Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×

Call for Apple Security 'Czar' 254

Posted by Zonk from the i-imagine-a-guy-with-a-stogie dept.
conq writes "The second security non-incident to hit the Mac platform in as many weeks has been debunked. People are talking a lot about security on the Mac these days, and the result is that a great deal of FUD is being spread around. BusinessWeek's latest Byte of The Apple column suggests that its time for Apple to appoint a security Czar to get out ahead of the FUD before it spreads much more." From the article: "Creating a CSO position may be viewed by some as an admission of weakness. Still, I say it would be a good way for Apple to inoculate itself against the perception -- warranted or not -- that Mac security may be eroding, and get ahead of the curve for any troubles that may be inevitable. That may not be the case, but in matters related to product marketing, it's the public perception, not the reality that really matters. And once you've lost a user's confidence, it's hard to get it back. Just ask Microsoft."
This discussion has been archived. No new comments can be posted.

Call for Apple Security 'Czar' More

Call for Apple Security 'Czar'

Comments Filter:

  • Chief Security Officer? (Score:5, Funny)

    by WinkyN ( 263806 ) on Thursday March 09, 2006 @01:30PM (#14883877) Homepage
    A chief security officer? Why did an image of Lt. Worf just pop in my mind?

    • Re:Chief Security Officer? (Score:5, Funny)

      by Anonymous Coward on Thursday March 09, 2006 @01:39PM (#14883951)
      I am not a merry man.

    • Re:Chief Security Officer? (Score:5, Funny)

      by Anonymous Monkey ( 795756 ) on Thursday March 09, 2006 @01:41PM (#14883971)
      Wow, I can imagine the next AV Package, Norton Warf. It would need to have a fire wall capable of striking back on its own (A Klingon would never let an aggressor stand), automatic redundant backups (Klingons have backup organs), and a tendency to talk back if you do something stupid (If you had any honor you would never even think of using Bonsai Buddy).

      • Re:Chief Security Officer? (Score:3, Funny)

        by Anonymous Coward
        ...and a tendency to talk back if you do something stupid (If you had any honor you would never even think of using Bonsai Buddy).

        He he he... The other day I was talking to a young woman who'd just got a Mac and set her download directory to "Applications" so that anything she downloads is automatically installed. She said it made it easier to use the computer.

        User ignorance is still the biggest threat.

    • Sounds like a PR or Legal issue, not a security. (Score:5, Insightful)

      by team99parody ( 880782 ) on Thursday March 09, 2006 @01:46PM (#14884019) Homepage
      "The second security non-incident to hit the Mac platform in as many weeks has been debunked."

      Sounds to me they need to hire someone with appropiate skills in either their PR or Legal departments.

      Two non-security incidents in a month almost certainly mean that they're the victim of a FUD campaign.

      The right way to answer that is not to validate the fud, but

      1. ... communicate the truth - which is a function of PR, and
      2. ... make sure no-one's illegally slandering their trademark -which is a function of legal.
      The latter is far more dangerous to Apple than the hypothetical security non-issues a CSO could address.

      • Apple's recent security update patched 20 holes (Score:5, Insightful)

        by I'm Don Giovanni ( 598558 ) on Thursday March 09, 2006 @02:23PM (#14884333)
        How do you expect Apple to dismiss security reports as "a FUD campaign" to be fought with PR when they just released a security update that patched 20 holes and in 2005 released security updates nearly every month [apple.com] (nearly as often as Microsoft)? Apple didn't have to release any from Dec 2005-Feb2006, but the massive March 2006 Security Update makes up for those three months. ;-))

        Apple needs to treat their holes as real problems, not just as a PR problem. And they're actually doing just that by releasing fixes and not spouting PR. Spouting PR would only make them a bigger target for hackers, just as appointing a "Security Czar" would. The latter would also undermine confidence of the general public ("If Mac is so secure, why do they need a 'Security Czar'?")

