4 ms·

Yeah, I really don't understand Gruber's position on this. It seems fairly obvious and inarguable that as Macs become a bigger target, there will be more and wo

Yeah, I really don't understand Gruber's position on this. It seems fairly obvious and inarguable that as Macs become a bigger target, there will be more and worse malware on them. Is he saying that there's something inherent to Mac OS that makes malware harder? If so, what?

rimantas 15y ago
Gruber wrote more then once in the past about market share argument. It's been going on for years. And there were more viruses for Mac OS versions prior to OS X with even smaller market share. I think one advantage OS X always had compared to Win < 7 that users never had a habit to run with administrator rights all the time.
- joebadmo 15y ago
  Sure, that's one advantage, but it doesn't seem like a decisive one, really. I must have missed his arguments re market share. I've only ever seen him post the historically periodic articles about how people have always been saying it's about to happen. What are his actual arguments? If anything, I feel like Mac OS X will potentially be more vulnerable. To make the anatomical analogy, Windows has always had a lot of exposure to malware, and as a result there's a fairly robust anti-malware ecosystem, like anti-bodies in an immune system. OS X, on the other hand, hasn't. It's evolved in the absence of many attacks, and has a proportionally weaker immune system. Ok, I'm not sure I buy that completely, but the market share argument seems like a straightforward one.
  - wtallis 15y ago
    Most iterations of the "market share argument" I've seen imply that at some time in the future, Mac market share will reach a tipping point and writing viruses for OS X will be lucrative enough that there will be a dramatic increase in the amount of malware being flung at Macs. It has the same problem that plagues every other apocalyptic argument: the world keeps not ending. Nobody ever says how much market share OS X needs to reach this tipping point, which makes it pretty hard to falsify. Meanwhile, the Mac market share keeps growing, year after year, with only minor increases in the prevalence of malware, and no major botnets or worms of the sort that were rampant on Win9x and early XP. Claiming that OS X is (or will be) a soft target also serves to further undermine the market share argument: Windows has been getting more secure over time, which should help make OS X a more attractive target if it really is a softer target than Windows.
    - joebadmo 15y ago
      You're totally right, that market share argument is often vague and probably unfalsifiable, but there's at least a clear logic to it. "It hasn't happened yet," on the other hand, is not an argument at all. An analysis charting data of total malware vs. market share would be more interesting, but an argument for why it hasn't happened yet, and will continue not to would be the most interesting to me. I'm not sure I follow your last point.
      - bediger 15y ago
        I don't know that the "market share" argument is unfalsifyable. The Witty Worm of 2004 (http://en.wikipedia.org/wiki/Witty_(computer_worm) http://en.wikipedia.org/wiki/Witty_(computer_worm)) attacked a particular vendor's firewall implementation. It seems to have infected every one of the 12,000 members of the susceptible population. That's a pretty small market share, even in the firewall market, even in 2004. The Witty Worm seems like a good counter-example of the "market share" argument. As for full disclosure, I personally regard the "market share" argument as a form of the Special Pleading logical fallacy.
        wtallis 15y ago
        The Witty Worm could be explained by those firewalls being considered far more valuable or vulnerable targets than desktop PCs. The market share argument typically assumes that those factors are roughly the same for Macs and Windows machines, and that the only significant difference (or at least, the dominant factor) is the size of the target population.
      - wtallis 15y ago
