Windows vs Mac Security 513
sdhorne writes "There is a good technical discussion over at InfoWorld on the merits of launchd and what is lacking in a comparable Windows secure solution. It is a throw back to the UNIX vs Windows security discussion that has been hashed out for many years." From the article: "it always traces back to Microsoft's untenable policy of maintaining gaps in Windows security to avoid competing with 3rd party vendors and certified partners. Apple's taking a different approach: What users need is in the box: Anti-virus, anti-spam, encryption, image backup and restore, offsite safe storage through .Mac, and launchd. Pretty soon any debate with Microsoft over security can be ended in one round when Apple stands up, says 'launchd', and sits back down."
slashdot this (Score:5, Interesting)
Links to slashdot submit article. http://slashdot.org/submit.pl [slashdot.org]
Cute.
Re:Well written, but (Score:4, Interesting)
I don't know if I'd go that far. OSX isn't 100% immune - it just has more common sense.
In a nutshell, OS-X is built upon a known animal, whereas Windows is an animal which continues to be re-invented, like a leopard changing its spots to stripes, then plaid, then paisley, then something else. With such moving targets all the time it's small wonder they've got security issues. Some begin to be addressed with good programming practices (which Apple could certainly lapse at at any moment, and may well have and we haven't heard about) Another is to require tight control over interfaces between code from different departments. Microsoft going back to scratch time and again doesn't necessarily mean anything is getting better.
UNIX and viruses (Score:5, Interesting)
Macs are based on UNIX. It's not faked to appear like UNIX, it is actually UNIX. The permissions system means that a common virus could damage a user's home directory, but the system for the most part would remain unaffected, including other users. It is still possible to write root-kit style viruses that take advantages of subtle bugs in the operating system and other software to gain control of the system, but this is significantly more complicated to do, and IIRC it was Theo from the OpenBSD project who said that attacks like this require many steps that often must take advantage of many vulnerabilities to elevate priviledges, and by fixing even one bug, a whole category of vulnerabilities (even if other bugs remain) becomes inaccessible to a would-be attacker. This, in addition to much of the code underlying OS X being available for hacking up by anybody, in addition to other projects actually hacking on this code (improvements from projects like Samba, Apache, GCC, FreeBSD, even various Linux projects, make it into Darwin and OS X.... and most of all the fact that users don't run as administrators, all of these reasons make it much less likely that viruses could be as damaging as on Windows.
But it still has the rootkit fallacy (Score:3, Interesting)
Now he does mention that most services on OS X don't run with unrestricted privileges, so there is much less chance of malware getting root *in the first place*. This is the important thing to emphasize - not what to hopelessly fiddle with once you are already 0wned.
I guess by root I don't necessarily mean what OS X or BSD or even Linux call root, but the classical Unix notion of the Almighty user who can do anything. Many BSDs have securelevel settings meaning that even root is restricted from doing certain things.
This is MS-FUD no doubt (Score:3, Interesting)
What bizarro-universe is the writer living in to write something so patently false?
Microsoft's Standard Operational Procedure is to wait-and-see which niche is picking up enough importance (and we all agree security is a major one this decade, right?) and then cutting off that vendor(s) oxygen by coming up with their own "superior" (guffaw) solution which MS gives away for free, next to nothing or by marrying it to some essential O.S. component.
Another piece of Microsoft-propaganda no doubt.
Sell it elsewhere, chum. I'm not interested in reading anything else you've written if this quote is representative of the drivel you are putting forth. Thank you.
the article may have some good points, but... (Score:5, Interesting)
being offered as a "reason why OS X is more secure than Windows."
The article claims that Administrator on Windows is equivalent to root; and that SYSTEM is more powerful than Administrator (and by implication more powerful than root). This is nonsense.
Administrator is indeed less powerful than SYSTEM. However, Administrator is equivalent to a user on the sudoers list and/or with group write access to system directories. SYSTEM is the correct equivalent to root.
We may quibble about how well Administrator accounts are protected from trojans; or whether non-Administrator accounts on Windows are of much use; those are valid arguments. However, claiming that, somehow, SYSTEM on Windows is magically more capable than root is ridiculous.
If anything, Windows has a somewhat better design in that it is possible to set up privileged accounts with a specific power that only root has on UNIX, yet not have any of the other root powers. However, this capability is quite underutilized, and in many ways is undermined by other (unfortunate) decisions that Microsoft made.
Re:But what if Microsoft offered it all together? (Score:5, Interesting)
Interoperability is a threat (Score:5, Interesting)
As long as corporations confuse interoperability with "windows compatibility" the scam will go on. Only when the commercial user who forks over billions of dollars to MS every year demand true interoperability and injects real competition, it will end. There is no advantage in being the first among the users pushing for it. Pepsi will not care as long as Coke is also spending relatively the same amount of money for similar services. But someday somewhere some corp will bite the bullet and spend what it takes to break the vendor-lock in, and only after that the security situation will improve.