    • Would it be like the Maytag repair man? (Score:3, Funny)

      by Anonymous Coward
      Worf sits bored and alone in his corner office:

      Worf: "This job gives me an intense feeling of Gardachk! I think I'll kill one of the developers at our next hackeysack battle."
    • After all, the top secret Apple/Novell skunk works project to show MacOS runing on Intel ('486) was code named "Star Trek". They actually had Finder running and had ported QuickDraw GX and QuickTime by the end of 1992; however when Sculley left and Spindler came in, they turned to the PowerPC instead.
    • Why did an image of Lt. Worf just pop in my mind?

      Because you're too young to recall Lt. Sulu as the security chief in the alternate universe.

  • The importance of user confidence (Score:5, Informative)

    by FuzzyDaddy ( 584528 ) on Thursday March 09, 2006 @01:31PM (#14883882) Journal
    And once you've lost a user's confidence, it's hard to get it back. Just ask Microsoft

    And yet, they still seem to be doing OK.

    • Microsoft is doing well only through inertia; if their product lines start to peter out, get passed by Linux or something else, the crash will be severe and short. Why do you think BG is trying so hard to keep Linux in a box? He knows that if it ever becomes as easy to use as Windows (try not to laugh) for the average user, they will run away from Windows in droves, driven by the desire to not pay so much for their software and support.
      • While I don't disagree with you necessarily, I'd like to point out that that statement could have been cut an pasted from a post 6 years ago. And has yet to happen.
        • While I don't disagree with you necessarily, I'd like to point out that that statement could have been cut an pasted from a post 6 years ago. And has yet to happen.

          Actually, while that statement seems like an informed comment, it is not.
          No one could have claimed that any Linux desktop of 6 years ago was just as good as the Windows desktops of the period.

          I've been running Linux for eight years, and it was JUST 6 years ago, on July 12, 1998, that KDE 1.0 was release. KDE 1.0 was the best desktop GUI availabl

          • HOWEVER, as lot has happened in the last 6 years. Right now I am running SymplyMEPIS-3.4.3 with KDE 3.50 on my Gateway m675prr laptop. KDE 3.5 is, IMO, more powerful, flexible and easier to use than Microsoft's aging XP.

            no, it isn't. Let's look at KDE alone, disregarding all the complications due to the distro fascism.
            KDE is utterly complicated, overpersonalizable, at the point that when you have to set something, you spend a considerable amount of time looking for the desired option diluited in a mayhem of
    • Right -- my other thought at seeing this was, "Microsoft lost user confidence due to FUD?"
    • >And once you've lost a user's confidence, it's hard to get it back. Just ask Microsoft
      And yet, they still seem to be doing OK.

      Do you mean in terms of security or money? If you are talking about security, given the attitudes toward MS on this forum, I'm surprised you weren't moded up to '+5 Funny' for that comment. Personally I wouldn't exactly call Windows Security 'OK' (as in security provided by Microsoft, out of the box, after patching and with native tools only no third party software), perhaps in a

  • I'm concerned (Score:5, Funny)

    by SpaceAdmiral ( 869318 ) on Thursday March 09, 2006 @01:32PM (#14883887) Homepage
    I'm concerned about the security on my new Intel iMac. Do any helpful /.ers want a SSH login on my machine so that they can take a look and tell me if it's secure?

  • Nominate Slashdot as the Apple CSO (Score:3, Funny)

    by drrck ( 959788 ) on Thursday March 09, 2006 @01:32PM (#14883894)
    Probably would work just as well to link to ever slashdot argu^^^^discussion on Apple's security issues.

  • Public confidence? (Score:5, Insightful)

    by 4doorGL ( 591467 ) on Thursday March 09, 2006 @01:33PM (#14883898) Homepage
    To maintain public confidence in its operating system, Jobs & Co. should consider hiring a security czar

    Huh? Most of the "public" I know doesn't have any lack of confidence in OS X and hasn't even heard all the latest "scares" of OS X's security. In fact, I'd venture to guess that most of the "public" knows nothing about OS X being more secure than Windows (as it isn't really an advertised fact) and think that viruses/trojans/worms, etc, are just a part of computing.

