6 ms·

Microsoft had its security Waterloo 6-8 years ago, and they have dramatically improved and changed their development practices since then. I once read that they

by mrich 15y ago

Microsoft had its security Waterloo 6-8 years ago, and they have dramatically improved and changed their development practices since then. I once read that they have one whole building of engineers dedicated to security (sorry cannot find the link anymore). Reports involving security breaches of Apple products often show Apple as someone who feels wronged and would rather try to kill the messenger than fix the problem. To their credit, they appear to be looking for fixes that cause the least harm to their users. But to me they appear to be operating on very limited manpower/budget for this so they have to prioritize. An example: Apple didn't fix a flaw on Windows iTunes for 3 years because it wasn't a priority, and intelligence software companies sold software based on this hole - imagine if Microsoft did this: http://www.telegraph.co.uk/technology/apple/8912714/Apple-iTunes-flaw-allowed-government-spying-for-3-years.html http://www.telegraph.co.uk/technology/apple/8912714/Apple-iT...

rhplus 15y ago
2002 was the start of Microsoft's major security rethink, prompted in part by exploits like the Code Red worm. For a short period it wasn't a building of engineers, but the whole engineering staff that stopped development and focused on security code reviews and bug fixes[1]. One of the outcomes was the Security Development Lifecycle[2]. [1] http://www.windowsitpro.com/article/security/microsoft-reportedly-halts-new-software-development-temporarily http://www.windowsitpro.com/article/security/microsoft-repor... [2] http://www.microsoft.com/security/sdl/default.aspx http://www.microsoft.com/security/sdl/default.aspx
rbarooah 15y ago
You dodged the question. You haven't listed a single thing that Microsoft has done that Apple has not. You are right that Microsoft started to take security seriously before Apple did, but Apple is not still behind. http://www.theregister.co.uk/2011/07/21/mac_os_x_lion_security/ http://www.theregister.co.uk/2011/07/21/mac_os_x_lion_securi...
- mindslight 15y ago
  Attempting to revert the PC revolution into centrally controlled display terminals is "pretty fucking behind". Microsoft attempted to do this a decade ago and was rightfully called out for it, but it seems most of the Apple community is happy to not own the devices they rely on. Apparently Macs really are not meant to be Personal Computers.
  - rbarooah 15y ago
    Are you sure you're not talking about Chrome OS? Also, what's your proposal for establishing the trustworthiness of code?
    - mindslight 15y ago
      Although what I said could be applied there as well, given that I didn't even attempt to reference it, I'm pretty sure. Sorry, arbitrary dichotomies are only fun for ultimately inconsequential things (professional sports, for instance).
      - rbarooah 15y ago
        It's not an arbitrary dichotomy, it's a factual one. Mac OS doesn't resemble a centrally controlled 'display terminal' at all, whereas Chrome OS does. You also didn't answer the part about trusted code.
        mindslight 15y ago
        Mac OS hasn't reached the point where one needs to jump through hoops to install arbitrary programs, but given that the beginnings of such a system is present in Lion and it's the status quo on all of Apple's more recent devices (and one of their main selling points), one can only conclude that's the direction they will be taking consumer-oriented Mac OS in. > You also didn't answer the part about trusted code. Because it wasn't there when I replied. Centrally signed code repositories on their own aren't the worst thing, I rely on them myself (apt-get). The problem arises when it's fixed to one possible repository. If the proverbial "average user" cannot install and administer a friend-approved but Apple-unapproved app with the nearly the same ease as an Apple-approved one, we end up with a situation where Apple directly controls what average users are capable of. It also causes users who wish to own their device to hope for new exploits to be publicly discovered, which is utterly backwards. I understand that progress for actual security (isolation, capabilities, proper deputies, etc) takes significant work, but coarse-grained whitelists aren't the answer.
- mrich 15y ago
  Please read my answer again, and you will find differences between Microsoft's and Apple's approach to security that answer your question.
  - rbarooah 15y ago
    You didn't answer my question. You've offered a vague opinion about appearances. If you had answered my question you would be able to pick out at least one thing that Microsoft had done that Apple had not. You said: Microsoft did their job years ago, now Apple has to follow. This is simply not supported by the facts.
    - nirvana 15y ago
      Especially the fact that Apple's OS security has been solid, all thru the past two decades, with very few exploits, while Microsofts has bee wide open during those period, and Microsooft deliberately chose not to close the holes because they were there for "marketing initiatives". On Windows a massive industry of malware detection has sprung up and still there are millions upon millions of zombie PCs out there. Meanwhile, despite no such industry on OS X there are no reports of infections in the wild (from viruses the original commenters claim, this article is about a trojan, which also is a lot more prevalent on windows than on the Mac.) But don't let these facts get in the way-- remember, the point of this thread specifically, and a big amount of the draw of Hacker News, is that you can bash Apple and get up voted by other Apple haters. Facts are not relevant.

