What is Digg?Sponsored by Guitar Center
When Heavy-handed Hints Fail--Guitar Center Wishlist Posters view!
guitarcenter.com - Cool personalized designs send a friendly reminder that a new Stratocaster would rock, thanks.
86 Comments
- runeasgar, on 10/25/2007, -3/+33People are amusing. Windows has plenty of security vulnerabilities, so does OS X. Unix, however, does do an overall better job at security than Windows, that gives OS X an advantage. OS X is not secure solely because it is obscure, it is secure because it is designed that way on an industry-standard secure technology.
- rebotfc, on 10/25/2007, -5/+24Very informative article not just on OSX but security vulnerabilities in general and the technologies used to prevent exploits.
- doctorfungi, on 10/25/2007, -2/+20What's weird about Leopard is that I've never spend more than 30 minutes on a Mac mucking around in Garage Band... yet something makes me want to try Leopard, and I'm really looking forward to "taking it for a spin".
- Ireland, on 10/25/2007, -6/+22It's great that Apple still takes security very seriously, making it better while there are still no viruses.
- blackhydra, on 10/25/2007, -16/+32Digg me down.
- sholt, on 10/25/2007, -1/+12Ahhh.. library randomization.
It's about time! - neodorian, on 10/24/2007, -2/+12Maybe true and that's good on Vista, but it's also good that Leopard is getting these features. OSX is not my platform of choice but there's nothing wrong with things generally getting more secure out there.
- kabitoSDMF, on 10/24/2007, -0/+9Have you never seen Independence Day? Any human with a cigar and a spaceship can fly into your laser guarded home and install a virus with a 3.5" floppy disc. And the alien's entire home WAS wireless, so Leopard has you covered either way.
- andnever, on 10/25/2007, -3/+11i guess AGAIN i am forced to ask where in the article it says os x had it first. infact if im not mistaken i believe that it actually mentions vista having it at one point and since vista was out first that would also imply it had it first wouldnt it. this article is how leopard will improve security from those using TIGER.
/rant - chrysrobyn, on 10/24/2007, -4/+11@Happy_Phantom:"Guess what? Vista had ALL these features first"
Really?! That's awesome! In all my reading about Vista, I never found the automatic versioning control (Time Machine). That would save a whole lot of people a whole lot of effort (and their asses). Guest Account scrubbing is another great feature -- I've seen third party apps for older revs of Windows, but didn't know Vista included it. That's a great boon for internet cafes or anybody who has kids with friends who come over. If Vista has those features, maybe it's worth another look. - inactive, on 10/25/2007, -12/+18Yawn, people still actually believe this? Mac laptop sales are near 20% of the market. Your argument is old and flawed. OS X is inherently more secure than Windows. Why assume the amount of viruses would scale linearly with the amount of users? It won't.
- ianweir, on 10/24/2007, -1/+7Nobody said they were new, only that they were new in leopard. And regardless of who had it first, it's still a good thing that more computers are getting features such as these.
A chain is only as strong as its weakest link, so if one of the computers on your network is compromised, you could be in a world of hurt no matter what OS it is running. - inexplicable, on 10/24/2007, -1/+7I'm amazed this argument still gets wheeled out. Have a look here (http://www.apple.com/pr/library/2007/10/22results. ... and tell me if you think there's no incentive to make MalWare for Mac.
By your logic most major mobile phone OS's would be riddled with Spyware and worse by now. And how does a user 'punch a hole' - install a virus? Create a buffer overflow. Windows is insecure out of the box. No punching needed. - totorototoro, on 10/24/2007, -6/+12Feel free to DIGG all the Vista articles touting its security features. Try to avoid your kneejerk "VISTA YADDA YADDA" in any article about OSX.
- superspud, on 10/24/2007, -1/+6But wouldn't you think, being the first writer of a zero-day worm or virus on OS X would carry much kudos?
There are 1.17 billion people connected to the Internet worldwide. Saying Apple as a share of 5% means 50 million Macs are connected to the Internet. Are you seriously telling me a group of two or three guys couldn't come together and make a virus or worm, that has the ability to infect over 50 million computers? - inactive, on 10/24/2007, -0/+5garage band is a lot of fun, even if you are just playing with it. Makes it really easy to put together a beat/song
- huskerdude, on 10/25/2007, -7/+12I must have missed the part in the article where the author claimed that Leopard was the first OS to have these features. Your life must be pretty small if you feel the need to attack a friggin operating system.
- yabos, on 10/24/2007, -0/+4iPhone runs as root, Macs do not(unless you're an idiot).
- HerrEisenheim, on 10/24/2007, -1/+5Not these days. Todays viruses are all about exploiting the system—so they can turn it into a spam zombie. Why buy servers and pay for bandwidth for your ***** spam site when you can just offload it to unsecured boxes all over the world?
