5 ms·

As someone who works in the IT security industry, I absolutely agree with this statement. I could give dozen of examples showing Apple does not prioritize secur

by mrb 15y ago

As someone who works in the IT security industry, I absolutely agree with this statement. I could give dozen of examples showing Apple does not prioritize security as much as, say, Microsoft. For example, when an open source software project bundled with Mac OS X releases a security update (LDAP, Apache, Java, etc), it sometimes take Apple months to merely test it and ship it out. OS X was also very late, compared to Windows, in implementing in-depth defense mechanisms such as address space layout randomization, stack protection, etc. And last August, it was discovered that LDAP auth on OS X blindly accepted any password! Apple's code review and testing processes must be very immature to let such a glaring vulnerability ship to customers http://forums.macrumors.com/showthread.php?t=1197379 http://forums.macrumors.com/showthread.php?t=1197379 But I think Apple is slowly and finally understanding the importance of security in their software ecosystem...

epistasis 15y ago
>OS X was also very late, compared to Windows, in implementing in-depth defense mechanisms such as address space layout randomization, stack protection, etc. These are not areas where Apple is even close to 10 years behind Microsoft. The statement here is absolutely indefensible, In 2002 OS X was way ahead of Microsoft on the security front, and OS X has not gone backwards since then.
- sontek 15y ago
  I don't believe OSX has ever been ahead of Microsoft in security, it just didn't have enough popularity for anyone to really care about attacking it. That has changed.
  - epistasis 15y ago
    In 2002 Microsoft shipped with all sorts of unnecessary daemons on and listening by default. OS X did not have that problem.
    - boyter 15y ago
      Which is 10 years ago which the article states.
      - deleted 15y ago
        [deleted]
  - taligent 15y ago
    OSX has always been ahead of Microsoft in the user experience aspect of security. The way it handled privilege escalation has always been far superior to Vista and Windows 7. Also OSX has been leading the charge towards developer signed binaries much more forcefully than Microsoft.
nirvana 15y ago
> As someone who works in the IT security industry, I absolutely agree with this statement. The former claim is impeached by the latter. > it sometimes take Apple months to merely test it and ship it out. This is a dishonest characterization. I'd rather Apple continue to ship a robust and secure operating system, than to simply patch it every time someone releases an update that passes its regression tests, with the subsequent breakage of other packages and new security holes, none of which are caught by regression tests. >OS X was also very late, compared to Windows, in implementing in-depth defense mechanisms I really don't think 2001-2002 counts as "very late". >Apple's code review and testing processes must be very immature to let such a glaring vulnerability ship to customers Please explain to me why there are known security holes in windows that have existed for 15 years? >But I think Apple is slowly and finally understanding the importance of security in their software ecosystem... Damning with faint praise. Apple has taken this issue seriously since 1987. Microsoft makes too much money from being vulnerable to take it seriously. This is just more nonsense from apple bashers based on characterization... Great for clicks but it impeaches you as an engineer.
- sliverstorm 15y ago
  > I'd rather Apple continue to ship a robust and secure operating system That's the thing, how is it robust and secure if Apple takes months to release security updates for said open-source software? > I really don't think 2001-2002 counts as "very late". You misread his comment. He is saying OS X was not released with in-depth defense mechanisms. Thus its release date is of no consequence. > Apple has taken this issue seriously since 1987. Forgive me for my skepticism, but what security concerns, exactly, did Apple face in 1987? 1987 was in the middle of the emergence of word processors.
  - nirvana 15y ago
    >You misread his comment. He is saying OS X was not released with in-depth defense mechanisms. Thus its release date is of no consequence. Really? 2001-2002 is when OS X got in depth defense mechanisms, thus the date is relevant-- it proves shows how full of it he is. So, I didn't misread the comment, I rebutted it by citing the date. >Forgive me for my skepticism, but what security concerns, exactly, did Apple face in 1987? 1987 was in the middle of the emergence of word processors. And the emergence of viruses. Where were a real problem on the Mac from 1987-1990. >That's the thing, how is it robust and secure if Apple takes months to release security updates for said open-source software? Because just shipping patches without testing them produces a brittle OS and opens them up to having security holes. I'm tired of these argument-from-ignorance claims that seem to be common on hacker news. If you're going to disagree with me, at least please take the time to read what I wrote and comprehend it and disagree with what I'm saying. Don't just dash off some response based on your lack of knowledge of history, and what I'm arguing.
taligent 15y ago
What you wrote contradicts itself. You criticise Apple for taking too long to test and ship out security updates. And then criticise Apple for not testing enough. Which is it ?
- steve918 15y ago
  These things aren't mutually exclusive. Apple takes to long to put out security updates for the same reason they are not testing enough. They don't dedicate a lot of resources to doing so.

