6 ms·

What do you think Microsoft has done that Apple has not?

mrich 15y ago
Microsoft had its security Waterloo 6-8 years ago, and they have dramatically improved and changed their development practices since then. I once read that they have one whole building of engineers dedicated to security (sorry cannot find the link anymore). Reports involving security breaches of Apple products often show Apple as someone who feels wronged and would rather try to kill the messenger than fix the problem. To their credit, they appear to be looking for fixes that cause the least harm to their users. But to me they appear to be operating on very limited manpower/budget for this so they have to prioritize. An example: Apple didn't fix a flaw on Windows iTunes for 3 years because it wasn't a priority, and intelligence software companies sold software based on this hole - imagine if Microsoft did this: http://www.telegraph.co.uk/technology/apple/8912714/Apple-iTunes-flaw-allowed-government-spying-for-3-years.html http://www.telegraph.co.uk/technology/apple/8912714/Apple-iT...
- rhplus 15y ago
  2002 was the start of Microsoft's major security rethink, prompted in part by exploits like the Code Red worm. For a short period it wasn't a building of engineers, but the whole engineering staff that stopped development and focused on security code reviews and bug fixes[1]. One of the outcomes was the Security Development Lifecycle[2]. [1] http://www.windowsitpro.com/article/security/microsoft-reportedly-halts-new-software-development-temporarily http://www.windowsitpro.com/article/security/microsoft-repor... [2] http://www.microsoft.com/security/sdl/default.aspx http://www.microsoft.com/security/sdl/default.aspx
- rbarooah 15y ago
  You dodged the question. You haven't listed a single thing that Microsoft has done that Apple has not. You are right that Microsoft started to take security seriously before Apple did, but Apple is not still behind. http://www.theregister.co.uk/2011/07/21/mac_os_x_lion_security/ http://www.theregister.co.uk/2011/07/21/mac_os_x_lion_securi...
  - mindslight 15y ago
    Attempting to revert the PC revolution into centrally controlled display terminals is "pretty fucking behind". Microsoft attempted to do this a decade ago and was rightfully called out for it, but it seems most of the Apple community is happy to not own the devices they rely on. Apparently Macs really are not meant to be Personal Computers.
    - rbarooah 15y ago
      Are you sure you're not talking about Chrome OS? Also, what's your proposal for establishing the trustworthiness of code?
      - mindslight 15y ago
        Although what I said could be applied there as well, given that I didn't even attempt to reference it, I'm pretty sure. Sorry, arbitrary dichotomies are only fun for ultimately inconsequential things (professional sports, for instance).
        rbarooah 15y ago
        It's not an arbitrary dichotomy, it's a factual one. Mac OS doesn't resemble a centrally controlled 'display terminal' at all, whereas Chrome OS does. You also didn't answer the part about trusted code.
        mindslight 15y ago
