3 ms·

Well, what is true is that it's extremely hard to execute arbitrary code without user knowledge on a Mac. Windows has thousands upon thousands of arbitrary code

Well, what is true is that it's extremely hard to execute arbitrary code without user knowledge on a Mac. Windows has thousands upon thousands of arbitrary code execution bugs where simply opening something like a pdf can allow an attacker to run arbitrary code as a privileged user. There are many defense mechanisms to this that are inherent to the design and implementation of Darwin/Mac OS.

munin 9y ago
> There are many defense mechanisms to this that are inherent to the design and implementation of Darwin/Mac OS. Do you have an example? Beyond the idea of user/root separation, which doesn't really do much for modern single user computers: https://xkcd.com/1200/ https://xkcd.com/1200/
- pdeuchler 9y ago
  Kinda unfair to not let me use the biggest example (DAC/user separation) just because there might be sensitive data with user permissions when we're talking about arbitrary code execution. Even still, such a concept makes privilege execution orders of magnitude harder on * nix systems. POSIX philosophy also prevents the "keys to the kingdom" kind of exploits you can get in windows, many linux exploits are much harder to chain together simply due to this. The * nix networking stack has always been much more mature and robust than the windows stack, although I'll admit that's not necessarily inherent to the design.
  - pjmlp 9y ago
    Virus were invented on UNIX.
- kenferry 9y ago
  Sandboxing. All third party apps in the Mac app store, and many system apps. Safari, Mail, Messages, FaceTime, Calendar, Contacts, Photos, Notes, and Reminders are all sandboxed. I also really like how Gatekeeper ( https://en.wikipedia.org/wiki/Gatekeeper_(macOS) https://en.wikipedia.org/wiki/Gatekeeper_(macOS) ) works – it quarantines documents such as word files, so that on first open you get a dialog pointing out that it's been downloaded. This is great, because you see the dialog very infrequently. I actually pay attention to it when it comes up.
  - munin 9y ago
    Windows also does sandboxing.
dingo_bat 9y ago
I don't think that's been true since windows 7. Almost all new viruses rely on user stupidity.

munin 9y ago

> There are many defense mechanisms to this that are inherent to the design and implementation of Darwin/Mac OS. Do you have an example? Beyond the idea of user/root separation, which doesn't really do much for modern single user computers: https://xkcd.com/1200/ https://xkcd.com/1200/

pdeuchler 9y ago
Kinda unfair to not let me use the biggest example (DAC/user separation) just because there might be sensitive data with user permissions when we're talking about arbitrary code execution. Even still, such a concept makes privilege execution orders of magnitude harder on * nix systems. POSIX philosophy also prevents the "keys to the kingdom" kind of exploits you can get in windows, many linux exploits are much harder to chain together simply due to this. The * nix networking stack has always been much more mature and robust than the windows stack, although I'll admit that's not necessarily inherent to the design.
- pjmlp 9y ago
  Virus were invented on UNIX.
kenferry 9y ago
Sandboxing. All third party apps in the Mac app store, and many system apps. Safari, Mail, Messages, FaceTime, Calendar, Contacts, Photos, Notes, and Reminders are all sandboxed. I also really like how Gatekeeper ( https://en.wikipedia.org/wiki/Gatekeeper_(macOS) https://en.wikipedia.org/wiki/Gatekeeper_(macOS) ) works – it quarantines documents such as word files, so that on first open you get a dialog pointing out that it's been downloaded. This is great, because you see the dialog very infrequently. I actually pay attention to it when it comes up.
- munin 9y ago
  Windows also does sandboxing.

dingo_bat 9y ago

I don't think that's been true since windows 7. Almost all new viruses rely on user stupidity.