4 ms·

Citation? I haven't seen anything near the equivalent of Windows flaws on OS X. How many remotely exploitable OS X vulnerabilities have there been in the last

Citation? I haven't seen anything near the equivalent of Windows flaws on OS X. How many remotely exploitable OS X vulnerabilities have there been in the last 2 years?

ori_b 16y ago
http://www.computerworld.com/s/article/9129978/Researcher_cracks_Mac_in_10_seconds_at_PWN2OWN_wins_5k http://www.computerworld.com/s/article/9129978/Researcher_cr... Mac isn't significantly more secure. In fact, after all the bad press, Microsoft has invested significant amounts of money on intrusion mitigation systems like address space randomization, non-executable stacks, and so on. Linux is playing catch up to Windows in some regards there, and from what I know about OSX, it's also far behind in intrusion mitigation techniques. (edit: here's a blog post that covers some of them: http://blogs.msdn.com/b/michael_howard/archive/2006/05/26/address-space-layout-randomization-in-windows-vista.aspx http://blogs.msdn.com/b/michael_howard/archive/2006/05/26/ad...) There are perfectly good reasons for switching to OSX (like, for example, the fact that the interface isn't a pain to use, and the command line doesn't suck, although I still favor Linux with a good tiling WM), but I don't think security is a valid one.
- andreyf 16y ago
  Uh, citation, please? You liked to an article that says "there once existed a vulnerability in Safari" and then right away claimed that Linux and OSX are "still catching up to" Windows in terms of security. Now, I want to believe you, but it sounds to me like you're speaking with a little too much conviction relative to the evidence you're presenting.
  - sp332 16y ago
    I'm not sure of the overall security level of Linux & Windows, but Linux ASLR is weak: http://jbrownsec.blogspot.com/2009/07/beating-linux-aslr.html http://jbrownsec.blogspot.com/2009/07/beating-linux-aslr.htm...
  - ori_b 16y ago
    One citation, describing flaws in the current implementations. http://web.archive.org/web/20080111062141/http://www.matasano.com/log/986/what-weve-since-learned-about-leopard-security-features/ http://web.archive.org/web/20080111062141/http://www.matasan... Another (fairly poorly written) article about it: http://www.tomshardware.com/news/hack-windows-security-snow-leopard,8704.html http://www.tomshardware.com/news/hack-windows-security-snow-... I'm sure you can find more if you dig around. Also, non-executable stack has been supported OSX since it was shipped, but non-executable heap is new. I believe (I'm not sure) that non-executable stack is also disabled fairly often because of trampolines in GCC. Security in OSX isn't broken, of course, but the mitigation measures are strongest in Windows, out of the mainstream OSes these days.
- thaumaturgy 16y ago
  You shouldn't've been downvoted; you're absolutely right. MacOS -- and I say this as a long-time user, since the System 6 days, and as an OS atheist -- only seems to have a better security track record in the minds of users because it hasn't been targeted anywhere near as much as Windows has. As far as Google is concerned, they may just be banking on security-through-obscurity. Use a system that the bad guys aren't familiar with exploiting, and you're less likely to be exploited.
- yason 16y ago
  The core difference between Unix and Windows, that has persisted since the beginning, is that by default on any Unix you get a user account which is different from the root account. On Windows, this hasn't even been possible until a few years ago (Vista? 7?), and AFAIK you still have to specifically configure Windows to give you a user account that really, really has no administrator rights. My parents wouldn't know how to do that. On Linux, if someone hacks my browser all I could ever lose is the stuff on my home directory. Should that happen, I can just log in as root, kill all processes of my user account, rm -rf the home directory and restore the most recent backup, and relogin with my account. Without rebooting. There are local vulnerabilities that might give you root privileges on Linux, too. But that's already a secondary attack and one of its own. Given the diversity of various Linux builds, it takes a lot more to crack into a machine and if successful, even that one is only one kind of a machine. With Windows, the homogeneity sweeps large installation bases at once.
  - pedrocr 16y ago
    On Linux, if someone hacks my browser all I could ever lose is the stuff on my home directory. Of course these tend to be precisely the only things you actually care about in the whole system. Assuming it's a desktop machine of course.
    - steveklabnik 16y ago
      Which is why he talked about backups, and why they're important. This doesn't mean your backup couldn't get infected...
    - yason 16y ago
      I have backups for my files anyway. Everyone should. It's the long, painful reinstallation process that I would have to do on a typical Windows machine to fully restore the pristine installation state after a virus/malware attack.
  - tptacek 16y ago
    This argument is a load of baloney. Desktop machines, whether Linux, Mac, or Windows, are single-user machines. Attackers don't want "root". They want your documents and they want access to your network, both of which they get just peachy with your user account. The only thing you can do with root that you can't do with a user account is write vanity malware that persists in ways that are harder to detect. But the most effective malware isn't written as a vanity exercise. In Google's case, it's even less important to have root; what Google is protecting is access to their corporate network.