        Mac OS hasn't reached the point where one needs to jump through hoops to install arbitrary programs, but given that the beginnings of such a system is present in Lion and it's the status quo on all of Apple's more recent devices (and one of their main selling points), one can only conclude that's the direction they will be taking consumer-oriented Mac OS in. > You also didn't answer the part about trusted code. Because it wasn't there when I replied. Centrally signed code repositories on their own aren't the worst thing, I rely on them myself (apt-get). The problem arises when it's fixed to one possible repository. If the proverbial "average user" cannot install and administer a friend-approved but Apple-unapproved app with the nearly the same ease as an Apple-approved one, we end up with a situation where Apple directly controls what average users are capable of. It also causes users who wish to own their device to hope for new exploits to be publicly discovered, which is utterly backwards. I understand that progress for actual security (isolation, capabilities, proper deputies, etc) takes significant work, but coarse-grained whitelists aren't the answer.
munin 15y ago
the easier question to ask is what HASN'T Microsoft done? quick example: they paid millions possibly tens of millions for the best people from industry and academia to build automatic bug searching tools. these tools currently define state of the art for finding bugs in applications. they also have a community outreach program where they will work with companies and individuals that report flaws. that same outreach program will work internally with the relevant product groups to get flaws fixed. oh and also they invest constantly in improvements to their toolchain and operating system runtime to make exploitable bugs harder (safeSEH, ASLR, DEP, GS cookies, EMET, encoded pointers, safe-unlinked heaps both in user and kernel mode, etc). and yet, you realize, there are still exploitable bugs. in my opinion you should regard this as the fundamental instability of system software written in C. if microsoft can't get that right (in terms of security and stability), after all that they've invested, who can?
- rbarooah 15y ago
  1. Where are those bug searching tools used? 2. I'd agree that the outreach program is something that Apple clearly hasn't done. 3. Apple clearly is doing this too. HP's work on secret agents in the 90's shows that you can't prove code to be trustworthy. You can only assign trust to the intentions of the originator. Therefore, the most significant thing you can do to improve security is to verify the provenance of trusted code and the isolation of untrusted code. Windows clearly has decent technical code-signing infrastructure, but Apple seems far ahead in terms of effectively deploying this model into the field.
  - angersock 15y ago
    "1. Where are those bug searching tools used?" Microsoft has some good static code analysis tools ( http://msdn.microsoft.com/en-us/gg712340 http://msdn.microsoft.com/en-us/gg712340 ), for a start. "3. Apple clearly is doing this too." They seem more concerned about not letting users jailbreak their devices than anything else. "Windows clearly has decent technical code-signing infrastructure, but Apple seems far ahead in terms of effectively deploying this model into the field." "Far ahead"? How do you justify that claim? Most charitably, it seems that both companies work on security. Of the two, Microsoft seems to have better documentation, better openness, and better tools.
blub 15y ago
Releasing security fixes in a timely manner for one. This Java exploit was fixed for a long time before Apple so graciously bestowed a fix upon us. Then there's that SSL certificate SNAFU where I had to fix Safari myself, after almost all companies had already issued updates. Too bad that was not possible on iOS, where you just had to sit around and twiddle your thumbs.

