



Jobs and company hope to keep customers ignorant of the truth








Products Affected


A second memo adds:


    • Do not attempt to remove or uninstall any malware software.



II. How Widespread is the problem?







III. How Long Can Apple Keep up the Charade?









Comments     Threshold


Relying on users typing in a password?
By SoCalBoomer on 5/20/2011 1:15:01 PM , Rating: 3
The beauty of Mac OS X is its security model.

Sorry, that's not a security model. I have a number of students whose computers have NO password because they're tired of typing it in (personally, I got that way too so my password is now quite short and easy to type in) - it comes up literally at least once a week and often more often as iTunes updates, Safari updates, MS Office updates, and OSX updates and each needs the password. . .

No, a true security model relies on . . . SECURITY.

That and a manufacturer actually responding positively to problems. . .

RE: Relying on users typing in a password?
By tng on 5/20/2011 1:43:23 PM , Rating: 2
Sorry, that's not a security model.

No, it is an excuse for Apple to pass the buck......

"They had to input a password to install malware, so it is not our fault", security has nothing to do with it.

RE: Relying on users typing in a password?
By cjohnson2136 on 5/20/2011 1:45:21 PM , Rating: 2
Any computer security person is laughing because if a password is their security model, they all know that security needs multiple layers. A password means nothing.

RE: Relying on users typing in a password?
By Solandri on 5/20/2011 2:39:18 PM , Rating: 5
OS X inherits its security model from Unix (it traces its roots back to BSD/Unix and NeXTStep). Unix was designed from the get-go as a shared multi-user system running on a mainframe with users logging in through terminals. Consequently, it has a rather robust security model. Apps run in user-space with only the minimum permissions needed to get the app to run. If you absolutely must have additional permissions, the app must ask for elevation to root privileges, which is when the user has to type in the root password.

Windows comes from the opposite direction. It started off with MS-DOS, which was a single-user OS. The user had full access to the entire system at all times. Consequently, most Windows apps were written assuming they had full access to the entire system - they assume they have root access. A lot of them broke when Vista introduced the Unix-style security model of apps only getting minimum permissions by default, which led to a lot of companies sticking with XP. Even today, 4 years after Vista was introduced, when I'm helping migrate clients' systems to new hardware, I call up the producer of the vertical app the company runs, and get told their solution to getting their software running under Vista or Win7 is to turn off Windows' UAC security.

I agree that Apple's dismissal of these security issues is ludicrous. But OS X's fundamental security model is better than Windows', and probably better than Linux's due to it being single-source (fewer unforeseen interactions to watch out for).

RE: Relying on users typing in a password?
By KoolAidMan1 on 5/20/11, Rating: 0
RE: Relying on users typing in a password?
By semicolon on 5/21/2011 10:53:10 AM , Rating: 3
Actually, the current Windows operating systems do not have a lineage that leads back to MS-DOS. Since Windows 2000, all versions of Windows have derived from the Windows NT kernal. Windows NT was a new development, originally from the joint Microsoft-IBM development of OS/2, and doesn't have any relationship with MS-DOS. In fact, the kernal has more in common with DEC VMS or RSX-11.

RE: Relying on users typing in a password?
By KoolAidMan1 on 5/21/2011 1:18:06 PM , Rating: 2
True, but what he is saying regarding the lineage of the Windows security model and where it changed with Vista still stands.

By nycromes on 5/25/2011 8:44:34 AM , Rating: 2
Regardless of the lineage, there will always be a tradeoff between convenience and security. The weakest link will always be the user. This is the case on all OSes and will continue to be until people learn not to trust popups, links, and messages.

You can put in all the security you want into an OS, many users will turn it off. If they can't turn it off and its too much they will switch to another OS. Not to mention, they will still blindly follow pop up messages directing them to install some app. People want both convenience and security, but we have yet to determine an effective way to accomplish this. The best way to eliminate these threats is to educate users on safe computing. People are going to use computers so lets teach them the safest way to use computers. Force the hackers to find the bugs in software rather than social engineer users into installing their malware.

