a very bad example.
Furthermore, open source is only part of apple's story. There is still the graphics system and lot's of utilities and applications that are not open source. Holes in the higher-level userland stuff are just as dangerous as what Apple gets from the *nix community. Now it would seem that Apple has done a pretty good job of this, but again, my contention is that their work hasn't been nearly as strenously challenged as Microsoft's.
The vast majority of microsoft software holes have patches available before any kind of significant exploit is actually released to the public. Besides having the holes in the first place, microsoft's biggest security challenge is simply getting users to apply the patches that are available. If you put up a decent hardware firewall (eg. NAT, and very few computers using any operating system should ever be exposed without such a firewall), apply patches when they come out and exercise common sense while browsing you will be perfectly fine. Of course, decent antivirus and antispyware are important too, but that's cure, not prevention. Yes, this is far more work than you usually have to do with os x, but my point was, it's possible.Xapplimatic said:
Why am I anti-Apple, just because I think security by obscurity is real? It's not a bad thing, and even if it was, is it against the rules to criticize Apple in any way, shape or form? Again, I'm not criticizing Apple here at all.
I'll admit, I don't know the market share percentages. Please cite some real statistics if you know them. I'd honestly be surprised if it's more than 5% on the desktop. That, coupled with the fact that osx is more secure than windows, makes it nearly impossible for a hypothetical mac virus to spread randomly over the internet the way the real windows ones do. If we were talking 50/50 it'd be a very different story (albeit, still in osx's favour).
What does Intel have to do with this? And yes, it does matter if you run IE or firefox or opera. Non-IE browsers don't have the gaping hole known as ActiveX for starters. Non-IE browsers sit at a fairly high level above the system, whereas IE is laced inextricably into windows. If you want to use numbers, compare the number of flaws in IE vs. non-IE that have actually been exploited. IE in it's current state is simply a hazard. Non-IE browsers benefit partly from better engineering and partly from obscurity.
Independant security firms can get their hands on Microsoft's code too. For a proprietary software company, they're actually not all that bad at sharing source code. More on Apple and proprietary code in a bit...
Au contraire, crackers rarely find exploits by reading source code. Unless you are actively developing or bug-fixing, reading code is mind-numbingly boring and not particular conducive to understanding. Having code in the open is not a serious benefit to crackers until after they are aware of the general location of a hole they want to exploit.
Of course engineering is the primary reason for the existence of holes. It is not necessarily the primary reason for exploits of those holes.
Anyways, I'm well aware of the benefits of open source vs. proprietary software. I think Apple's decision to adopt Mach and FreeBSD is one of the coolest things that has happened in the computer industry in recent memory and it's the single biggest reason I'm using a mac today. However, that's not the whole story. It's quite possible to develop secure software in a proprietary environment, microsoft just happens to be a very bad example.
Furthermore, open source is only part of apple's story. There is still the graphics system and lot's of utilities and applications that are not open source. Holes in the higher-level userland stuff are just as dangerous as what Apple gets from the *nix community. Now it would seem that Apple has done a pretty good job of this, but again, my contention is that their work hasn't been nearly as strenously challenged as Microsoft's.
Continued ...
And bs on the ui having little to do with security. A huge number of windows exploits are based on how IE handles webpages or how certain file formats are handled or how it's too easy for a user to allow malicious attacks to continue. Any time you have any data coming from outside the physical computer you have an opportunity for a hole. Apple and all the 3rd party vendors that supply software for os x have ample space to screw up.
I'm no fan of microsoft. I dislike many of their business practices and their attitude towards producing useful software instead of making money. I'll be as amused as the next guy if Vista falls flat on it's behind from a security perspective, but I just don't see it happening.
Anyways, after that far-too-long rant, my summary is that I don't understand why people get offended when I suggest that security by obscurity has something to do with the fact that os x isn't a big target. I'm not criticizing apple's development process and I'm not praising microsoft's. It's just that it's not a simple matter of os x being better than windows.
Links to articles please? 🙂 Anyways, how many banks do you know that run os x? How many actually run windows in vulnerable places? I'm not sure if this argument is relevant.
I never said that os x wasn't harder to crack than windows. That would be kinda silly 😛 Regardless, for all the situations that either of us have stated that a cracker might target a particular system, windows still has a much higher market share than os x. Higher market share = easier to exploit and more potential gains (whatever those gains may be). There's simply no way you can claim that these factors have no bearing on where crackers spend their time.
You have an opportunity to educate me 🙂 I know nothing about pre-osx Apple software or the existence of viruses.
No it doesn't. We're arguing about two different things here. Just because os x is more secure now than it was before, doesn't mean it doesn't benefit from obscurity. If pre-osx mac os had the market share that windows has now, perhaps it would have been exploited to a similar degree (who knows?). If os x had that market share it would, in all likelyhood, suffer much less problems but it would still be more than it has now.
Please stop calling it unix source code. Unix, as you are referring to it, is merely a set of standards with many very diverse implementations. Apple, so far as I'm aware, has only adopted significant portions of code from the bsd and gnu communities, neither of which are really unix. Calling it bsd source code or unix principles makes much more sense.
And bs on the ui having little to do with security. A huge number of windows exploits are based on how IE handles webpages or how certain file formats are handled or how it's too easy for a user to allow malicious attacks to continue. Any time you have any data coming from outside the physical computer you have an opportunity for a hole. Apple and all the 3rd party vendors that supply software for os x have ample space to screw up.
And kudos to apple for making this move.
The idea of microsoft tossing out their kernel and adopting a *nix base is silly. There are plenty of customers who respect microsoft and benefit tremendously from their products. Granted, few of them travel in *nix circles 🙂. There are also plenty of things that microsoft is doing right from a security perspective. They are adopting a virtual-machine based environment as their primary 3rd party software platform (which, afaik, apple has no plans on doing). This will have (and is having) great benefit for server applications and will benefit the desktop more as more of microsoft's software gets done in .NET. They are making it much easier for users to run as non-privileged users (which is the only really fundamental idea that they need to borrow from *nix). They are putting IE in a tight sandbox. They are adopting a more serious fundamental attitude towards security (albeit, very slowly). It's not like unix is the only possible way to implement a secure platform.
I'm no fan of microsoft. I dislike many of their business practices and their attitude towards producing useful software instead of making money. I'll be as amused as the next guy if Vista falls flat on it's behind from a security perspective, but I just don't see it happening.
Anyways, after that far-too-long rant, my summary is that I don't understand why people get offended when I suggest that security by obscurity has something to do with the fact that os x isn't a big target. I'm not criticizing apple's development process and I'm not praising microsoft's. It's just that it's not a simple matter of os x being better than windows.