Re:in fairness to microsoft (Score:4, Interesting)
Apple doesn't incorporate anti-virus/anti-malware into their OS. They incorporated good security, and made good use of it.
MS could easily do the same even more with their more featurefull security model, if they wanted to, without incorporating any anti-virus/anti-malware into their operating system. Odd that instead of fixing their security problems, they just opted to compete with anti-virus/anti-malware vendors.
Re:Well written, but (Score:5, Interesting)
I'm not sure that 're-invented' is how I'd describe windows, or their efforts at security.
In the past Microsoft have commented that they have completely ditched the code Windows was written with and re-written from ground up, to try to address myriad flaws. That's pretty drastic. I've done it with small projects which simply grew too large and unwieldy because they were never expected to scale to newer demands* Microsoft is effectively doing this with Vista and yet... there still appear to be security flaws. Something wrong with that picture. Could be they're just a victim of their success and such a massive undertaking of code is approaching the event horizon just before the black hole.
*You know the type.. you develop some nifty little tool to summarise information for your own use and someone sees it and says, "Hey! That thing does in seconds what I spend a week doing! I need it, set me up with it!" Next thing you know your little tool has to be user friendly, go to printers, be in colour, etc. Continually piling in changes makes it fragile so you step back, figure what it all needs to do and how to achieve the goals and then recode, with an eye toward more scalibility and unforeseen features later.
Re:But what if Microsoft offered it all together? (Score:5, Interesting)
Microsoft has been declared a monopoly in Federal court, and found guilty of anti-trust offenses related to abusing that monopoly in violation of the Sherman Anti-Trust Act.
Apple, on the other hand, is not a monopoly, and hence it would be perfectly legal for them to bundle anything they damn well felt like bundling.
Why is this so difficult to understand? Microsoft, because of their market position, is held to a different legal standard. End of story.
Re:But what if Microsoft offered it all together? (Score:5, Interesting)
It's not difficult to understand; it's annoying because it's the wrong argument, and it really muddies the debate. We don't need to hold Microsoft and Apple to different standards to show that one is better than the other. There is nothing wrong with MS bundling software with their OS. What was wrong was that they were forcing companies like Dell NOT to include competing software (such as Netscape).
It's a moot point any way though, because in this case we aren't even talking about the right thing. As someone else mentioned, we're talking about a system that is built to resist viruses and such, not virus scanning software bundled with the OS.
Re:But what if Microsoft offered it all together? (Score:5, Interesting)
Also, there's a difference since in the Apple world, there isn't an antivirus or antispyware market, but in the Windows world, there is a huge market that's been around for over a decade, so it's a big deal when Microsoft starts bundling its own versions of these services.
For the record, OS X ships with no antivirus software. Not needed.
Re:the article may have some good points, but... (Score:5, Interesting)
If anything, Windows has a somewhat better design in that it is possible to set up privileged accounts with a specific power that only root has on UNIX, yet not have any of the other root powers.
I don't want to quibble about nomenclature and real differences between security layers or accounts or whatever between platforms, but I think you're a little mistaken here. One of the reasons LaunchD is being applauded in this article is because it allows you to run a given process with very specific permissions without going to hassle of trying to create a special user account and while also integrating the scheduling and resource allocation in one, nice, neat, hopefully secure package. It obviates the need for straining the "user" metaphor as is so common. I don't exactly think it is really appropriate to claim it as the security benefactor, however, when what we're really talking about is that services aren't written to require unneeded permissions as much as on Windows.
Microsoft wouldn't need to offer it all together (Score:3, Interesting)
In a sense everyone is trying to argue that Microsoft can't include additional security tools because they'd be accused of leveraging their monopoly. The enitire antivirus industry likely wouldn't exist, and this would be a moot point, if Windows were designed securely from the start.
What we seem to have now is pressure on Microsoft not to make things *too* much better because they would wipe out a lucrative business niche occupied by third parties. Microsoft is a slave to backwards compatibility, so they won't scrap everything and start from scratch. But they can't win because if they offer an antivirus solution they're leveraging their monopoly unfairly. Or they're an extortionist because they failed to secure Windows properly, but are getting more money from customers by forcing them to purchase their anti-malware solution.
OSX is better than Windows in terms of security. But Microsoft only have themselves to blame. They should break with backwards compatibility, buy themselves and Linux distro and layer the Windows GUI and APIs on top of it. Do it right and their security problems will be a thing of the past.
Re:But what if Microsoft offered it all together? (Score:3, Interesting)
Apple isn't including third-party software with their Macs, they're putting their own programs into System Software.