Citation? I haven't seen anything near the equivalent of Windows flaws on OS X. How many remotely exploitable OS X vulnerabilities have there been in the last 2 years?

ori_b 16y ago

http://www.computerworld.com/s/article/9129978/Researcher_cracks_Mac_in_10_seconds_at_PWN2OWN_wins_5k http://www.computerworld.com/s/article/9129978/Researcher_cr... Mac isn't significantly more secure. In fact, after all the bad press, Microsoft has invested significant amounts of money on intrusion mitigation systems like address space randomization, non-executable stacks, and so on. Linux is playing catch up to Windows in some regards there, and from what I know about OSX, it's also far behind in intrusion mitigation techniques. (edit: here's a blog post that covers some of them: http://blogs.msdn.com/b/michael_howard/archive/2006/05/26/address-space-layout-randomization-in-windows-vista.aspx http://blogs.msdn.com/b/michael_howard/archive/2006/05/26/ad...) There are perfectly good reasons for switching to OSX (like, for example, the fact that the interface isn't a pain to use, and the command line doesn't suck, although I still favor Linux with a good tiling WM), but I don't think security is a valid one.

andreyf 16y ago
Uh, citation, please? You liked to an article that says "there once existed a vulnerability in Safari" and then right away claimed that Linux and OSX are "still catching up to" Windows in terms of security. Now, I want to believe you, but it sounds to me like you're speaking with a little too much conviction relative to the evidence you're presenting.
- sp332 16y ago
  I'm not sure of the overall security level of Linux & Windows, but Linux ASLR is weak: http://jbrownsec.blogspot.com/2009/07/beating-linux-aslr.html http://jbrownsec.blogspot.com/2009/07/beating-linux-aslr.htm...
- ori_b 16y ago
  One citation, describing flaws in the current implementations. http://web.archive.org/web/20080111062141/http://www.matasano.com/log/986/what-weve-since-learned-about-leopard-security-features/ http://web.archive.org/web/20080111062141/http://www.matasan... Another (fairly poorly written) article about it: http://www.tomshardware.com/news/hack-windows-security-snow-leopard,8704.html http://www.tomshardware.com/news/hack-windows-security-snow-... I'm sure you can find more if you dig around. Also, non-executable stack has been supported OSX since it was shipped, but non-executable heap is new. I believe (I'm not sure) that non-executable stack is also disabled fairly often because of trampolines in GCC. Security in OSX isn't broken, of course, but the mitigation measures are strongest in Windows, out of the mainstream OSes these days.
thaumaturgy 16y ago
You shouldn't've been downvoted; you're absolutely right. MacOS -- and I say this as a long-time user, since the System 6 days, and as an OS atheist -- only seems to have a better security track record in the minds of users because it hasn't been targeted anywhere near as much as Windows has. As far as Google is concerned, they may just be banking on security-through-obscurity. Use a system that the bad guys aren't familiar with exploiting, and you're less likely to be exploited.
yason 16y ago
The core difference between Unix and Windows, that has persisted since the beginning, is that by default on any Unix you get a user account which is different from the root account. On Windows, this hasn't even been possible until a few years ago (Vista? 7?), and AFAIK you still have to specifically configure Windows to give you a user account that really, really has no administrator rights. My parents wouldn't know how to do that. On Linux, if someone hacks my browser all I could ever lose is the stuff on my home directory. Should that happen, I can just log in as root, kill all processes of my user account, rm -rf the home directory and restore the most recent backup, and relogin with my account. Without rebooting. There are local vulnerabilities that might give you root privileges on Linux, too. But that's already a secondary attack and one of its own. Given the diversity of various Linux builds, it takes a lot more to crack into a machine and if successful, even that one is only one kind of a machine. With Windows, the homogeneity sweeps large installation bases at once.
- pedrocr 16y ago
  On Linux, if someone hacks my browser all I could ever lose is the stuff on my home directory. Of course these tend to be precisely the only things you actually care about in the whole system. Assuming it's a desktop machine of course.
  - steveklabnik 16y ago
    Which is why he talked about backups, and why they're important. This doesn't mean your backup couldn't get infected...
  - yason 16y ago
    I have backups for my files anyway. Everyone should. It's the long, painful reinstallation process that I would have to do on a typical Windows machine to fully restore the pristine installation state after a virus/malware attack.
- tptacek 16y ago
  This argument is a load of baloney. Desktop machines, whether Linux, Mac, or Windows, are single-user machines. Attackers don't want "root". They want your documents and they want access to your network, both of which they get just peachy with your user account. The only thing you can do with root that you can't do with a user account is write vanity malware that persists in ways that are harder to detect. But the most effective malware isn't written as a vanity exercise. In Google's case, it's even less important to have root; what Google is protecting is access to their corporate network.