Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OS X – Safe, yet horribly insecure

allthatiswrong.wordpress.com

Post reply on HN
Print view View original

1–10 of 134 posts

Re: OS X – Safe, yet horribly insecure

#2

Post by zdw »

They often share vulnerabilities with core libraries in other UNIX like systems with samba and java being two examples.

Good thing that Lion jettisons both (Samba for going GPLv3, and Java is non-core download)

The firewall functionality in OS X is impressive, but hardly utilized. The underlying technology is ipfw

Also changed in Lion, which now uses OpenBSD's pf. Apple doesn't make much more use of it though.

It has been a shame to see the sandboxing functionality introduced in Leopard not being utilized to anywhere near its full capacity.

That's changed as well in Lion, as any Mac App Store developer can tell you.

Re: OS X – Safe, yet horribly insecure

#4

Post by beaumartinez »

fourspace wrote: post #3

11px font with 19px line height? Uf, not for my tired eyes. Fixed with this CSS snippet: p { font: 16px "Lucida Sans Unicode", "Trebuchet MS", Verdana, monospace; }

My go-to bookmarklet for poor article design: Readable (not Readability). Someone posted it as a Show HN a few months ago and I haven't looked back since―it's incredibly fast and very customisable.

http://readable.tastefulwords.com/

Re: OS X – Safe, yet horribly insecure

#5

Post by comex »

Although it's not officially documented, Snow Leopard's sandbox is already quite capable and easier to use than the norm; it's nonsensical to list "sandboxing" and "mandatory access controls" as wins for other operating systems. Lion will make it mandatory for all App Store apps and add features like a secure open dialog (where the OS handles the open dialog and gives the app access to only user-selected files) and an easy-to-use privilege separation API (to make it easier to take advantage of the sandbox); the result is much more advanced than anything mainstream in Windows or Linux. Lion will also get rid of previous limitations on DEP and ASLR; in particular, it randomizes dyld.

The article also seriously underestimates the benefit of the centralized App Store model (which has an equivalent in Linux, but not Windows); despite all the horrible rejections and review issues, if it becomes the usual way to obtain Mac applications, it will greatly reduce the chance that users will come into contact with malware.

Re: OS X – Safe, yet horribly insecure

#6

Post by X-Istence »

> The Unix Design is significantly less granular than that of Windows, not even having a basic ACL. The UNIX design came from a time when security was less of an issue and not taken as seriously as it did, and so does the job adequately. Windows NT (and later OSes) were actually designed with security in mind and this shows.

This comparison doesn't even make sense, comparing a decades old UNIX design to a comparatively newly designed OS (Windows NT). POSIX permissions have stood the test of time for a long time and by far were much better than what was available in Windows for the longest time. Off course Windows NT has improved on what was available at the time.

That being said, Mac OS X since 10.4 has had ACL, so that argument goes right out of the window. ACL's are enabled by default and they function as designed.

  touch testing
  chmod 700
  chmod +a "otheruser allow delete"
  
  su - otheruser
  ls -lahe testing
  rm testing
> They often share vulnerabilities with core libraries in other UNIX like systems with samba and java being two examples.

That is because they use that exact open source software. This is a simple no shit sherlock kind of deal. Luckily those are going away and won't be in Lion. Java will be an extra download, like Adobe Flash and Samba won't be included by default because of the GPLv3.

Apple's policy regarding third-party software vulnerabilities could definitely be improved, and they already have, but it could still be better. Ultimately many of the third party tools they ship are never used by consumers and even though they may be exploitable they aren't accessible to an attacker (looking at you PHP ...)

> They are extremely difficult to deal with when trying to report a vulnerability, seemingly not having qualified people to accept such reports. Even if they do manage to accept a report and acknowledge the importance of an issue they can take anywhere from months to a year to actually fix it properly.

This has been fixed recently, they have a new head of security [1] and have increasingly shown that they are getting faster at closing bugs and bringing out updates to fix issues. Look at the Pwn2Own contest iPhone bug, Apple was notified and an update was made available that fixed only that one flaw.

Do I think they are doing the best of job? No, MSFT has them beat by a mile with their security response team (really impressive), however the above sentence makes it sound like this is still the case which is no longer true.

--

It is a pretty good article in that it shows that there are certain issues that Apple could definitely improve upon, but completely ignoring any development to OS X for the past couple of years doesn't look good at all especially when the flaws you are attempting to point out have already been fixed.

[1] http://threatpost.com/en_us/blogs/apple-hires-new-security-c...

Re: OS X – Safe, yet horribly insecure

#7

Post by epistasis »

>Personally for me, malware is a minor threat with the impact being negligible as long as you follow basic security practices and can recognize when something looks out of place.

Likewise, with proper security knowledge, the holes that Apple leaves unpatched for months are "minor threats." For example, disabling Java in the web browser when there's a known vulnerability. It's an inconvenience, but so is having to always be on the watchout for things that are out of place.

Apple is not fantastic on security, but they are good enough for the current threat level, as long as you take basic security precautions.

Re: OS X – Safe, yet horribly insecure

#10

Post by crag »

First, the author is right. Except his article is a boring read; repeating himself over and over and over and over again.

Yeah, I get that OSX is not secure. Now move on and tell me why.

In short, I wish the author would not write like a lawyer (unless of course he IS a lawyer).

Post reply on HN