- dmurphy, on 10/25/2007, -1/+4"Encrypted disk images now use 256-bit keys instead of 128-bit keys (much more than twice as strong)"
Much more than twice? wouldn't a 129-bit key be twice as strong? isn't 256-bit 2^128 times stronger? I guess technically that is more than twice... - superkendall, on 10/24/2007, -1/+4If you'd read the article on Time Machine from Apple Insider, you'd know how little "Shadow Copy" and Time Machine have to do with each other.
- andnever, on 10/24/2007, -2/+5Windows Vista is now unquestionably the most secure OS on the market
HAHAHAHAHAHAHAHAHAHAH..........
anyone else think that was funny? - runeasgar, on 10/24/2007, -1/+4Apple is just a wee bit behind -- so was XP until Vista was released. It's the inevitable flow of the market. Company A pushes forward, then B, then A again, then B again.. I think we can all agree that Leopard is going to push much farther forward than Vista did, however, and Microsoft won't have another OS until 2010. Apple will have another in ~2 years.
- yabos, on 10/24/2007, -1/+4Disk Utility calls it 256 bit AES
- AfterTen, on 10/24/2007, -0/+3That's cool. Is there a way to tell which executables are ASLR enabled?
- Boondoggle, on 10/24/2007, -0/+2"first, 256-bit rijndael encryption is NOT AES. AES is the advanced encryption standard and is defined as a limitation of rijndael. specifically, it is rijndael with a 128 bit key. the second you start using a larger key, you are no longer using AES. "
You are being really picky. Because the article does not call it 256-bit AES. It refers to 128-bit AES. And Apple calling it 256-bit AES may not be strictly correct, but it makes sense from a marketing perspective. IT IS THE SAME ALGORITHM, WITH A BIGGER KEY.
From the article: "Encrypted disk images now use 256-bit keys instead of 128-bit keys (much more than twice as strong), and although I don't know anyone who can break a 128-bit key, thanks to the way AES functions, performance should be essentially unaffected."
As far as the other items go, they all provide aditionall hurdles that malicous code writers have to overcome. Not perfect, but they come with very little penalty in terms of performance.
And as others have pointed out, the article does not state ANYWHERE that these are measures that have not been around on other systems for some time. - Dweller99, on 10/24/2007, -0/+2"Your life must be pretty small if you feel the need to attack a friggin operating system."
Hasn't that basically been the foundation of Apple's entire marketing strategy for the last few years? They seem to be moving away from it finally, but for a long time I heard more about what windows did wrong than I ever heard about what Mac did right. - Braingoo, on 10/24/2007, -0/+2No I mean open to the user security wise.
- drlha, on 10/24/2007, -1/+3In what way is Windows a more open system than Mac OS X exactly? If anything its the other way around, a great deal of the core Mac OS X functionality is open source.
- Firehed, on 10/24/2007, -0/+2No more or less closed than Windows. If you're not a developer, you don't have access to the source code.
- ozydingo, on 10/24/2007, -2/+4New code in Leopard:
if(openFileRequest.name == "NakedPictures.jpg.exe") {
message("You are a dumbass!!!");
crash();
} - runeasgar, on 10/24/2007, -0/+2The opinion of one person is hardly "absolute truth". Vulnerability is also (very) subjective. There's a difference between forensically trying to obtain data from a computer and trying to exploit a computer to execute malicious code.
- MioTheGreat, on 10/24/2007, -3/+5You mean Volume Shadow Copy? Windows has had it since Server 2003. Right Click -> Restore Previous Versions.
- drlha, on 10/24/2007, -1/+3The operating system for allowing the user to run such an obvious trojan?
- MioTheGreat, on 10/24/2007, -0/+2Vista comes with the OS files secured by ASLR, but any 3rd party apps benefit from it to. They just have to recompile it with the latest visual c++ compiler.
/dynamicbase is enabled by default in Visual Studio 2008. - screwzluse, on 10/24/2007, -5/+7It's the same expectation I have for seeing Apple fans in Vista articles.
- FKnight, on 10/25/2007, -0/+1huh?
- natenovs, on 10/24/2007, -1/+2it is up to the compiler of the executable to decide if the program will be ASLR. it is achieved by setting a bit in the PE header field DLLCHARACTERISTICS. if the program is compiled in visual studio, the buld option /dynamicbase will give it address space randomization.