    • Re:Public confidence? (Score:5, Insightful)

      by PitaBred ( 632671 ) <slashdot&pitabred,dyndns,org> on Thursday March 09, 2006 @01:36PM (#14883923) Homepage
      But the geeks have, and the geeks tell the "public" about these things. My parents and family take my word about tech as gospel, essentially. They know I care about that stuff, they don't, and that I'm going to try to do the best for them that I can with advising that. If I think Macs are insecure (I don't, at least not compared to Windows), that's a lot of people that might have bought them that won't now.
      • Not sure it'd matter even then. Geeks like me who use OS X would be sure to get to the bottom of these security "scares" in the interest of self-security. And MS geeks prolly wouldn't think of recommending a Mac in the first place. So I suppose the only people affected are Linux geeks, who might have been inclined to mention the Mac. Yes, that was major generalization, but at least mostly true.

    • Re:Public confidence? (Score:4, Insightful)

      by Golias ( 176380 ) on Thursday March 09, 2006 @01:41PM (#14883970)
      The whole idea makes no sense at all.

      What they seemed to just say, in a nutshell:

      "Apple should create a executive position to serve as a figurehead in charge of security. Doing so will create the perception that Apple's shit is not as secure as it used to be, but is needed to maintain the perception that it's still as secure as it used to be."

      So, if they don't hire somebody like that, confidence in their security will erode.

      But if they do hire somebody like that, confidence in their security will erode.

      Here's a thought: Why not just keep putting out an OS which is vastly more secure than Windows? As a customer, I've been pretty happy with that strategy so far.

    • Re:Public confidence? (Score:5, Funny)

      by Midnight Thunder ( 17205 ) on Thursday March 09, 2006 @02:14PM (#14884263) Homepage Journal
      Huh? Most of the "public" I know doesn't have any lack of confidence in OS X and hasn't even heard all the latest "scares" of OS X's security.

      What is OS X? Should it effect me? ;)

  • Just ask Microsoft???? (Score:3, Interesting)

    by WindBourne ( 631190 ) on Thursday March 09, 2006 @01:33PM (#14883900) Journal
    that is funny. The reason why you can not trust MS is because they have loads of security issues. With Apple they have been overall secure. What I find funny is that a column would call for them to go through the hoops that MS does now, rather than simply staying the same course that has worked well for mainframes, other *nixs, and all the trusted systems that they gov. uses today.

  • Not a bad idea, (Score:5, Interesting)

    by Hawthorne01 ( 575586 ) on Thursday March 09, 2006 @01:34PM (#14883906)
    Especially if the appointee is a highly-visible and respected switcher to OSX from the open-source community.

    If nothing else, it'll start an effective and accurate comparison of the state of security between OSX and Winodws, a feature of OSX that Apple has not stressed as much in their ads as they should.
    • No - its a terrible idea - Apple's gained a good reputation from its User base doing all the advertising for them for free....

      Appointing a 'Security Czar' would move all these low key (outside of the /. and mac fanboy community) security rumblings onto the front page of real media. Joe public, who's never heard security and apple in the same sentence before will suddenly get the idea that Apple is no more secure then windows (after all they both need CSOs).

      It's a terrible idea, Apple should continue to let
    • comparison of the state of security between OSX and Winodws,

      Yeah, and who said OSX has to be compared to Windows ? Who says that OSX has to "defend" itself as in "just ask Microsoft" ? Microsoft is not trusted because their software has "earned" this mistrust. OSX's so called security issues have mostly turned out to be fud^2. Yes, we know crowds don't understand and don't want to understand unix vs windows architecture differences, they need to see "comparisons" and security "studies" performed by "inde

  • They recently hired on the FreeBSD CSO (Score:5, Interesting)

    by ninja_assault_kitten ( 883141 ) on Thursday March 09, 2006 @01:35PM (#14883912)
    Jacques A. Vidrine was recently hired on (leaving Verio) and now holds a high level position in the Apple Information Security. Jacques was the former FreeBSD Security Officer

  • It's just how you handle the marketing (Score:5, Funny)

    by sprior ( 249994 ) on Thursday March 09, 2006 @01:35PM (#14883913) Homepage
    "Creating a CSO position may be viewed by some as an admission of weakness." - Not if they market the position like the Maytag Repair Guy...

  • Just ask Microsoft (Score:5, Insightful)

    by gEvil (beta) ( 945888 ) on Thursday March 09, 2006 @01:36PM (#14883918)
    Remember that to the average luser, anything made by Microsoft is top-notch. If it weren't, they wouldn't be in the position they're in market-wise. It's all those damn "hackers" out there that cause the problems, not Microsoft.