        The market share argument implicitly rejects the idea that OS X is significantly more secure than Windows, by saying that when OS X gets more popular, the amount of malware for OS X will catch up and be more comparable to the amount of Windows malware. It postulates that there must be some threshold level of market share that Macs must exceed before this happens. The current fact that Mac malware is still rare puts a lower bound on that threshold. Whatever that number is, it is larger than the current Mac market share. It is also safe to assume that 50% is an upper bound on that threshold. If you assume that OS X is not only as insecure as Windows, but significantly less secure than Windows, then the threshold should be lower, because fewer Macs should be needed to reach the same level of successful attacks. If an attack on Windows is twice as hard as an attack on OS X, then OS X should only need 33% market share in order to reach malware-volume parity. Every advance in Windows security that is not matched by Apple, and every increase in Mac market share, narrows the conditions under which the market share argument can be considered true, and narrows the range of predictions that can be made in accordance with that theory. While there is not enough evidence to totally reject the market share argument, we do not have the crucial evidence necessary to prove it true, and all the evidence that has been accumulating over the past decade counts against it.
  - Steko 15y ago
    "What are his actual arguments?" Here's one: http://daringfireball.net/2004/06/broken_windows http://daringfireball.net/2004/06/broken_windows Mac community has no tolerance. Here's another: http://daringfireball.net/2006/11/jackass_larry_seltzer http://daringfireball.net/2006/11/jackass_larry_seltzer Fundamentally more secure. Overall I just think he has more confidence in Apple's drive to deliver ease of use consumer experiences. As he recently recently hinted: "So, for the sake of argument, let’s take it as a given that this sort of thing is becoming more common. What can Apple do? Think about it. (My guess: think about why the iPhone and iPad, despite being far more popular than the Mac, have no trojan horses.)" Obviously he's thinking that Apple could, if security becomes an issue, offer clueless users a mode where app execution is limited to signed Mac App Store installs or something.
    - joebadmo 15y ago
      Thanks, that's what I was looking for. I guess I haven't really been following Gruber long enough to have been exposed to those arguments, and he doesn't really seem to have linked back to them (they are pretty old). That said, I'm not sure I follow his arguments. The first one seems to be that the Mac community is less tolerant of malware/crapware. But as the market expands, especially to former Windows users, doesn't this become less true by definition? It's an explanation for why there hasn't been much malware on Macs, but not really one for why there couldn't or won't be. The second was isn't an argument so much as an assertion. Though this might be a case again of me not being familiar enough with his writing historically and his audience. Maybe he's speaking from the assumption that his audience understands technical details about Mac OS architecture/design that makes this true? You're right, though, it does indeed seem like Mac App Store exclusivity is where Apple is headed. And that does seem likely to make the OS fundamentally more secure than others, mostly reducing potential exploits to third party app/web.
      - Steko 15y ago
        I think historically it WAS more secure. See Pogue's write up from 2003: http://www.nytimes.com/2003/09/18/technology/circuits/18POGUE-EMAIL.html?ex=1214280000&en=1efe03e6ab949440&ei=5070 http://www.nytimes.com/2003/09/18/technology/circuits/18POGU... As time has gone on MS has made strides in the default shipping copies of Windows. SP3, Vista, WP7. I'm not sure if they're better the same or worse today compared to OSX (or linux) but I'd agree historically Windows was a total mess -- we'd have entire days of downtime to viruses as they took over the company. haven't seen one of those in years though.
Anechoic 15y ago
Is he saying that there's something inherent to Mac OS that makes malware harder? No, he's saying that everytime there is a virus/trojan/rootkit/malware found in the wild that targets MacOS X there is a chorus of articles in the tech media essentially proclaiming that the end is nigh for safe computing on the Mac. There is malware/etc that targets Macs. There will always be malware that targets Mac. I doubt Gruber doesn't believe this. However the existence of particular piece of malicious software is not the same as a widespread practice that will bring down the platform as is seemingly presumed by the various tech articles that talk about Mac malware.
- joebadmo 15y ago
  I agree that one instance of malware doesn't necessarily mean anything, but growing market share does. And what the ars article points out that's really pernicious is Apple's response to the issue, which is not a good sign for how they might deal with the growth of malware as a reaction to growing market share. Especially in light of Apple's marketing re security of Mac OS. And Gruber doesn't seem to be making an argument in this post. He agrees with the reporting but quibbles with a tertiary, almost irrelevant graph.

