Davoud wrote:
> What I'm really asking is why does this guy say that there is Mac
> malware out there when he can't identify any? Where's the beef? Read
> any article on Windows malware and it is named and described in
> considerable detail.
All very true. But still, it's not wise to be too smug. One reason that
the unix part of the industry has such a good security record is that
both developers and users have historically taken security seriously.
Lots of people are on constant watch for problems, and when we see
one, we let the vendor(s) know, and if vendors haven't responded
with fixes within a few weeks, we holler loudly. We publish details
of the problem, complete with exploit code, and include the messages
we sent the vendors weeks earlier. This exposure wonders over the
long term.
I recall back in the early 80's, when a new version of vi came out that
allowed "inline setup" by including vi commands in the first few lines
of a file. So you could start a C program, for example, with
/*
:set ts=4 sw=4 ai
*/
and your tab stops and auto-indent would be set to 4 columns. Within
a week or so, mailing lists and newsgroups were full of the example:
Send someone email that starts with the line:
:!rm -rf /
At the time, many users used their editors to read email. Horrified users
let their vendors know that this would be fixed *right now*, or they'd
never get another order. Within weeks, it was fixed. The feature is still
there, but you need to type a command-line arg to turn it on. About the
same time (I don't recall who was first), emacs came out with a similar
misfeature, and it got the same reaction. Every few years, some vendor
gets the idea that this would be a good thing to turn on by default. But
watchful users spot it, and start hollering again until it's fixed.
It's "interesting" that Microsoft has gotten away with similar security
holes, in the form of automatic execution of code downloaded from
outside systems (email, web pages, whatever). Windows users haven't
responded with outrage like unix users, and demanded a fix or they'd
never buy from Microsoft again. So Microsoft sees no reason to fix
such problems until a disaster forces them to fix it.
IMHO, this is the real reason that MS software is so insecure. Its users
don't understand security, and don't jump all over the vendor when an
exploit appears. They accept that "That's how computers are". They
aren't on the watch for security problems.
Macs are more secure partly because they do tend to have somewhat
more knowledgeable users who have opinions and are willing to speak
their mind. If an OS X exploit does appear, we'll probably all let Apple
know exactly what we're thinking. But mostly, Apple has been able
to leverage several decades of unix experience with security. Most of
the mistakes are well documented, and by using a BSD unix base, Apple
incorporated all of that learning in one swell foop.
>> Stay informed about: Spyware and Virus Programs? 
FAQ
Search
Profile
Private Messages
Log in
