I must be a masochist...
This post has been painful to read, and I've been sitting here debating whether or not it's worth replying, as I'd basically be contributing to what I'm complaining about, and I'm incapable of being succinct.
But it's Friday, and who doesn't like a good internet argument on a Friday
First off, to those claiming that Charlie is an attention-whore, or trying to get a job at Apple:
Charlie is a huge fan of OS X. He's had to state this in pretty much every interview, because people seem to think that by pointing out security vulnerabilities with the Mac, that means he doesn't like it. He uses OS X, he likes OS X. He wrote a book about hacking OS X (with another security researcher) that's a really good read. It's not about poking fun at OS X, it's about wanting the system that you yourself use to be more secure.
Charlie makes his living (like many of us) as a security professional. We get paid to either break into companies or try and break products. As far as security professional's go, he's a very well-regarded one. He's not a fourteen year old kid in a basement writing irc-bots.
There is near-unanimous agreement in the security community (as unanimous as we ever get) that Apple's security posture is near the bottom of all vendors. That includes companies like Microsoft, and Cisco, and Adobe. This is based on years of working with them to get them to patch vulnerabilities. They are categorically the last to release patches when a vulnerability has been discovered, and their whole "veil of secrecy" that people here discuss ad naseum carries over into even this area. Things are promising, however, as they just hired someone to work in this capacity (someone most of us have a lot of respect for and consider to be a great hire). Time will tell if they get better about handling vulnerabilities.
The thing is, Microsoft (who historically was the punchline to any joke about vulnerability management), has been doing things right for about the past five years. This doesn't excuse the way they acted before that, and it doesn't mean that now Windows is magically vulnerability-free (although both Vista and 7 have been a marked improvement from XP), but they've gotten significantly better about handling vulnerabilities (and are now leaps and bounds better than Apple is).
The thing is though, Microsoft had to do this, as they represent a huge portion of installed systems, and are the biggest target. They were getting beaten up about their security (rightfully so) and it was to the point that it actually effected business.
The same is not true about Apple. The reality, is that they can be as bad as they are about security management because they don't yet have a reason not to be. We in the security community are all about security for the sake of security (it's a philosophical tenant), but that's not pragmatic. Companies only care about security if it effects their business (and I don't necessarily think that's a bad thing), and for Apple, it doesn't.
People keep talking about viruses on here, and to be honest, we haven't cared about viruses for almost ten years. Viruses eat up CPU cycles, and generate network traffic and are easy to detect in an environment that has even basic security monitoring.
Everything comes back to money. Viruses don't cost money anymore (not of the magnitude that we worry about). What does cost money is malware that hijacks online banking credentials, or grabs ssn's, or online gaming accounts, or acts as a way for an attacker to obtain sensitive corporate information. This past year the amount of money stolen from banks electronically was about 10 times the amount taken in actual physical robberies.
And attackers don't care how they obtain this information. We don't care about owning a box for the sake of owning it, we don't care about stealing passwords from a user unless that is a means to obtain what we're actually after. Honestly, we're after the money, and we'll spend large amounts of our own time and money if it means we can get more of it.
If that means developing exploits for OS X, then that's what we do. If it means just getting a user to visit a website, then we do that.