by mrb 15y ago

epistasis 15y ago

>OS X was also very late, compared to Windows, in implementing in-depth defense mechanisms such as address space layout randomization, stack protection, etc. These are not areas where Apple is even close to 10 years behind Microsoft. The statement here is absolutely indefensible, In 2002 OS X was way ahead of Microsoft on the security front, and OS X has not gone backwards since then.

sontek 15y ago
I don't believe OSX has ever been ahead of Microsoft in security, it just didn't have enough popularity for anyone to really care about attacking it. That has changed.
- epistasis 15y ago
  In 2002 Microsoft shipped with all sorts of unnecessary daemons on and listening by default. OS X did not have that problem.
  - boyter 15y ago
    Which is 10 years ago which the article states.
    - deleted 15y ago
      [deleted]
- taligent 15y ago
  OSX has always been ahead of Microsoft in the user experience aspect of security. The way it handled privilege escalation has always been far superior to Vista and Windows 7. Also OSX has been leading the charge towards developer signed binaries much more forcefully than Microsoft.

nirvana 15y ago

> As someone who works in the IT security industry, I absolutely agree with this statement. The former claim is impeached by the latter. > it sometimes take Apple months to merely test it and ship it out. This is a dishonest characterization. I'd rather Apple continue to ship a robust and secure operating system, than to simply patch it every time someone releases an update that passes its regression tests, with the subsequent breakage of other packages and new security holes, none of which are caught by regression tests. >OS X was also very late, compared to Windows, in implementing in-depth defense mechanisms I really don't think 2001-2002 counts as "very late". >Apple's code review and testing processes must be very immature to let such a glaring vulnerability ship to customers Please explain to me why there are known security holes in windows that have existed for 15 years? >But I think Apple is slowly and finally understanding the importance of security in their software ecosystem... Damning with faint praise. Apple has taken this issue seriously since 1987. Microsoft makes too much money from being vulnerable to take it seriously. This is just more nonsense from apple bashers based on characterization... Great for clicks but it impeaches you as an engineer.

sliverstorm 15y ago
> I'd rather Apple continue to ship a robust and secure operating system That's the thing, how is it robust and secure if Apple takes months to release security updates for said open-source software? > I really don't think 2001-2002 counts as "very late". You misread his comment. He is saying OS X was not released with in-depth defense mechanisms. Thus its release date is of no consequence. > Apple has taken this issue seriously since 1987. Forgive me for my skepticism, but what security concerns, exactly, did Apple face in 1987? 1987 was in the middle of the emergence of word processors.
- nirvana 15y ago
  >You misread his comment. He is saying OS X was not released with in-depth defense mechanisms. Thus its release date is of no consequence. Really? 2001-2002 is when OS X got in depth defense mechanisms, thus the date is relevant-- it proves shows how full of it he is. So, I didn't misread the comment, I rebutted it by citing the date. >Forgive me for my skepticism, but what security concerns, exactly, did Apple face in 1987? 1987 was in the middle of the emergence of word processors. And the emergence of viruses. Where were a real problem on the Mac from 1987-1990. >That's the thing, how is it robust and secure if Apple takes months to release security updates for said open-source software? Because just shipping patches without testing them produces a brittle OS and opens them up to having security holes. I'm tired of these argument-from-ignorance claims that seem to be common on hacker news. If you're going to disagree with me, at least please take the time to read what I wrote and comprehend it and disagree with what I'm saying. Don't just dash off some response based on your lack of knowledge of history, and what I'm arguing.

taligent 15y ago

What you wrote contradicts itself. You criticise Apple for taking too long to test and ship out security updates. And then criticise Apple for not testing enough. Which is it ?

steve918 15y ago
These things aren't mutually exclusive. Apple takes to long to put out security updates for the same reason they are not testing enough. They don't dedicate a lot of resources to doing so.