5 ms·

Windows Vista and Ubuntu, by contrast, added much more robust implementations of ASLR years earlier. I don't pay much attention to security, but I would be s

by saulrh 15y ago

Windows Vista and Ubuntu, by contrast, added much more robust implementations of ASLR years earlier. I don't pay much attention to security, but I would be surprised if this were the only feature that OSX is years behind on. I can imagine that OSX is better than Windows, if only because I have a reflexively bad opinion of Windows, and it's almost certainly better than previous OSX versions, but I'll believe it's better than Linux when I see a lot of reports from a lot of real security people.

deleted 15y ago
[deleted]
rdl 15y ago
10.7 is clearly the most secure Mac OS ever. It's basically parity with Windows 7 and mainstream Linux; inferior to security-specific Linux builds (e.g. SELinux). There are also various tools to security-harden Windows 7 and Linux which don't (as far as I know) yet exist on OSX, or 10.7. One of the issues is the lack of vPro/TXT/TPM on Mac hardware. Another issue is the lack of any biometric or smartcard support in Mac hardware (you could add an aftermarket USB reader, but that's a pain on something like a laptop). The only TPM-like protections in Apple hardware are to prevent piracy of OSX (hackintoshes), and you can see how efective those have been (existence of hackintosh is kind of proof that they haven't been). Apple's iOS devices could be much more secure than they are, too -- they don't actually have effective "erase after 10 tries" password protection, in that it's possible to image the phone and then try to decrypt the image an infinite number of times offline. That's kind of unforgivable as a design flaw, IMO, and means you need to use a super long brute force resistant passphrase to keep the phone secure (which only one person I know does).
- othermaciej 15y ago
  I don't think Windows 7 or mainstream Linux distros have the level of sandboxing provided by OS X. App sandbox plus the fact that many frameworks now run their engine in a separate tightly sandboxed process is kind of a big deal.
  - eropple 15y ago
    Mandatory Integrity Control provides an equivalent under Vista/7, but is not a requirement for applications. (The only applications I can think of that use it are IE8-9 and Chrome.)
    - othermaciej 15y ago
      Yes, Windows does have sandboxing APIs of sorts, but they are not used nearly as much, either by the system or by third-party apps, as Lion sandboxing. This is probably in part because the relevant Windows APIs are extremely course-grained and therefore very hard to use.
      - rdl 15y ago
        Yeah -- I totally agree that Apple's done a better job making this usable for developers and thus users, but that's what Apple does with everything. I wish someone would do a great iris biometric app for the Mac and iPhone, and would incorporate a hw tamper-resistant chip for password to key mapping (to reduce all brute force attempts to "online" vs. "offline"). iCloud kinda solves the latter by potentially letting you push auth out into the cloud.
- masklinn 15y ago
  > It's basically parity with Windows 7 and mainstream Linux; inferior to security-specific Linux builds (e.g. SELinux). I am not aware that the kind of sandboxing Lion offers (and promotes, and encourages through things like the pbox daemon) is available on any consumer OS (apart from SELinux, and that's hardly a consumer OS), let alone with that attention to painlessness from the user's POV.

by saulrh 15y ago

deleted 15y ago

[deleted]

rdl 15y ago

10.7 is clearly the most secure Mac OS ever. It's basically parity with Windows 7 and mainstream Linux; inferior to security-specific Linux builds (e.g. SELinux). There are also various tools to security-harden Windows 7 and Linux which don't (as far as I know) yet exist on OSX, or 10.7. One of the issues is the lack of vPro/TXT/TPM on Mac hardware. Another issue is the lack of any biometric or smartcard support in Mac hardware (you could add an aftermarket USB reader, but that's a pain on something like a laptop). The only TPM-like protections in Apple hardware are to prevent piracy of OSX (hackintoshes), and you can see how efective those have been (existence of hackintosh is kind of proof that they haven't been). Apple's iOS devices could be much more secure than they are, too -- they don't actually have effective "erase after 10 tries" password protection, in that it's possible to image the phone and then try to decrypt the image an infinite number of times offline. That's kind of unforgivable as a design flaw, IMO, and means you need to use a super long brute force resistant passphrase to keep the phone secure (which only one person I know does).

othermaciej 15y ago
I don't think Windows 7 or mainstream Linux distros have the level of sandboxing provided by OS X. App sandbox plus the fact that many frameworks now run their engine in a separate tightly sandboxed process is kind of a big deal.
- eropple 15y ago
  Mandatory Integrity Control provides an equivalent under Vista/7, but is not a requirement for applications. (The only applications I can think of that use it are IE8-9 and Chrome.)
  - othermaciej 15y ago
    Yes, Windows does have sandboxing APIs of sorts, but they are not used nearly as much, either by the system or by third-party apps, as Lion sandboxing. This is probably in part because the relevant Windows APIs are extremely course-grained and therefore very hard to use.
    - rdl 15y ago
      Yeah -- I totally agree that Apple's done a better job making this usable for developers and thus users, but that's what Apple does with everything. I wish someone would do a great iris biometric app for the Mac and iPhone, and would incorporate a hw tamper-resistant chip for password to key mapping (to reduce all brute force attempts to "online" vs. "offline"). iCloud kinda solves the latter by potentially letting you push auth out into the cloud.
masklinn 15y ago
> It's basically parity with Windows 7 and mainstream Linux; inferior to security-specific Linux builds (e.g. SELinux). I am not aware that the kind of sandboxing Lion offers (and promotes, and encourages through things like the pbox daemon) is available on any consumer OS (apart from SELinux, and that's hardly a consumer OS), let alone with that attention to painlessness from the user's POV.