3 ms·

If malware on OSX is as small a problem as you're suggesting, why is Apple bothering with any of this? Is it to wrestle further control of the app eco-system on

by batista 15y ago

If malware on OSX is as small a problem as you're suggesting, why is Apple bothering with any of this? Is it to wrestle further control of the app eco-system on OSX? Or is it just security theatre? Or both? Something else? I don't understand the question. Apple has been improving OS X security mechanisms in every OS X update. From "address space layout randomization" to the "first run warning". This is another step in the same direction. Are you implying that Apple should only do something about OS X security AFTER malware on OS X get's to be a problem? Because, I'd rather they do it BEFORE. And I fail to see how pro-actively making an OS more secure is "security theater". Then it will be a lot easier for them to require apps to be signed. For your own protection of course. Of course. I miss the irony here. Signed applications are touted by security experts as a highly successful security measure. Are you suggesting it is otherwise or are you just confusing the potential of misuse of that feature with that feature being meaningless? * After all, if developer IDs are so easy and free to get, and will make it easier for people to install your app. Why wouldn't you get it signed?* Yeah, why? Surely not for the $100 it takes. SSL certificates cost money too, but I don't see anybody suggesting running your web app in plain HTTP is better, or that paid certificates hamper secure web application development.

mike-cardwell 15y ago
I stated what malware writers will do. You then replied by being sarcastic about how malware isn't really a problem. I then asked a rhetorical question about why would they be doing this if not to defend against malware. Now you're ranting about how malware could become a problem as if this is somehow news to me. I'm sure you had a point.
batista 15y ago
I stated what malware writers will do. No, you stated what you THINK they will do. For one, most Macs are updated very often, what with Software Update and Mac Store updates. So updating a black list of applications wouldn't be a problem. Second, they cannot just get a certificate, because they will have to interact with Apple and the developer program. You know many malware writers that want to give their details away? Third, even if they somehow get through the second caveat above, revocation would just be a step away. I then asked a rhetorical question about why would they be doing this if not to defend against malware. No, you said that if they don't do it to defend against ALREADY EXISTING malware then it's either a security theater or a mystery to you why they'd do it. As if defending against POSSIBLE FUTURE malware is a "security theater" or a strange notion.
- mike-cardwell 15y ago
  "No, you stated what you THINK they will do." I didn't think I would have to point out that I'm not psychic, and that it was only an opinion/prediction. I will try to be more clear in future. "Second, they cannot just get a certificate, because they will have to interact with Apple and the developer program. You know many malware writers that want to give their details away?" Sorry. I forgot that identity theft was impossible, and not rampant and easy and used as a matter of course by malware authors. The last three lines of your comment are complete nonsense. You have failed to parse and understand what I wrote.
- batista 15y ago
  The last three lines of your comment are complete nonsense. You have failed to parse and understand what I wrote. Yeah, because it is so off base, right, you writing: "If malware on OSX is as small a problem as you're suggesting, why is Apple bothering with any of this? Is it to wrestle further control of the app eco-system on OSX? Or is it just security theatre? Or both? Something else?" And me translating the above as you saying that if they don't do it to defend against ALREADY EXISTING malware then it's either a security theater or a mystery to you why they'd do it.
  - mike-cardwell 15y ago
    I was attempting to prompt you into retracting your ridiculous statement about malware not being a problem. I wish I hadn't bothered now. I'll leave you to it.
    - batista 15y ago
      I was attempting to prompt you into retracting your ridiculous statement about malware not being a problem. Ridiculous how? It's perfectly valid, as in: VERY VERY VERY VERY VERY FEW OS X users ever had problems with malware. Less that what would be statistical noise. On top of it, all the cases of OS X malware, had been trojans. So, 99.9999% got scratch free, despite not even running any antivirus or anything. So, an ACTUAL, EXISTING problem, it is NOT. Now, a POSSIBLE, FUTURE problem, yeah, it can be.

by batista 15y ago

mike-cardwell 15y ago

I stated what malware writers will do. You then replied by being sarcastic about how malware isn't really a problem. I then asked a rhetorical question about why would they be doing this if not to defend against malware. Now you're ranting about how malware could become a problem as if this is somehow news to me. I'm sure you had a point.

batista 15y ago

I stated what malware writers will do. No, you stated what you THINK they will do. For one, most Macs are updated very often, what with Software Update and Mac Store updates. So updating a black list of applications wouldn't be a problem. Second, they cannot just get a certificate, because they will have to interact with Apple and the developer program. You know many malware writers that want to give their details away? Third, even if they somehow get through the second caveat above, revocation would just be a step away. I then asked a rhetorical question about why would they be doing this if not to defend against malware. No, you said that if they don't do it to defend against ALREADY EXISTING malware then it's either a security theater or a mystery to you why they'd do it. As if defending against POSSIBLE FUTURE malware is a "security theater" or a strange notion.

mike-cardwell 15y ago
"No, you stated what you THINK they will do." I didn't think I would have to point out that I'm not psychic, and that it was only an opinion/prediction. I will try to be more clear in future. "Second, they cannot just get a certificate, because they will have to interact with Apple and the developer program. You know many malware writers that want to give their details away?" Sorry. I forgot that identity theft was impossible, and not rampant and easy and used as a matter of course by malware authors. The last three lines of your comment are complete nonsense. You have failed to parse and understand what I wrote.
batista 15y ago
The last three lines of your comment are complete nonsense. You have failed to parse and understand what I wrote. Yeah, because it is so off base, right, you writing: "If malware on OSX is as small a problem as you're suggesting, why is Apple bothering with any of this? Is it to wrestle further control of the app eco-system on OSX? Or is it just security theatre? Or both? Something else?" And me translating the above as you saying that if they don't do it to defend against ALREADY EXISTING malware then it's either a security theater or a mystery to you why they'd do it.
- mike-cardwell 15y ago
  I was attempting to prompt you into retracting your ridiculous statement about malware not being a problem. I wish I hadn't bothered now. I'll leave you to it.
  - batista 15y ago
    I was attempting to prompt you into retracting your ridiculous statement about malware not being a problem. Ridiculous how? It's perfectly valid, as in: VERY VERY VERY VERY VERY FEW OS X users ever had problems with malware. Less that what would be statistical noise. On top of it, all the cases of OS X malware, had been trojans. So, 99.9999% got scratch free, despite not even running any antivirus or anything. So, an ACTUAL, EXISTING problem, it is NOT. Now, a POSSIBLE, FUTURE problem, yeah, it can be.