Microsoft can't put good security into Windows. They aren't allowed. They would be "investigated" and sued... again. Every time Microsoft puts some new, useful app into Windows someone cries "monopoly".
Re:Well written, but (Score:2, Interesting)
But at the same time Apple gets applauded for rolling EVERY SINGLE LITTLE POSSIBLE THING into their OS?
I don't give a damned either way. It's the hypocrisy that I can't stand.
Re:But what if Microsoft offered it all together? (Score:4, Interesting)
It has nothing to do with Microsoft not offering anti-virus, anti-spam, encryption....
The problem has everything to do with Microsoft having to keep backwards compatibility!
Windows wasn't designed to be used on a totally open network. It was meant to be a single user OS that ended up being used as a server and then being hung on an insecure network we call the Internet.
Running windows with less than administrator rights is a pain.
Installing software without administrator rights is impossible.
The problem with Windows security is the same problem that Microsoft has with IE7 not following standards.
They refuse to give up on backwards compatibility to fix fundamental flaws.
The reason that people keep using Windows is because their old software works. That is Microsoft's big advantage in the market place. They are not going to loose that to fix security issues.
Re:But what if Microsoft offered it all together? (Score:3, Interesting)
By your rationale, Microsoft's Notepad and Wordpad, and Apple's Text Edit would all violate the law because they are bundled with the OS and there are definitely existing markets for word processing.
Having a large market share of a product is not the same as having a monopoly. If Apple starting buying up other companies and disolving them, or put pressure on retailers of the iPod to not sell competing brands, that would be illegal. Making a product that sells insanely well is not illegal, it is good production and marketing (a.k.a. "The American Dream").
Re:Well written, but (Score:5, Interesting)
Because they don't force you to use any of it. You can delete any of the utilities that you want. Don't want ichat? Trash it.
On the other hand, good luck getting rid of Windows Messenger. It's even hidden in Add/Remove Programs and fixing that requires a hack well beyond most users.
Don't want to use Safari? Make it go poof.
On the other hand, you CANNOT get rid of Internet Explorer. And that's bad. IE is full of security holes and you can't get rid of it. Safari is far safer, and you can get rid of it.
What hypocrisy was that, again? There's a damn good reason MS gets blasted and Apple doesn't. (Well, it does, but nowhere near as much, and I just explained why.)
Re:But what if Microsoft offered it all together? (Score:4, Interesting)
Total crap (Score:4, Interesting)
It is not that hard to argue for OSX security over Windows security due to the track-records, but this article is total crap. A few of the points:
With all that said I can easily see people going to OSX to improve security, that does not make that article anything but deeply flawed however.
Re:Well written, but (Score:5, Interesting)
But IE is part of the OS... just ask Microsoft. Seriously, though, back when my previous company had to deal with IIS before moving to a more secure/sane server, one of the server bugs was fixed by upgrading IE on the server, so IE-is-fundamental-to-the-OS is frighteningly close to actual truth with Windows.
Also, I'd like to see the statistics you cite that say that Windows hasn't been hit statistically more than MacOS. There are no MacOS-specific worms or viruses "in the wild", so it's hard to come up with the sigmas for what would be "expected" for what a comparable OS should expect.
Re:well, (Score:5, Interesting)
Re:Well written, but (Score:5, Interesting)
The purpose of most of the DLLs in SYSTEM32 is documented, just look at the summary tab in Explorer, the problem is that with any complex operating system it's trivial to make up fake names that sound plausible
I just looked at the summary tab on a dozen random DLLs in my system32 directory (most from microsoft, some from 3rd parties), and there was no information in any of them. Why can't 3rd parties use a different location than MS... at least that would help a little (would help me anyway, if not the actual problem being discussed)
Windows requires users to use Administrator to install software? No, buggy software requires that. Historically a few Mac programs have had the same requirements
"buggy" software? I think you mean to say legacy OR poorly coded... this is one of those side effects that windows carries from version to version (like the registry) because MS refuses to leave customers high and dry for old software. Back in the old days this was the right way to do things, store configs in programdirectory/conf... we didn't have an appdata directory like we do now. Same with registry hives, they weren't setup in the same way they are now where certain users could do certain things. Calling it buggy implies the software is behaving contrary to design, it's not, it's just that the target has moved and the software hasn't all moved with it.
Re:OS X is better,but... (Score:4, Interesting)
On the other hand, OS X doesn't have all the legacy cruft of ye olde unix. I think one of the main strengths of Apple systems is that they do a clean start every now and then. Quite contrary to the Windows style of supporting everything since the DOS days.
