Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OS X – Safe, yet horribly insecure

allthatiswrong.wordpress.com

Post reply on HN
Print view View original

71–80 of 134 posts

Re: OS X – Safe, yet horribly insecure

#71

Post by uriel »

Lexarius wrote: post #65
Goladus wrote: post #57

Earlier quoted context omitted.

One example: given a file, you can create several different access levels. One group can be read-only, one group can have read and write but NOT delete, one group might only be able to modify permissions, and one group might have full access to the file, while "EVERYONE" has no access at all. Administrators, incidentally, need not have access beyond "take ownership" which is an obvious and easily-audited action. Thes…

The old standard file permission system is the default on most unixy systems because it's easy to use and understand (more or less). That doesn't mean these systems don't have ACLs. http://linux.die.net/man/5/acl

> The old standard file permission system is the default on most unixy systems because it's easy to use and understand

And that is exactly what makes it more secure than ACLs which are extremely complex and unwieldy to setup and manage.

Re: OS X – Safe, yet horribly insecure

#72

Post by seanp2k »

tres wrote: post #58
vogonj wrote: post #41

Earlier quoted context omitted.

As an engineer (though admittedly one at Microsoft), Steve Jobs seems like he'd be a /horrible/ boss. All appearances suggest that he doesn't care about good engineering, but rather that he cares about good user experience, damn the torpedoes.

This statement reveals so much about what's wrong with Microsoft... Good engineering is good user experience.

Good UX engineering is good UX engineering. Software engineering / architecture / development in general is not necessarily the same.

An app can be beautifully engineered by have an awful UX. The inverse is less likely to be true (because bugs and obvious flaws like long delays and unresponsive UIs can quickly degrade UX), but still possible.

Re: OS X – Safe, yet horribly insecure

#73

Post by seabee »

X-Istence wrote: post #6

> The Unix Design is significantly less granular than that of Windows, not even having a basic ACL. The UNIX design came from a time when security was less of an issue and not taken as seriously as it did, and so does the job adequately. Windows NT (and later OSes) were actually designed with security in mind and this shows. This comparison doesn't even make sense, comparing a decades old UNIX design to a comparative…

"[Unix permissions] were much better than what was available in Windows for the longest time"? Try DOS. Windows 1.0 - Me were never multi-user operating systems, which was largely the purpose of having permissions, until the world realised just what a mistake it is to have full, unguarded permission to your system files.

MS's first multi-user OS was Windows NT in 1993, which shipped with ACLs.

Re: OS X – Safe, yet horribly insecure

#74

Post by seanp2k »

vogonj wrote: post #62
xtreegold wrote: post #60

Earlier quoted context omitted.

Ballmer certainly looks like a great boss, having great care for good engineering practices such as yelling, throwing chairs at people and being generally obnoxious. Also, user experience is a part of good engineering.

Steve Jobs certainly looks like a great boss, calling the entire MobileMe team into an all-hands and asking them point blank why the fuck their software doesn't work. http://news.softpedia.com/news/Steve-Jobs-Not-Shy-of-Using-t... we can both play this game all day. user experience is indeed a part of good engineering, but it's not the be-all and end-all, and eventually you will /always/ run into a place where you mu…

>"and there's no good way to do it seamlessly yet."

Right. There are ways to do it, but not any /good/ ones. Good here meaning "while still letting the software execute efficiently and without a ton of added complexity"

Re: OS X – Safe, yet horribly insecure

#75

Post by cageface »

tres wrote: post #58
vogonj wrote: post #41

Earlier quoted context omitted.

As an engineer (though admittedly one at Microsoft), Steve Jobs seems like he'd be a /horrible/ boss. All appearances suggest that he doesn't care about good engineering, but rather that he cares about good user experience, damn the torpedoes.

This statement reveals so much about what's wrong with Microsoft... Good engineering is good user experience.

So many of Google's products prove the contrary.

Re: OS X – Safe, yet horribly insecure

#76

Post by seanp2k »

davidu wrote: post #37

This is actually just the tip of the iceberg for OS X vulnerabilities. On the enterprise side, it's much much worse. AFP is heinous. Their kerberos implementations are painful. They actually have checkboxes in OS X server config screens that say: "Prevent man in the middle attacks? Yes or No?"

We have some colocation clients who have a full cab of all XServes and Mac Pros (with OSX Server installed). One time, I asked what they run with all of that. They said "Ooh, we needed it to run Tomcat". Uhh....

I don't really understand the point of OSX Server beyond possibly render farms (for music / movies)

Re: OS X – Safe, yet horribly insecure

#78

Post by w1nk »

X-Istence wrote: post #50
vogonj wrote: post #49

Earlier quoted context omitted.

your Windows clients are probably using NTLM (or NTLMv2), Microsoft's old, terrible auth protocol that the Windows team eventually abandoned for Kerberos. there are policy settings you can change to force Kerberos; I'd suggest Googling to see if you can find them, and see if it breaks your Windows clients as bad as your OS X clients seem to be.

I had not thought about that, would OS X fall back to using that in case Kerberos doesn't function? Thanks for the suggestion!

You should also check the clocks on all the machines involved. Kerberos is quite finicky when the time between machines starts drifting.

Re: OS X – Safe, yet horribly insecure

#79

Post by hackermom »

gonzo wrote: post #54
zdw wrote: post #2

They often share vulnerabilities with core libraries in other UNIX like systems with samba and java being two examples. Good thing that Lion jettisons both (Samba for going GPLv3, and Java is non-core download) The firewall functionality in OS X is impressive, but hardly utilized. The underlying technology is ipfw Also changed in Lion, which now uses OpenBSD's pf. Apple doesn't make much more use of it though. It has…

OpenBSD's pf? I highly doubt that Jordan Hubbard took the OpenBSD tree's variant. More likely it came directly from FreeBSD. (Yes, I know that 'pf' started on OpenBSD.)

Your parentheses seem to imply that the OpenBSD team only started PF, and then let go of development, which isn't the case at all. The OpenBSD team is still the lead developer of PF, and FreeBSD sources changes from "The Source". To the best of my knowledge, there are no notable PF forks around from which the OpenBSD team can, or ever have sourced changes from, but I'd be happy to learn otherwise if you have any accounts to share.

Re: OS X – Safe, yet horribly insecure

#80

Post by zdw »

gonzo wrote: post #54
zdw wrote: post #2

They often share vulnerabilities with core libraries in other UNIX like systems with samba and java being two examples. Good thing that Lion jettisons both (Samba for going GPLv3, and Java is non-core download) The firewall functionality in OS X is impressive, but hardly utilized. The underlying technology is ipfw Also changed in Lion, which now uses OpenBSD's pf. Apple doesn't make much more use of it though. It has…

OpenBSD's pf? I highly doubt that Jordan Hubbard took the OpenBSD tree's variant. More likely it came directly from FreeBSD. (Yes, I know that 'pf' started on OpenBSD.)

Ah, so they get a version that is several years out of date, and uses a slightly different syntax... great.
Post reply on HN