mrich 15y ago

Microsoft had its security Waterloo 6-8 years ago, and they have dramatically improved and changed their development practices since then. I once read that they have one whole building of engineers dedicated to security (sorry cannot find the link anymore). Reports involving security breaches of Apple products often show Apple as someone who feels wronged and would rather try to kill the messenger than fix the problem. To their credit, they appear to be looking for fixes that cause the least harm to their users. But to me they appear to be operating on very limited manpower/budget for this so they have to prioritize. An example: Apple didn't fix a flaw on Windows iTunes for 3 years because it wasn't a priority, and intelligence software companies sold software based on this hole - imagine if Microsoft did this: http://www.telegraph.co.uk/technology/apple/8912714/Apple-iTunes-flaw-allowed-government-spying-for-3-years.html http://www.telegraph.co.uk/technology/apple/8912714/Apple-iT...

rhplus 15y ago
2002 was the start of Microsoft's major security rethink, prompted in part by exploits like the Code Red worm. For a short period it wasn't a building of engineers, but the whole engineering staff that stopped development and focused on security code reviews and bug fixes[1]. One of the outcomes was the Security Development Lifecycle[2]. [1] http://www.windowsitpro.com/article/security/microsoft-reportedly-halts-new-software-development-temporarily http://www.windowsitpro.com/article/security/microsoft-repor... [2] http://www.microsoft.com/security/sdl/default.aspx http://www.microsoft.com/security/sdl/default.aspx
rbarooah 15y ago
You dodged the question. You haven't listed a single thing that Microsoft has done that Apple has not. You are right that Microsoft started to take security seriously before Apple did, but Apple is not still behind. http://www.theregister.co.uk/2011/07/21/mac_os_x_lion_security/ http://www.theregister.co.uk/2011/07/21/mac_os_x_lion_securi...
- mindslight 15y ago
  Attempting to revert the PC revolution into centrally controlled display terminals is "pretty fucking behind". Microsoft attempted to do this a decade ago and was rightfully called out for it, but it seems most of the Apple community is happy to not own the devices they rely on. Apparently Macs really are not meant to be Personal Computers.
  - rbarooah 15y ago
    Are you sure you're not talking about Chrome OS? Also, what's your proposal for establishing the trustworthiness of code?
    - mindslight 15y ago
      Although what I said could be applied there as well, given that I didn't even attempt to reference it, I'm pretty sure. Sorry, arbitrary dichotomies are only fun for ultimately inconsequential things (professional sports, for instance).
      - rbarooah 15y ago
        It's not an arbitrary dichotomy, it's a factual one. Mac OS doesn't resemble a centrally controlled 'display terminal' at all, whereas Chrome OS does. You also didn't answer the part about trusted code.
        mindslight 15y ago
        Mac OS hasn't reached the point where one needs to jump through hoops to install arbitrary programs, but given that the beginnings of such a system is present in Lion and it's the status quo on all of Apple's more recent devices (and one of their main selling points), one can only conclude that's the direction they will be taking consumer-oriented Mac OS in. > You also didn't answer the part about trusted code. Because it wasn't there when I replied. Centrally signed code repositories on their own aren't the worst thing, I rely on them myself (apt-get). The problem arises when it's fixed to one possible repository. If the proverbial "average user" cannot install and administer a friend-approved but Apple-unapproved app with the nearly the same ease as an Apple-approved one, we end up with a situation where Apple directly controls what average users are capable of. It also causes users who wish to own their device to hope for new exploits to be publicly discovered, which is utterly backwards. I understand that progress for actual security (isolation, capabilities, proper deputies, etc) takes significant work, but coarse-grained whitelists aren't the answer.

munin 15y ago

the easier question to ask is what HASN'T Microsoft done? quick example: they paid millions possibly tens of millions for the best people from industry and academia to build automatic bug searching tools. these tools currently define state of the art for finding bugs in applications. they also have a community outreach program where they will work with companies and individuals that report flaws. that same outreach program will work internally with the relevant product groups to get flaws fixed. oh and also they invest constantly in improvements to their toolchain and operating system runtime to make exploitable bugs harder (safeSEH, ASLR, DEP, GS cookies, EMET, encoded pointers, safe-unlinked heaps both in user and kernel mode, etc). and yet, you realize, there are still exploitable bugs. in my opinion you should regard this as the fundamental instability of system software written in C. if microsoft can't get that right (in terms of security and stability), after all that they've invested, who can?

rbarooah 15y ago
1. Where are those bug searching tools used? 2. I'd agree that the outreach program is something that Apple clearly hasn't done. 3. Apple clearly is doing this too. HP's work on secret agents in the 90's shows that you can't prove code to be trustworthy. You can only assign trust to the intentions of the originator. Therefore, the most significant thing you can do to improve security is to verify the provenance of trusted code and the isolation of untrusted code. Windows clearly has decent technical code-signing infrastructure, but Apple seems far ahead in terms of effectively deploying this model into the field.
- angersock 15y ago
  "1. Where are those bug searching tools used?" Microsoft has some good static code analysis tools ( http://msdn.microsoft.com/en-us/gg712340 http://msdn.microsoft.com/en-us/gg712340 ), for a start. "3. Apple clearly is doing this too." They seem more concerned about not letting users jailbreak their devices than anything else. "Windows clearly has decent technical code-signing infrastructure, but Apple seems far ahead in terms of effectively deploying this model into the field." "Far ahead"? How do you justify that claim? Most charitably, it seems that both companies work on security. Of the two, Microsoft seems to have better documentation, better openness, and better tools.

blub 15y ago

Releasing security fixes in a timely manner for one. This Java exploit was fixed for a long time before Apple so graciously bestowed a fix upon us. Then there's that SSL certificate SNAFU where I had to fix Safari myself, after almost all companies had already issued updates. Too bad that was not possible on iOS, where you just had to sit around and twiddle your thumbs.