Security: What Microsoft Can Teach Apple
|
Is Apple's approach to Mac OS X 10.5 security about stupidity or arrogance? Maybe Apple needs to learn something from Microsoft. |
Last night, I read an Heise Security report about Leopard's firewall being turned off by defaultor turning off a previously active firewall during the upgrade from an earlier Mac OS X version. I can confirm that the upgrade flips off the firewall, and without warning.
There are other troubling changes going on under the hood, too. For example, Apple's new Back to My Mac feature either turned on without my authorization or turned on during installation. I'm still early stages testing and hadn't gotten around to this feature. I ran Leopard all day yesterday, periodically using the Cisco VPN client to connect to my corporate network. This morning, when I launched the VPN client, a Leopard popup warned that the new Back to My Mac feature and VPN cannot operate at the same time; a handy link flipped off the service. But who turned it on in the first place?
This morning, my wife had trouble sending e-mail. She had no problems yesterday. But today, for some reason, Apple Mail reverted to using her .Mac SMTP server as default. I had previously set it to a Cox server SMTP, as required by the cable provider.
I'm usually more of a fan of Apple operating systems, but Leopard doesn't feel like a finished product. The security settings are particularly irksome, if nothing else. Apple should know to turn off as many unwanted services as possible and keep on those that beef up security.
Problem: Security features aren't that different from locks and bars on a home or store. They're nuisances. Who really wants them? Apple's approach could easily be about maximizing performance and perceptions about Leopard. Maybe Apple product managers see limited risk because Mac OS X has been largely free of malware.
Maybe Apple took the wrong lessons from Vista's hardship. Windows Vista is very locked downfrom a usability perspective, to a fault. Microsoft took the right approach of turning off more network services and, by putting bars, locks and warning signs on Internet Explorer 7, making it the most annoying browser to use on the planet. Oh, but it's safer! There is something good said about Microsoft's batten-down-the-hatches approach to security. But there are usability trade-offs.
Apple's Leopard security approach isn't enterprise friendly. I certainly wouldn't recommend using Leopard in a corporate environment until the security approach is fully understoodwhat's on, what's not and why.
In fairness to Apple, I didn't find all the same open services as Heise Security. For example, I used the lsof command in Terminal to see what Leopard had running. Heise found NetBIOS active; I did not.
But what I have seen is disconcerting, although the greater concern is the unseen and unknown. I took a quick look at the Console logs this morning and can see when I turned off Back to Mac but not where it was enabled. If it was turned on by default during the Leopard upgrade, then why was there no VPN conflict yesterday but one today?
Microsoft made the hard decision of putting safety before convenience. In some ways, Microsoft went too far. I spoke to three people over the weekend who had turned off UAC (User Account Control) because they found the pop-up notices to be too annoying. The off-switch defeats the purpose of having UAC. Microsoft would have done better taking more of the security decision burden from the end user. Even so, the fundamental approach is right from a security perspective.
Apple seems to have taken an approach that is more about enhancing performance and usability than security. The right approach is simple: Turn off most network services and turn on most security services. Should that really be so hard?
Related Posts:
- Leopard Isn't Better Than Vista, Microsoft Watch, Oct. 29, 2007
- Why Leopard Is Better Than Vista, Microsoft Watch, Oct. 29, 2007
- The Great Double Standardd, Microsoft Watch, Oct. 26, 2007
- Apple Is No. 3. So What?, Microsoft Watch, Oct. 22, 2007
- Vista: Cat Scratch Fever, Microsoft Watch, Oct. 19, 2007
- Vista Security: A Petulant Child, Microsoft Watch, Jan. 16, 2007


Comments (31)
@Joe:
It's obvious that you are doing the 'John Dvorak'.
Hint: It's only one of him
What ever happened to Microsoft Watch?
Posted by n0neXn0ne | October 30, 2007 12:52 PM
@Joe:
I don't have a dog in this fight...
But now you need to chill, you are starting to look like an ID10-T. You are no security expert by any stretch of the imagination.
Have a nice day;-)
Posted by n0neXn0ne | October 30, 2007 12:59 PM
Hey Joe:
Trust me, you are laughing when you are writing some of that stuff, but guess what, I'm also laughing when I'm writing some of this stuff. Hey it's all in good fun, life is too short. Tell your readers not to take this stuff twooo seriously. Because at the end-of-the day, it's about killing the day.
