4 ms·

Yeah I have Basilisk II running MacOS 8.1 that a friend of mine had to recompile because the libraries they used for it are out of date. It has IE 4.0 but the c

Yeah I have Basilisk II running MacOS 8.1 that a friend of mine had to recompile because the libraries they used for it are out of date. It has IE 4.0 but the certificates have expired so it won't load most websites. Nobody seems to be targeting the older PowerMacs for Web Browsers and other Internet apps. I used to use it for safe web browsing because Windows viruses don't infect it and the web browser is so old it won't run the new stuff for the latest version of IE.

Karunamon 10y ago
This is kind of a harebrained theory of mine that I'm not sure it's possible to test: are you more safe on very, very obsolete platforms because the chances of stumbling onto malware that'll target you is almost nonexistent? If so, there's an argument for doing your day to day web browsing in SheepShaver running Classilla.. if not for the dealbreaking lack of support for any security better than SSLv3 (hopelessly broken).
- sliverstorm 10y ago
  I think fringe is probably more important than obsolete (though both together could be powerful). The problem being, obsolete software is trivial by modern standards to exploit, so it seems it would be like wandering a minefield. Stumble on some dusty old exploit, and it's over.
- icebraining 10y ago
  Just like there are clients running old code, there are old viruses around. I doubt it is safer than running up-to-date software, though it might be safer than being just a couple of versions behind.
- amyjess 10y ago
  I remember hearing that, at one point, there were some secure government sites that ran everything on classic Mac OS because it was one of the only operating systems that had no CLI and as such weren't vulnerable to someone getting console access and going to town. Never verified that story, though.
  - protomyth 10y ago
    I'm not sure if its the same story but the US Army once used Mac OS for some of its web servers because they were judged the most secure. I cannot remember what third party web server they were using.
    - orionblastar 10y ago
      I used to work as a federal contractor in 1996-1997. The Army did switch to MacOS for web servers. I'm not sure what Mac web server they used. They tried Windows that got hacked, and they ran Linux but didn't always update it and it got hacked as well. I think they ran some stuff as Root in Linux. The MacOS security model was different from Linux or Windows and supposed to be more secure. Of course social engineering meant that people can call their help desk and pretend to be someone working on the server to get the password reset. No security software is going to stop a social engineering attack. Also after people get their password reset they forget to change it and leave it "password" and other easy to remember passwords. So weak passwords mean someone can get in without using an exploit but a password dictionary attack.
      - protomyth 10y ago
        And here's the article https://tidbits.com/article/5552 https://tidbits.com/article/5552 "The compelling aspect of this story is that as a result of the break-in, the U.S. Army has switched the machines that serve the Army's home page from Windows NT-based PCs to Power Macintosh G3s running WebSTAR from StarNine Technologies." [edit:] I do love the speculation at the end on if Mac OS X Server will be as good security-wise as Mac OS.
- davb 10y ago
  That's probably true to some extent. The security of these older systems also undoubtedly benefits from the much smaller attack surface. They typically have far fewer services (network or otherwise) and simpler interfaces between components. If known vulnerabilities were patched, I can see how it would be easy to trust a simpler, legacy platform over a modern platform. Very few experienced professionals I've worked with (myself included) posses a working knowledge of a modern OS's services and persistent processes - that's a lot of trust to place in the platform. There's something to be said for the time when you could have an inside out understanding an OS, its libraries and its binaries. I thought vanilla Android was overly complex, but one look at the running processes on a Samsung S7 and I was horrified. The same can be said of OSX or a recent mainstream Linux distribution. I'd happily take a less flexible but much simpler OS over what we have now. Removing all those layers of services and indirection might increase short term development costs, but I think it would be worth it. Modern computing has me feeling more and more like a grump old man. I'm only 30.
- yuhong 10y ago
  Classilla do better than SSLv3 these days. It even supports SHA2 certificates now.
- ikeboy 10y ago
  You're less likely to pick up a widely targeted virus, and more likely to be pwned if anyone attempts to target you personally.
- guardiangod 10y ago
  If you want to run obsolete platforms with built in modern security protections, why don't you just use OpenBSD? /rimshot I love you OpenBSD

Karunamon 10y ago

This is kind of a harebrained theory of mine that I'm not sure it's possible to test: are you more safe on very, very obsolete platforms because the chances of stumbling onto malware that'll target you is almost nonexistent? If so, there's an argument for doing your day to day web browsing in SheepShaver running Classilla.. if not for the dealbreaking lack of support for any security better than SSLv3 (hopelessly broken).

sliverstorm 10y ago
I think fringe is probably more important than obsolete (though both together could be powerful). The problem being, obsolete software is trivial by modern standards to exploit, so it seems it would be like wandering a minefield. Stumble on some dusty old exploit, and it's over.
icebraining 10y ago
Just like there are clients running old code, there are old viruses around. I doubt it is safer than running up-to-date software, though it might be safer than being just a couple of versions behind.
amyjess 10y ago
I remember hearing that, at one point, there were some secure government sites that ran everything on classic Mac OS because it was one of the only operating systems that had no CLI and as such weren't vulnerable to someone getting console access and going to town. Never verified that story, though.
- protomyth 10y ago
  I'm not sure if its the same story but the US Army once used Mac OS for some of its web servers because they were judged the most secure. I cannot remember what third party web server they were using.
  - orionblastar 10y ago
    I used to work as a federal contractor in 1996-1997. The Army did switch to MacOS for web servers. I'm not sure what Mac web server they used. They tried Windows that got hacked, and they ran Linux but didn't always update it and it got hacked as well. I think they ran some stuff as Root in Linux. The MacOS security model was different from Linux or Windows and supposed to be more secure. Of course social engineering meant that people can call their help desk and pretend to be someone working on the server to get the password reset. No security software is going to stop a social engineering attack. Also after people get their password reset they forget to change it and leave it "password" and other easy to remember passwords. So weak passwords mean someone can get in without using an exploit but a password dictionary attack.
    - protomyth 10y ago
      And here's the article https://tidbits.com/article/5552 https://tidbits.com/article/5552 "The compelling aspect of this story is that as a result of the break-in, the U.S. Army has switched the machines that serve the Army's home page from Windows NT-based PCs to Power Macintosh G3s running WebSTAR from StarNine Technologies." [edit:] I do love the speculation at the end on if Mac OS X Server will be as good security-wise as Mac OS.
davb 10y ago
That's probably true to some extent. The security of these older systems also undoubtedly benefits from the much smaller attack surface. They typically have far fewer services (network or otherwise) and simpler interfaces between components. If known vulnerabilities were patched, I can see how it would be easy to trust a simpler, legacy platform over a modern platform. Very few experienced professionals I've worked with (myself included) posses a working knowledge of a modern OS's services and persistent processes - that's a lot of trust to place in the platform. There's something to be said for the time when you could have an inside out understanding an OS, its libraries and its binaries. I thought vanilla Android was overly complex, but one look at the running processes on a Samsung S7 and I was horrified. The same can be said of OSX or a recent mainstream Linux distribution. I'd happily take a less flexible but much simpler OS over what we have now. Removing all those layers of services and indirection might increase short term development costs, but I think it would be worth it. Modern computing has me feeling more and more like a grump old man. I'm only 30.
yuhong 10y ago
Classilla do better than SSLv3 these days. It even supports SHA2 certificates now.
ikeboy 10y ago
You're less likely to pick up a widely targeted virus, and more likely to be pwned if anyone attempts to target you personally.
guardiangod 10y ago
If you want to run obsolete platforms with built in modern security protections, why don't you just use OpenBSD? /rimshot I love you OpenBSD