  • Biased poster (Score:3, Insightful)

    by Anonymous Coward on Thursday March 09, 2006 @01:36PM (#14883920)
    It's not FUD if the vulnerabilities are real. The fact that not many machines were affected is not relevant. With only 3% of the OS market - I wouldn't expect any Apple outbreak to bring down the house. The point is - Mac's are not immune and the sooner people realize it and cast off their false sense of security the better.

  • What is it with the 'Czar' title? (Score:5, Funny)

    by Aspirator ( 862748 ) on Thursday March 09, 2006 @01:39PM (#14883950)
    Why is it we have so many 'Czar' titles nowadays?

    What about other titles for potentates?

    'Chief' 'King' 'Master' 'Commander' 'Lord' .......

  • That's not security, that's marketing (Score:3, Interesting)

    by mmarlett ( 520340 ) on Thursday March 09, 2006 @01:39PM (#14883952)
    It would seem that what the author really wants is for Apple to comment on silly people doing things with Apple computers, which is the job of a marketing person. The marketing person just goes and asks someone authoritative sounding to comment, wraps that in pretty and feeds it to the public. No big deal. And that's certainly not a reason to make a security czar.

  • Perception? (Score:4, Insightful)

    by hackstraw ( 262471 ) * on Thursday March 09, 2006 @01:40PM (#14883953)
    it's the public perception, not the reality that really matters.

    OK, then everybody else can stick to the illusion of security with Windows despite reality, and I'll be happy in the reality of my secure OS X machines.

    OS X is not 100% secure, but out of the box, its about as secure as any system can be that has a network adaptor in it. Try this on your average box:

    netstat -an |grep -i listen
    tcp4 0 0 127.0.0.1.631 NOT JUNK LISTEN
    tcp4 0 0 127.0.0.1.1033 NOT JUNK LISTEN

    Go ahead, break into 127.0.0.1. I dare you.

    Please use fewer junk characters OK Please use fewer junk characters OK Please use fewer junk characters OK Please use fewer junk characters OK Please use fewer junk characters OK Please use fewer junk characters OK
  • ...just because it hasn't happened yet (in the field, as it were), doesn't mean it won't happen. Apple would do better looking like they're on top of it even if it does appear to be non-event. There is no such thing as a secure system.
  • Ok. Lame. I think that the major attack on mac is that, as more people use it, it becomes less obscure, so people might actually target it for attack, not that the software is becoming less secure.

    It is notable that microkernel OSs offer improved security and such, at the cost of performance. Not being a Mac fanboy, I don't know how true they are to the whole bit.
    • Oh, and that the performance cost isn't usually so bad (and can be non-existant0 so, don't dump a load of threads on me saying I'm wrong.

      The common attack on microkernel OSs is performance.

  • He's not calling for a CSO (Score:4, Insightful)

    by Red Flayer ( 890720 ) on Thursday March 09, 2006 @01:41PM (#14883968) Journal
    This isn't about Mac security, it's about public perception of Mac security. He's calling for a VP of Marketing/Publicity for Security Issues.

    As stated in the article, putting security in the hands of an individual is counter to Apple's philosophy of having security be a priority for everyone.

    I personally think Apple's better off letting third parties defend the FUD; they seem to be doing a swell job with the last two instances. By now, no one in the know doesn't know that the past two were FUD. //sorry for the awkwardness of that sentence)
    Those who aren't in the know didn't even hear about it.

    IMO, we should never ASK a company to add in another layer of publicity and marketing. That's asking to be mislead by slanted information, be it MS, Apple, Google, IBM, or whomever.

  • MS's problem is the reality, not the perception (Score:5, Insightful)

    by mbeckman ( 645148 ) on Thursday March 09, 2006 @01:43PM (#14883988)
    Microsoft's probem isn't the public perception that it has security problems. It's concrete, measurable, reality that thorns their side. It's Microsoft who floated the "Windows get hacked because its a bigger target" fantasy. But you can take a Mac out of the box and scan it and find zero open ports. A Windows machine has more than a dozen. Those ports are open for Bill's benefit, not for the customers'. Bill wants to keep his fingers in every Windows box, and won't give up that capbility in exhange for better security. Yes, the Mac probably still has some OS flaws that hackers could exploit, and thus Apple can't be complacent. But at least Steve isn't holding the door open to let the hacker inside.