by mrich 15y ago

rhplus 15y ago

2002 was the start of Microsoft's major security rethink, prompted in part by exploits like the Code Red worm. For a short period it wasn't a building of engineers, but the whole engineering staff that stopped development and focused on security code reviews and bug fixes[1]. One of the outcomes was the Security Development Lifecycle[2]. [1] http://www.windowsitpro.com/article/security/microsoft-reportedly-halts-new-software-development-temporarily http://www.windowsitpro.com/article/security/microsoft-repor... [2] http://www.microsoft.com/security/sdl/default.aspx http://www.microsoft.com/security/sdl/default.aspx

rbarooah 15y ago

You dodged the question. You haven't listed a single thing that Microsoft has done that Apple has not. You are right that Microsoft started to take security seriously before Apple did, but Apple is not still behind. http://www.theregister.co.uk/2011/07/21/mac_os_x_lion_security/ http://www.theregister.co.uk/2011/07/21/mac_os_x_lion_securi...

mindslight 15y ago
Attempting to revert the PC revolution into centrally controlled display terminals is "pretty fucking behind". Microsoft attempted to do this a decade ago and was rightfully called out for it, but it seems most of the Apple community is happy to not own the devices they rely on. Apparently Macs really are not meant to be Personal Computers.
- rbarooah 15y ago
  Are you sure you're not talking about Chrome OS? Also, what's your proposal for establishing the trustworthiness of code?
  - mindslight 15y ago
    Although what I said could be applied there as well, given that I didn't even attempt to reference it, I'm pretty sure. Sorry, arbitrary dichotomies are only fun for ultimately inconsequential things (professional sports, for instance).
    - rbarooah 15y ago
      It's not an arbitrary dichotomy, it's a factual one. Mac OS doesn't resemble a centrally controlled 'display terminal' at all, whereas Chrome OS does. You also didn't answer the part about trusted code.
      - mindslight 15y ago
        Mac OS hasn't reached the point where one needs to jump through hoops to install arbitrary programs, but given that the beginnings of such a system is present in Lion and it's the status quo on all of Apple's more recent devices (and one of their main selling points), one can only conclude that's the direction they will be taking consumer-oriented Mac OS in. > You also didn't answer the part about trusted code. Because it wasn't there when I replied. Centrally signed code repositories on their own aren't the worst thing, I rely on them myself (apt-get). The problem arises when it's fixed to one possible repository. If the proverbial "average user" cannot install and administer a friend-approved but Apple-unapproved app with the nearly the same ease as an Apple-approved one, we end up with a situation where Apple directly controls what average users are capable of. It also causes users who wish to own their device to hope for new exploits to be publicly discovered, which is utterly backwards. I understand that progress for actual security (isolation, capabilities, proper deputies, etc) takes significant work, but coarse-grained whitelists aren't the answer.
mrich 15y ago
Please read my answer again, and you will find differences between Microsoft's and Apple's approach to security that answer your question.
- rbarooah 15y ago
  You didn't answer my question. You've offered a vague opinion about appearances. If you had answered my question you would be able to pick out at least one thing that Microsoft had done that Apple had not. You said: Microsoft did their job years ago, now Apple has to follow. This is simply not supported by the facts.
  - nirvana 15y ago
    Especially the fact that Apple's OS security has been solid, all thru the past two decades, with very few exploits, while Microsofts has bee wide open during those period, and Microsooft deliberately chose not to close the holes because they were there for "marketing initiatives". On Windows a massive industry of malware detection has sprung up and still there are millions upon millions of zombie PCs out there. Meanwhile, despite no such industry on OS X there are no reports of infections in the wild (from viruses the original commenters claim, this article is about a trojan, which also is a lot more prevalent on windows than on the Mac.) But don't let these facts get in the way-- remember, the point of this thread specifically, and a big amount of the draw of Hacker News, is that you can bash Apple and get up voted by other Apple haters. Facts are not relevant.