rimantas 15y ago

Gruber wrote more then once in the past about market share argument. It's been going on for years. And there were more viruses for Mac OS versions prior to OS X with even smaller market share. I think one advantage OS X always had compared to Win < 7 that users never had a habit to run with administrator rights all the time.

joebadmo 15y ago
Sure, that's one advantage, but it doesn't seem like a decisive one, really. I must have missed his arguments re market share. I've only ever seen him post the historically periodic articles about how people have always been saying it's about to happen. What are his actual arguments? If anything, I feel like Mac OS X will potentially be more vulnerable. To make the anatomical analogy, Windows has always had a lot of exposure to malware, and as a result there's a fairly robust anti-malware ecosystem, like anti-bodies in an immune system. OS X, on the other hand, hasn't. It's evolved in the absence of many attacks, and has a proportionally weaker immune system. Ok, I'm not sure I buy that completely, but the market share argument seems like a straightforward one.
- wtallis 15y ago
  Most iterations of the "market share argument" I've seen imply that at some time in the future, Mac market share will reach a tipping point and writing viruses for OS X will be lucrative enough that there will be a dramatic increase in the amount of malware being flung at Macs. It has the same problem that plagues every other apocalyptic argument: the world keeps not ending. Nobody ever says how much market share OS X needs to reach this tipping point, which makes it pretty hard to falsify. Meanwhile, the Mac market share keeps growing, year after year, with only minor increases in the prevalence of malware, and no major botnets or worms of the sort that were rampant on Win9x and early XP. Claiming that OS X is (or will be) a soft target also serves to further undermine the market share argument: Windows has been getting more secure over time, which should help make OS X a more attractive target if it really is a softer target than Windows.
  - joebadmo 15y ago
    You're totally right, that market share argument is often vague and probably unfalsifiable, but there's at least a clear logic to it. "It hasn't happened yet," on the other hand, is not an argument at all. An analysis charting data of total malware vs. market share would be more interesting, but an argument for why it hasn't happened yet, and will continue not to would be the most interesting to me. I'm not sure I follow your last point.
    - bediger 15y ago
      I don't know that the "market share" argument is unfalsifyable. The Witty Worm of 2004 (http://en.wikipedia.org/wiki/Witty_(computer_worm) http://en.wikipedia.org/wiki/Witty_(computer_worm)) attacked a particular vendor's firewall implementation. It seems to have infected every one of the 12,000 members of the susceptible population. That's a pretty small market share, even in the firewall market, even in 2004. The Witty Worm seems like a good counter-example of the "market share" argument. As for full disclosure, I personally regard the "market share" argument as a form of the Special Pleading logical fallacy.
      - wtallis 15y ago
        The Witty Worm could be explained by those firewalls being considered far more valuable or vulnerable targets than desktop PCs. The market share argument typically assumes that those factors are roughly the same for Macs and Windows machines, and that the only significant difference (or at least, the dominant factor) is the size of the target population.
    - wtallis 15y ago
      The market share argument implicitly rejects the idea that OS X is significantly more secure than Windows, by saying that when OS X gets more popular, the amount of malware for OS X will catch up and be more comparable to the amount of Windows malware. It postulates that there must be some threshold level of market share that Macs must exceed before this happens. The current fact that Mac malware is still rare puts a lower bound on that threshold. Whatever that number is, it is larger than the current Mac market share. It is also safe to assume that 50% is an upper bound on that threshold. If you assume that OS X is not only as insecure as Windows, but significantly less secure than Windows, then the threshold should be lower, because fewer Macs should be needed to reach the same level of successful attacks. If an attack on Windows is twice as hard as an attack on OS X, then OS X should only need 33% market share in order to reach malware-volume parity. Every advance in Windows security that is not matched by Apple, and every increase in Mac market share, narrows the conditions under which the market share argument can be considered true, and narrows the range of predictions that can be made in accordance with that theory. While there is not enough evidence to totally reject the market share argument, we do not have the crucial evidence necessary to prove it true, and all the evidence that has been accumulating over the past decade counts against it.
- Steko 15y ago
  "What are his actual arguments?" Here's one: http://daringfireball.net/2004/06/broken_windows http://daringfireball.net/2004/06/broken_windows Mac community has no tolerance. Here's another: http://daringfireball.net/2006/11/jackass_larry_seltzer http://daringfireball.net/2006/11/jackass_larry_seltzer Fundamentally more secure. Overall I just think he has more confidence in Apple's drive to deliver ease of use consumer experiences. As he recently recently hinted: "So, for the sake of argument, let’s take it as a given that this sort of thing is becoming more common. What can Apple do? Think about it. (My guess: think about why the iPhone and iPad, despite being far more popular than the Mac, have no trojan horses.)" Obviously he's thinking that Apple could, if security becomes an issue, offer clueless users a mode where app execution is limited to signed Mac App Store installs or something.
  - joebadmo 15y ago
    Thanks, that's what I was looking for. I guess I haven't really been following Gruber long enough to have been exposed to those arguments, and he doesn't really seem to have linked back to them (they are pretty old). That said, I'm not sure I follow his arguments. The first one seems to be that the Mac community is less tolerant of malware/crapware. But as the market expands, especially to former Windows users, doesn't this become less true by definition? It's an explanation for why there hasn't been much malware on Macs, but not really one for why there couldn't or won't be. The second was isn't an argument so much as an assertion. Though this might be a case again of me not being familiar enough with his writing historically and his audience. Maybe he's speaking from the assumption that his audience understands technical details about Mac OS architecture/design that makes this true? You're right, though, it does indeed seem like Mac App Store exclusivity is where Apple is headed. And that does seem likely to make the OS fundamentally more secure than others, mostly reducing potential exploits to third party app/web.
    - Steko 15y ago
      I think historically it WAS more secure. See Pogue's write up from 2003: http://www.nytimes.com/2003/09/18/technology/circuits/18POGUE-EMAIL.html?ex=1214280000&en=1efe03e6ab949440&ei=5070 http://www.nytimes.com/2003/09/18/technology/circuits/18POGU... As time has gone on MS has made strides in the default shipping copies of Windows. SP3, Vista, WP7. I'm not sure if they're better the same or worse today compared to OSX (or linux) but I'd agree historically Windows was a total mess -- we'd have entire days of downtime to viruses as they took over the company. haven't seen one of those in years though.

Anechoic 15y ago

Is he saying that there's something inherent to Mac OS that makes malware harder? No, he's saying that everytime there is a virus/trojan/rootkit/malware found in the wild that targets MacOS X there is a chorus of articles in the tech media essentially proclaiming that the end is nigh for safe computing on the Mac. There is malware/etc that targets Macs. There will always be malware that targets Mac. I doubt Gruber doesn't believe this. However the existence of particular piece of malicious software is not the same as a widespread practice that will bring down the platform as is seemingly presumed by the various tech articles that talk about Mac malware.

joebadmo 15y ago
I agree that one instance of malware doesn't necessarily mean anything, but growing market share does. And what the ars article points out that's really pernicious is Apple's response to the issue, which is not a good sign for how they might deal with the growth of malware as a reaction to growing market share. Especially in light of Apple's marketing re security of Mac OS. And Gruber doesn't seem to be making an argument in this post. He agrees with the reporting but quibbles with a tertiary, almost irrelevant graph.