  • Wow, talk about an unassailable position (Score:5, Informative)

    by hey! ( 33014 ) on Thursday March 09, 2006 @01:43PM (#14883992) Homepage Journal
    it would be a good way for Apple to inoculate itself against the perception -- warranted or not -- that Mac security may be eroding

    While I agree that every company that sells operating systems should take security seriously, and that having somebody responsible is practically always a prerequisite to being "serious", it's really too bad that people don't seem to absorb a bit more reasoning skill by the time they get out of school.

    Sure, Apple's relatively superior security record "may" erode as they start to gain market share and visibility to the black hats. In fact I'd say there's not much room for it to go other than the direction of erosion. However, we don't have any evidence that that anything like a disaster is about to happen. You can posit that terrible things may happen, and nobody can prove you wrong. You could posit that Steve Jobs is the vanguard of an alien mind-control invasion, and nobody could prove that wrong either. These are the sort of things that can only be proved in an affirmative sense: some researcher finds a vulnerabilityin the Mac OS authentication system, or tentacles suddenly springing from Steve's head.

    Right now I'd say the biggest problem are the Mac user base's overconfidence. While back in the day, Mac users did struggle quite a bit with viruses, which were oh-so-much more interesting to write for the more advanced Mac platform than for DOS, recently, they're getting a bit cocky. They're not as used to the security patch grind as the people running Windows.

  • Security Czar role will fit in well in Apple (Score:5, Funny)

    by dwalsh ( 87765 ) on Thursday March 09, 2006 @01:45PM (#14884011)
    He will be able to work closely with the Quality Emperor. Both ultimately report to the Development Shogun. His office is just down the hall from the Usability Kaiser.

    Every week, they hold a cross group meeting with the Sultan of Marketing, the Sales Duchess, and the Distribution Führer. They all are answerable to the Grand Baron of Charging More for Stuff because it is Shiny (he prefers people call him Tim, for brevity).

  • The wrong perspective. (Score:4, Insightful)

    by keilinw ( 663210 ) * on Thursday March 09, 2006 @01:48PM (#14884044) Homepage Journal
    I've examined and compared the security features of operating systems for many years now and I can tell you one thing for certain. No "useful" operating system is invulnerable... and this includes Mac OS X, regardless of what hardware it is running on.

    Of course, you could argue that it be completely locked down with no keyboard or connection to the Internet, etc... but this would be a completely moot point.

    With this in mind lets consider the overall design of the security subsystem. Apple Mac OS X is much better DESIGNED than Windows in its current state. I won't delve into detail about protected memory, access controls, permissions, default configurations, open ports, etc... but out of the box Mac OS X is more "security minded" that Microsoft's Windows.

    Now, keep in mind that things ARE changing. No matter how much heat Microsoft takes they are still managing to improve the quality of their product. Windows XP is a far superior product (security wise) than was 98 or ME... and it appears that the next version of Windows is even more security conscious.

    In conclusion, people should not "judge" an OS based on the potential for it to have problems... they all will. Mac OS X has enjoyed a reputation for safety that is based on many factors (including having a small market share). However, the bottom line is that it is very "security aware" and has the potential for you to lock it down even more... and this is the right perspective to look at.

    Matt Wong
    http://www.themindofmatthew.com [themindofmatthew.com]

  • We need to defend against scare tactics (Score:5, Funny)

    by cocoamix ( 560647 ) on Thursday March 09, 2006 @01:50PM (#14884064)
    from a group secretly funded by Microsoft who call themselves "OS X Veterans for Truth."

    Pictures of Jane Fonda on her iMac will be forthcoming.
  • The second challenge debunks nothing. One challenge gave shell access, the other didn't. Only one of those actually ended up demonstrating a result.

    Not to mention that the second challenge was pulled early, and not that I expect someone to give away a remote shell exploit for free to prove a point.