Personally I prefer Linux for the sheer amount of control. But the Apple way might have some benefits compared to more traditional unices. In any case I believe it's much more secure and sane than any Windows. I've recently convinced a friend to get a Macbook, since it's pretty much the only way to get a real OS preinstalled.
Windows Firewall????? (Score:2, Interesting)
The Windows Firewall is worthless, and does very little against any kind of attack. See the results of http://www.firewallleaktester.com/ [firewallleaktester.com]. The windows firewall in reality is more "security blanket" than Security. The point of many complaints that you wil see here is that there are so many backdoors to the core components of MS operating systems that security is a nightmare. Personally I agree with your analysis of the state of anti-malware. I just think that there is too much financial incentive for a completely secure end-user OS to not be designed. Just my cynicism speaking.
Clearly the Fanboi's Are (Score:2, Interesting)
Getting extra mod points these days. Rather than informing themselves by actually reading the specifications and informing themselves on the issue at hand, they mod real problems down, preventing other users from the opportunity to inform themselves as well.
I thought that this was news for nerds, and stuff that matters. Well, if it doesn't matter that there are no protections in place for owners of TPM enabled equipment to Slashdot, I guess they're already cashing their cheques from Apple. In light of the consistent pro-Apple slant to this site, I will refrain from recommending this site to new tech-people as one of the 'go-to' sites for stuff that matters.
Frankly I'm disgusted by your incredulity, as any self-respecting tech would first inform themselves as to the issue, and then make their decision, rather than mod down a story that is a) on topic (if we're actually discussing Windows v. Apple security) b) relevant as software runs on hardware c) not an attempt to troll for (un)favourable responses, but rather an attempt to elucidate a very clear and present issue facing computer users today.
In closing, to whoever modded me down: 'Bite Me Fanboy' to quote the Main Man.
Re:Well written, but (Score:3, Interesting)
Comment removed (Score:2, Interesting)
legacy compat: implement unionfs (Score:3, Interesting)
The subject line is a short summary of the solution that Microsoft should have implemented a long time ago---to implement a union of file systems so some files are drawn from a read-only file systems and others from a read-write file system.
See http://en.wikipedia.org/wiki/UnionFS [wikipedia.org].
Basically, the program folder has only read access to users, but unionfs of the program folder and a user folder in "Documents and Settings" would allow each user to modify content of that program folder independently. Users do not see each other's changes, and the main copy is left intact. You also don't need to be a privileged user to run that program.
Mac OS X also has it. See http://www.kernelthread.com/mac/osx/arch_fs.html [kernelthread.com].
I apologize in advance if Microsoft has already included that feature, but I would get even further irritated because there is absolutely no excuse now to make everyone administrators.
Virus model (Score:2, Interesting)
1. there has to be a vulnerability
2. there has to be a vector
Now market share has substantial impact on -vectors-, but has -no impact- on the core vulnerability. This is the point so many people miss when they claim that the only reason MacOS X is not infected is because of market share. This is not my original thought, but I'm very sorry I do not remember who first pointed this out to me. (If you read
For a long time (I don't know if this is still true), the Army corporate Intranet, Army Knowledge Online (AKO,) was run on top of a whole ton of Macs. This was after the Nth infection of their previous Win NT baseline, and the 3-star said "Fix it." It's my understanding from about 5 years ago from a friend who worked on that project that there were a few first-stage penetrations/DoS attacks, but NO (zero, nada, zilch) successful infections of the Macs, even when they were running WebStar on OS9, and then none when they moved to OS X. (He provided no details for security reasons, and I didn't ask. But having known this guy for 12 years at that point, I take him at his word.)
So to those who claim that "there's no reason for a hacker to infect a Mac-based system," I'd point to both the big-time hacker glory that people in that culture would get for screwing up www.us.army.mil, and to the much more serious impact of a deliberate cyber-attack (e.g. Al Queda, Hezbollah, Chinese espionage, etc - all of which I believe are documented as attacking US military web sites, and unfortunately with some success for sites other than AKO.) Most well-run websites can detect a penetration, even without a change to the home page.
Anyway, my point is that the lack of infections has to be attributed primarily to lack of vulnerability, and in evidence I offer the big headlines that come out whenever someone thinks they've found a vulnerability in OS X. But so far, to the best of my knowledge, there's been no successful infection "in the wild", and certainly NOTHING to resemble the Windoze viruses that seem to spread across the 'Net about every year or so. This canNOT be attributed only to "lack of market share".
dave
Re:Total crap (Score:3, Interesting)
I can only hope you are right, but past experience with MS buying out other companies is that very few actually last. Most just wither and die from lack of maintainance. Process Explorer is comparable to Activity Monitor on OS X and is so much better than Window's default task manager. When we heard that MS bought it there was a collective "Oh no" from our office.