Finally, We all are just using a screen a browers and a keypad to read and respond to this forum. Obviously that at lease is working for everyone no matter the O/S or gadget.
Have a nice day...
Posted by n0neXn0ne | October 30, 2007 1:16 PM
I like this post so much...
(but for more you'll have to visit the Yahoo/Microsoft board)
... I decided to give it its own thread:
And vcsy_stock_scam wants you to believe VCSY is a stock scam with no way to survive much longer. It's what vcsy_stock_scam has been saying with his buddy for years. It's what those in the industry believed and poured their R&D dollars into building technology that would run over the "soon to be bankrupt" VCSY technology.
That was years ago and VCSY refuses to die. Now they received the money awarded them when VCSY won the VCSY v CDC/Ross Systems case earlier this year and I don't hear the posters here crowing about VCSY going "bankrupt" any more.
So the VCSY v MSFT case is 72 hours away from a discovery ruling and it's on to the Markman hearing where VCSY will be able to petition the court for an injunction against MSFT for infringement in their .Net and all derivative products and projects inside Microsoft and inside their customers.
It's been a long three years since the 744 patent was issued.
If you'll take a look at Laszlo Systems you'll see what Microsoft hoped they would be able to use once VCSY was destroyed. But, when industry players found in 2004 that VCSY would be issued the 744 patent in November 2004, Laszlo Systems pulled a skip-out and released their work into open-source October 2004.
Microsoft shut down all their XML bravado, lost Mark Lucovsky and tried to find some way of rebuilding their projects while hiding the use of XML in the company. You don't see much at all about XML in Microsoft from 2004 onward. In fact, google XML + Microsoft and compare the results with XML + IBM or XML + Adobe. with IBM and Adobe you see XML holds a prominent place in the inner workings of both IBM and Adobe products and projects. Microsoft's XML is in file formats, parsing and simple logic statements in SQL Server. Microsoft went from a vast XML-centric project load to bit parts and basic work for XML by late 2005.
All this while IBM and Adobe brought XML in as a framework for all their applications and projects.
Pro-Microsoft writers crow about past glory because they remember what Bill Gates used to say about XML and they remember all the demos using XML... they just forgot to update their information files to see where Microsoft is now in XML. They aren't.
Note this laughable article claiming Microsoft "owned" XML:
http://www.internetnews.com/dev-news/art...
Without the XML over http ecology the 6826744 and the coming 7076521 patents, Microsoft and Laszlo and many others in the industry were in a tizzy. AJAX has made a valiant effort to duplicate what patent 7076521 does. Go ahead and read the patent. Then come back here and give me another unfounded "crap!" statement like confused did. LOL
So all of you can whirl and dip and dodge all you want but the facts stand in your way... and in the way of Microsoft management... and the open-source movement who know the idea of web operating systems and web applications owes an acknowledgement to the VCSY inventors who developed these capabilities long before .Net existed.
Keep ignoring the facts, folks. It's a great way to remain ignorant and show yourself to be foolish. BUT, it IS your money, isn't it? Therefore, it's your responsibility to do your own study and due diligence.
Posted by I-Man | October 30, 2007 1:19 PM
I like this post so much...
(but for more you'll have to visit the Yahoo/Microsoft board)
... I decided to give it its own thread:
And vcsy_stock_scam wants you to believe VCSY is a stock scam with no way to survive much longer. It's what vcsy_stock_scam has been saying with his buddy for years. It's what those in the industry believed and poured their R&D dollars into building technology that would run over the "soon to be bankrupt" VCSY technology.
That was years ago and VCSY refuses to die. Now they received the money awarded them when VCSY won the VCSY v CDC/Ross Systems case earlier this year and I don't hear the posters here crowing about VCSY going "bankrupt" any more.
So the VCSY v MSFT case is 72 hours away from a discovery ruling and it's on to the Markman hearing where VCSY will be able to petition the court for an injunction against MSFT for infringement in their .Net and all derivative products and projects inside Microsoft and inside their customers.
It's been a long three years since the 744 patent was issued.
If you'll take a look at Laszlo Systems you'll see what Microsoft hoped they would be able to use once VCSY was destroyed. But, when industry players found in 2004 that VCSY would be issued the 744 patent in November 2004, Laszlo Systems pulled a skip-out and released their work into open-source October 2004.