    • Re:Debunked? (Score:4, Insightful)

      by 99BottlesOfBeerInMyF ( 813746 ) on Thursday March 09, 2006 @02:32PM (#14884385)

      The second challenge debunks nothing. One challenge gave shell access, the other didn't.

      The second challenge did not debunk the first challenge, it debunked the poorly written and misleading articles about the first challenge by replicating the situation the articles depicted the first challenge as being.

      Only one of those actually ended up demonstrating a result.

      You can't logically prove a negative. What amount of time is sufficient to show something won't ever happen?

      Not to mention that the second challenge was pulled early...

      But not because it was hacked. It was pulled for reasons outside the control of the person running it and certainly stood up to more than 30 minutes of attacks, thus the sensationalist articles were debunked.

      ...and not that I expect someone to give away a remote shell exploit for free to prove a point.

      Remote "shell" exploit? Why would it be a shell exploit, necessarily?

      I certainly think it is likely there are remote exploits for OS X out there. There are certainly a lot of white hats and other crackers that would love the publicity this could have generated for them. There are also a lot of people that would like to quiet down the small number of uninformed, overzealous fans of OS X that at times can be quite annoying. What this has show is that remote exploits are not common enough that people can demonstrate one to show boat and they are not easy enough to find that they can be found and demonstrated by the white hats in that short a period.

      Basically this confirmed what pretty much every security person already has plenty of evidence to support. The point you are missing is that while the original test was somewhat useful, the very poor articles about the original test spread misinformation and FUD that did more damage than the original test did good. It is those articles that this challenge was designed to rebuke and it has done that much at least.

      • You can't logically prove a negative. What amount of time is sufficient to show something won't ever happen?

        Exactly. So which one proved something?

        Remote "shell" exploit? Why would it be a shell exploit, necessarily?

        It's a very common infosec term, it means an exploit that provides a remote shell or equivalent. As opposed to a flaw in RSH, if that's what you were thinking.

        I certainly think it is likely there are remote exploits for OS X out there.

        Of course there are. Several have been published, and I kn

        • Exactly. So which one proved something?

          The first challenge showed that local exploits are out there. The second challenge showed that the articles about the first challenge were a bunch of crap. Each proved something.

          It's a very common infosec term, it means an exploit that provides a remote shell or equivalent. As opposed to a flaw in RSH, if that's what you were thinking.

          I'm familiar with what a shell is. But you're saying a shell exploit is an exploit that gives access to a remote shell or the sam

  • Just ask Microsoft (Score:4, Insightful)

    by truthsearch ( 249536 ) on Thursday March 09, 2006 @01:53PM (#14884089) Homepage Journal
    Just ask Microsoft.

    Or an ex-customer like me [msversus.org].

    Perception of course matters to many people. But hopefully reality matters to many more people.

    Apple, please... just please... do everything you can to keep your customers' computers safe. That's all I ask. Appoint a CSO or don't, I don't care.
  • Sounds good as long as they don't hire Microsoft's security czar. They'd want someone who can do something besides spin out of control.

  • Uhh, personally (Score:5, Informative)

    by mcc ( 14761 ) <amcclure@purdue.edu> on Thursday March 09, 2006 @02:01PM (#14884164) Homepage
    Personally I think they'd be better served by concentrating on improving their security, rather than concentrating on improving their security-related PR.

    Analysts and bloggers crowing endlessly about "Apple/Linux/Firefox/whatever don't have better security, they're just smaller" gets attention for a little while, but just let time pass. Eventually people realize they're being cried wolf to. After a few years people will have forgotten the bloggers, but will remember whatever the next major Windows worm incident that gets on the nightly news turns out to be.

    Unfortunately, this only works if you really do have better security. And while this article is just talking about media events like the mac mini challenge as if they're all that matters, Apple has had real security problems of late. Whether or not the mac mini challenge was important for real security there are apparently some os x privilidge escalation exploits floating around, and there was that incredibly embarrassing bug [slashdot.org] awhile back where Safari could be tricked into launching a shell script as if it were a .jpg. Exploits based on getting the operating system confused about filetype mismatches are really the kind of thing we should not be seeing in 2006, especially since (1) OS X has had security issues of this exact same type before and (2) this is the exact kind of exploit which is the basis for many Windows e-mail worms. Apple needs to take this seriously.

