51–60 of 134 posts
And in the servermarket, OSx is hardly around, and is the share of various Linux servers growing larger then Windows, even.
I was struck by the part about the OSX ASLR implementation. I can't believe they only randomize library loads :-/.
Although it's not officially documented, Snow Leopard's sandbox is already quite capable and easier to use than the norm; it's nonsensical to list "sandboxing" and "mandatory access controls" as wins for other operating systems. Lion will make it mandatory for all App Store apps and add features like a secure open dialog (where the OS handles the open dialog and gives the app access to only user-selected files) and a…
I want an optional feature which only allows the OS to execute MacAppStore programs. This would be "grandparent proof" and would prevent trivial kinds of social engineering used by MacDefender (which targeted clueless users).
They often share vulnerabilities with core libraries in other UNIX like systems with samba and java being two examples. Good thing that Lion jettisons both (Samba for going GPLv3, and Java is non-core download) The firewall functionality in OS X is impressive, but hardly utilized. The underlying technology is ipfw Also changed in Lion, which now uses OpenBSD's pf. Apple doesn't make much more use of it though. It has…
(Yes, I know that 'pf' started on OpenBSD.)
The author may have some good points, but this essay is so poorly organized that it's hard to tell what they are or put them into proper perspective. It's mostly a good argument for teaching essay-writing in school.
Earlier quoted context omitted.
I want an optional feature which only allows the OS to execute MacAppStore programs. This would be "grandparent proof" and would prevent trivial kinds of social engineering used by MacDefender (which targeted clueless users).
I'd be very likely to buy this for my mother or recommend it to others who need a simple and safe environment. With a bit more polish, a Linux locked to a rigorously maintained package repository could also fill this niche.
So far, she has been very happy with it. She is now using Natty and quickly transitioned to the Unity shell.
Every once in a while, I log in remotely and brush the machine's teeth. Never found anything remotely suspicious.
Earlier quoted context omitted.
Unix by far is not secure. Access control via unix permissions is a mess, this is why we have selinux, apparmor, smack... The whole 'complexity' argument is moot todays unix with selinux, chrooting, jails, apparmor is much more complex than say a capability based security.
Can you mention specific issues with Unix permission management that Windows solves?
These are all standard features in most ACL-based multi-user environments.
Unix file permissions don't use ACLs, so off the top of my head I'm not sure how you would set this up on Unix. For one thing, I am pretty sure w implies delete permissions. So that group can't even exist, and if it could, there's no easy way to have that group be different from the read-only group, and still have a no-access-at-all group.
I suspect most complicated requirements can be resolved with some combination of sudo and traditional permissions but it's not always straightforward and probably won't be exactly equivalent to the way you would do it in Windows.
Earlier quoted context omitted.
It’s possible some people might believe that, perhaps not HN readers But the quality of the management plays a very important role in the quality of the end result: Apples has Jobs and Microsoft has Ballmer. So Microsoft is at a disadvantage human-resource-wise.
As an engineer (though admittedly one at Microsoft), Steve Jobs seems like he'd be a /horrible/ boss. All appearances suggest that he doesn't care about good engineering, but rather that he cares about good user experience, damn the torpedoes.
Good engineering is good user experience.
Earlier quoted context omitted.
your Windows clients are probably using NTLM (or NTLMv2), Microsoft's old, terrible auth protocol that the Windows team eventually abandoned for Kerberos. there are policy settings you can change to force Kerberos; I'd suggest Googling to see if you can find them, and see if it breaks your Windows clients as bad as your OS X clients seem to be.
I had not thought about that, would OS X fall back to using that in case Kerberos doesn't function? Thanks for the suggestion!
anyway, hope you figure out the problem. :)
Earlier quoted context omitted.
It’s possible some people might believe that, perhaps not HN readers But the quality of the management plays a very important role in the quality of the end result: Apples has Jobs and Microsoft has Ballmer. So Microsoft is at a disadvantage human-resource-wise.
As an engineer (though admittedly one at Microsoft), Steve Jobs seems like he'd be a /horrible/ boss. All appearances suggest that he doesn't care about good engineering, but rather that he cares about good user experience, damn the torpedoes.
Also, user experience is a part of good engineering.