here's how it works in vista:
"While loading an image that has elected to participate in ASLR, the system uses a random global image offset. This offset is selected once per reboot, although weve uncovered at least one other way to cause this offset to be reset without a reboot (see Appendix II). The image offset is selected from a range of 256 values and is 64 KB aligned. The offset and the other random parameters are generated pseudo-randomly [3]. All images loaded together into a processincluding the main executable and DLLsare loaded one after another at this offset. Because image offsets are constant across all processes, a DLL that is shared between processes can be loaded at the same address in all processes for efficiency. When executing a program whose image has been marked for ASLR, the memory layout of the process is further randomized by placing the thread stack and the process heaps randomly. The stack address is selected first. The stack region is selected from a range of 32 possible locations, each separated by 64 KB or 256 KB (depending on the STACK_SIZE setting). Once the stack has been placed, the initial stack pointer is further randomized by a random decremental amount. The initial offset is selected to be up to half a page (2,048 bytes), but is limited to naturally aligned addresses (4-byte alignment on IA32 and 16-byte alignment on IA64). The choices result in an initial stack pointer chosen from one of 16,384 possible values on an IA32 system. Once the stack address has been selected, the process heaps are selected. Each heap is allocated from a range of 32 different locations, each separated by 64 KB. The location of the first heap must be chosen to avoid the previously placed stack, and each of the heaps following must be allocated to avoid those that come before. The address of an operating system structure known as the Process Environment Block (PEB) is also selected randomly. The PEB randomization feature was introduced earlier in Windows XP SP2 and Windows 2003 SP1, and is also present in Windows Vista. Although implemented separately, it is also a form of address space randomization; but unlike the other ASLR features, PEB randomization occurs whether or not the executable being loaded elected to use the ASLR feature. An important result of the ASLR design in Windows Vista is that some address space layout parameters, such as PEB, stack, and heap locations, are selected once per program execution. Other parameters, such a the location of the program code, data segment, BSS segment, and libraries, change only between reboots." - Firehed, on 10/24/2007, -0/+1An OS can only be as secure as it's users allow it to be. You could be running a block of wood and still get it infected if you've got a dumb enough user. Larger market share translates to more dumb users, not to mention the lower entry price (smarter people tend to make more money). The basic security features are irrelevant as soon as you introduce humans into the equation.
- Boondoggle, on 10/24/2007, -0/+1Encryption is used to protect data in the event as system is compromised or seized, or when restricting access is not fully feasible for any number of reasons. It is a viable security option. Hence it is in the article.
Many people know this, including many mac users.
Why don't you ? Not as smart as a Mactard, are you sonny? - Ramble, on 10/24/2007, -0/+1Just core system files I believe. I'm sure there's some videos on channel9 from some kernel dude who implemented ASLR if you wanted to know more.
- datdamonfoo, on 10/24/2007, -1/+2And wasn't it odd that OS X had things that Windows 95 had years before them?
- threemagic, on 10/24/2007, -1/+2Why did him down? He's right...
He never said OpenSuse was more elegant or polished or that there are even any apps for it, he just merely stated the truth. - FKnight, on 10/25/2007, -0/+1Generally, people who are used to working with Windows don't understand that the reason "Time Machine" is a big deal and "Volume Shadow Copy" is not is because Volume Shadow Copy is not approachable by an end user because the concepts, GUI, and the way it works are IT-esque concepts. An end-user has to have a few hours of IT-101 to use VSS effectively. My grandmother can use Time Machine. There are Windows users who will disagree with me and say that VSS is easy to use, but I would bet every single one of them works in IT. The Wintel side of things really doesn't have a solid concept of ease-of-use or approachability.
Additionally, Volume Shadow Copy sucks because it is NOT automatic versioning control. It takes /scheduled snapshots/. If you change a file 20 times between noon and 6PM and the shadow copy snapshots happen at 6AM, the 6AM copy is what you're getting, sorry.
So, the reason "Time Machine" is a big deal is because it's actually usable by an end-user without having to take a class on volumes and snapshots from their "IT guy friend". And the reason it's better than VSS is because it's actual version control. - andnever, on 10/25/2007, -1/+2aw whats that? youre sad because os x wont let you call the superuser?
- inactive, on 10/31/2007, -1/+1I was careful to say Windows Vista and not Windows XP. Point out one incident of a worm out brake that has defeated Vista since its release. You can't.
- MioTheGreat, on 10/24/2007, -1/+1And? The vast majority of Malware exists for Windows thanks to the default user privledge levels. That was fixed with Vista. Now, in order for malware to successfully install, the user has to do it. It can't come in through any backdoor in their email client or web browser, or something.
The kind of malware that Windows is now vulnerable to is the kind that can run without Admin privledges. And guess what? Linux and OSX are vulnerable to that same kind to no smaller degree than Windows (Actually, perhaps slightly more, since to my knowledge, OSX or the Window managers in Linux don't implement anything like UIPI) - natenovs, on 10/25/2007, -1/+1oh my god. its a ***** right click on a file. if you cant handle that then stop using a computer.
- MioTheGreat, on 10/24/2007, -3/+3How they actually install is generally through user stupidity more than actually exploiting some flaw in the system, though. I mean, if you get an email, and run NakedPictures.jpg.exe, who is to blame?
- ozydingo, on 10/24/2007, -1/+1I don't think he was talking about open/closed source when he said open / closed.
-
Show 51 - 86 of 86 discussions
© Digg Inc. 2009
— Content created and posted by Digg users is