    Taking this seriously does not mean-- as the article suggests-- appointing someone to talk to the press about how great Apple's security is. It means actually fixing the problems, and making some effort to see what other problems might be out there. PR is temporary, and if you do too much of it it can backfire (as people start to assume anything positive they read about your platform is just a result of PR). Real security problems like the filetype bug I mention can impact your reputation for years, no matter how much you try to spin them.

    Speaking of which, there was a new security update on Apple Software Update this week. Anyone know what exactly that covered? Is the jpg/sh MIME or whatever problem fixed yet?
    • Personally I think they'd be better served by concentrating on improving their security, rather than concentrating on improving their security-related PR.

      I'd like to agree, but there's more bucks being returned from spending on better PR than from spending on better (real) security. Just ask MicroSoft.

      Will just ask MicroSoft become a new meme?

  • personally I'd like to see..... (Score:3, Interesting)

    by joe 155 ( 937621 ) on Thursday March 09, 2006 @02:08PM (#14884219) Journal
    more information about the security for mac. I think the security is good enough, but (and I know I sound mental) I feel more secure on windows, because even because i might get a virus/spyware I've got pretty good at knowing how to deal with it if I get it and not get it. If I was on mac and got any security problem I'd never know and so it could run for ages...

    That said i do want to migrate...
    • I'd think it would be a lot easier to clean out any malware from an OS X box than it is to clean out the stuff on a Windows machine, mostly because there's no registry. Just search for the files, drag them to the trash, and empty it. Problem solved.
    • There are loads and tons of materials about bsd and linux security. There's no Mr. Apple who will visit you at home and feed all the information into your brain, one has to be willing to learn doing things some other way than what having been accustomed to. Just because one knows an OS better, doesn't mean one is more safe, this is just an illusion. Truth is, most of computer using people just couldn't care less about security issues. They are the targets of the endless pr stunts every company performs cont

  • Apple should put up a honeypot. (Score:4, Insightful)

    by FFFish ( 7567 ) on Thursday March 09, 2006 @02:17PM (#14884281) Homepage
    Put up a stock OS X box, with default config, and encourage the blackhat crowd to go for it. Take what they learn, apply it to the system updates, and re-iterate.
  • And once you've lost a user's confidence, it's hard to get it back. Just ask Microsoft.

    Bill, can I be confident that Vista will not have any security holes?

    Yes you can, just make sure you buy Vista Ultimate. [microsoft.com] It is the best one that we offer.
  • The second security non-incident to hit the Mac platform in as many weeks has been debunked.

    This is crap. It was an "incident" for sure. The fact of the matter is that the Mac, given local access by either a process or login is very subceptible to local privledge esclation. It took someone 30 minutes to prove that this is the case.

    The real concern with this is that the Mac is not truly equipped (in it's current state) to be used securely as a multi-user UNIX machine. An example of such an environment would
    • Everybody is sitting here saying "this "debunking" thing is crap...Apple needs to need to fix..." blah blah blah.

      Here's the real problem. Hackers are trying to make a name for themselves by "winning" a "Hack into a Mac" challenge. They accomplish this by using an "unpublished exploit", then tell the world that they did it. The problem is they don't say how. If you figure it out, then tell Apple(or whoever's OS/app you've cracked) what you did and how.

      The pathetic thing is gwerdna is being praised as a h

  • Appointing a czar... (Score:2, Interesting)

    by GuloGulo ( 959533 )
    Isn't appointing a czar what ineffective beauracracies do in response to a problem they don't have an answer for?

    Have there been any successful czars for anything?
  • Creating a CSO position may be viewed by some as an admission of weakness.

    I don't think so. I think it's an admission that you arn't a self-centered egotistical fathead who is actually dumb as a stump. Security is always an issue. No matter how well you *think* you are protected.
  • Could someone please enlighten me as to why it is possible for a least privileged user account to gain root without the consent of the owner to be classed as a "non-incident"?

    If I give someone an account with limited rights I've given them an account with limited rights, not an account for them to get root if they feel like it. If I wanted them to have root, I'd have given it to them in the first place!

    • Could someone please enlighten me as to why it is possible for a least privileged user account to gain root without the consent of the owner to be classed as a "non-incident"?

      It isn't a non-incident, but neither is it a remote exploit. Apple fixes 5-10 local escalations a month in their security updates, many of which are found by outside security people. Thus exposing one more is not exactly news. This is the same for Linux or most any other OS not designed to be ultra-secure. (Except Windows which has

  • Oh please ... (Score:3)

    by tbone1 ( 309237 ) on Thursday March 09, 2006 @02:32PM (#14884381) Homepage
    Does anyone really believe that adding more bureaucracy is going to make security better? Somehow I question this being a sufficient, or even necessary, condition.

  • Apple doesn't need no PR guy to handle any security problems that may be exploited in OSX. What they could use is preventive maintenance.

    Apple could easily integrate an Anti-Malware system in OSX and it would boost their security immensely and there's nothing Symantec or Mcafee could do or say about it (Unlike MS under an antitrust ruling. I'm surprised they are letting Windows Defender in Vista). All it would have to do is warn you of potentially harmful actions even if it's initiated by the system root (h

  • Business Weak (Score:3, Insightful)

    by Doc Ruby ( 173196 ) on Thursday March 09, 2006 @02:43PM (#14884465) Homepage Journal
    At least with this story we get a peek at how Business Week sees the world. A "Security Czar" job is to create propaganda, not enforce security policies. Appointing such a person is principally "an admission of weakness", not a declaration of strength.

    Who do they back on National Security issues? How do their favorite National Security spokesmodels rate?

  • Might not be in Apple's gameplan. (Score:4, Interesting)

    by ZombieRoboNinja ( 905329 ) on Thursday March 09, 2006 @02:44PM (#14884478)
    It's my understanding that thus far, Apple has been intentionally downplaying their system's security because they don't want to be seen as taunting hackers. A "security czar" might be seen by Apple as just such a misstep. The last thing they want is a guy standing up at an Apple podium exclaiming how their security is invincible, because that's one sure way to make themselves a bigger target.
  • There has been a long-standing design flaw in Safari and Mail as long as they have existed. The problem is that there's a single database, "LaunchServices", for use by applications working with local files and by applications working with untrustable documents. To fix this Apple has been trying to come up with a clever scheme to make double-clicking like a crackhead monkey on any random icon in your download directory "safe". Instead, they need to come up with a separate database (a "WebServices" database)

  • PR is nice, but I want the real deal (Score:3, Insightful)

    by John Whitley ( 6067 ) on Thursday March 09, 2006 @03:45PM (#14884933) Homepage
    As others have pointed out, the proposed position is a PR position. I want the real deal -- actual security not the appearance of it. On that note, the clueless keep making noise about Unix being "fundamentally more secure" than Windows, and that's bullshit. Let's be clear: the practical differences between OS X and WinXP in terms of security come down to the vendor's practices and the dilligence of the admins. There's no technological magic juice here. There are, IMO, zero fundamental differences between OS X and WinXP (or stock Linux) when it comes to the potential for local or remote vulnerabilities. Local and remote exploits are quite possible and practical on all these platforms.

    Thus Apple has two approaches it can take. First, it can consider tactics that harden the system as a whole, making it much harder for exploits to work in the first place. Look to approaches such as those taken by grsecurity, SELinux, and the other layers found in hardened Linux and *BSD distros for examples. Harden the hell out of the kernel and compiler layers as baseline approach. Perhaps fund Coyotos [coyotos.org] work as a strategic-term approach, with an eye towards migrating the kernel. The room for innovation here is to present a hardened system that isn't any harder to use.

    Second, Apple simply must be dilligent in identifying and fixing exploits. To that end, I'd propose that Apple offer a substantial first-reporter bounty for local and remote exploits on the Mac OS X platform. Think about it: set aside the equivalent salary+overhead of one or more good security experts. Divvy that amount out to leverage a larger community each year. I'd love to see a few students help pay their way through college this way. 8-)

    Forget the illusion of no exploits -- go out, find 'em, and close 'em first.

Slashdot Top Deals

"When the going gets tough, the tough get empirical." -- Jon Carroll

Close