Microsoft shut down all their XML bravado, lost Mark Lucovsky and tried to find some way of rebuilding their projects while hiding the use of XML in the company. You don't see much at all about XML in Microsoft from 2004 onward. In fact, google XML + Microsoft and compare the results with XML + IBM or XML + Adobe. with IBM and Adobe you see XML holds a prominent place in the inner workings of both IBM and Adobe products and projects. Microsoft's XML is in file formats, parsing and simple logic statements in SQL Server. Microsoft went from a vast XML-centric project load to bit parts and basic work for XML by late 2005.
All this while IBM and Adobe brought XML in as a framework for all their applications and projects.
Pro-Microsoft writers crow about past glory because they remember what Bill Gates used to say about XML and they remember all the demos using XML... they just forgot to update their information files to see where Microsoft is now in XML. They aren't.
Note this laughable article claiming Microsoft "owned" XML:
http://www.internetnews.com/dev-news/art...
Without the XML over http ecology the 6826744 and the coming 7076521 patents, Microsoft and Laszlo and many others in the industry were in a tizzy. AJAX has made a valiant effort to duplicate what patent 7076521 does. Go ahead and read the patent. Then come back here and give me another unfounded "crap!" statement like confused did. LOL
So all of you can whirl and dip and dodge all you want but the facts stand in your way... and in the way of Microsoft management... and the open-source movement who know the idea of web operating systems and web applications owes an acknowledgement to the VCSY inventors who developed these capabilities long before .Net existed.
Keep ignoring the facts, folks. It's a great way to remain ignorant and show yourself to be foolish. BUT, it IS your money, isn't it? Therefore, it's your responsibility to do your own study and due diligence.
Posted by I-Man | October 30, 2007 1:28 PM
Joe,
You make it sound as if you need an exorcist for your Macs.
I've updated my desktop at work to Leopard without a problem. There's no big-brother artifacts occurring.
I'm looking forward to upgrading our department's 200 machines in short order.
Posted by HG | October 30, 2007 1:33 PM
Hey HG, it seems to me that you're not an experienced IT guy...:
"I'm looking forward to upgrading our department's 200 machines in short order."
Who in is right mind would update 200 company machines with an OS that has been out for just a week? Be carefull or you might get sacked due to that one!
lol
Posted by Keeper | October 30, 2007 1:54 PM
Quoting Joe Wilcox:
"Microsoft made the hard decision, of putting safety before convenience. In some ways, Microsoft went too far. I spoke to three people over the weekend who had turned off UAC (User Account Control) because they found the pop-up notices to be too annoying. The off-switch defeats the purpose of having UAC. Microsoft would have done better taking on more of security decision burden from the end user. Even so, the fundamental approach is right from a security perspective."
----------------------------------------------------
Joe, I know that MS is now doing all the advertising on this site, but n0neXn0ne is right when he asks "What ever happened to Microsoft Watch?"
MS Watch did not get the MS advertising bucks because you were writting pro-ms stuff, but rather the truth, which they would like not to see.
Security and MS should not be mentioned in the same sentance, its a joke. Vi$ta with its new UAC is painfull for the average user, so most turn it off. Yes, there is a freeware tool out there that helps it, so why can't MS just buy the freeware tool, and put it into SP1 for Vista? Or fix it themselves, for that matter? Also, since I am now discussing 3rd party programs and fixes, the problems with Vista is that it breaks so many 3rd party programs, a long due to DRM and a few due to the UAC.
The advantages gained with the UAC in Vista over XP with all the 3rd party security apps to protect it, is most likely a step back in security.
Finially, your article title "Security: What Microsoft Can Teach Apple," is a really poor selection. Think rationally, it should be "Security: What Linux and Apple Can Teach Micro$oft, if they gave a **** about their users."
I know we all got to put bread on the table, and money got to come from somewhere. But try to remember which company has the OS with "all the viruses" on the internet.
MS should have focused more on security for Vi$ta, and not put all their time into crippling it with DRM and WGA. The DRM could have been made as an addon for those who wanted Blueray or Toshiba HD-DVD movie playback capability, as almost nobody at this time even has these drives in their computers. But then, the fact is, that DRM is doing more than that, which is why MS wanted it on all systems, even the ones without the new drives.
With the Storm Botnet (which only runs on windows) at some point, governments will mandate that M$ provide a "secure OS."
Posted by chips | October 30, 2007 2:06 PM
Quoting Joe Wilcox:
"Microsoft made the hard decision, of putting safety before convenience. In some ways, Microsoft went too far
and this would be a problem for Apple if it actually had any hacks that could spread something bad.... but you make it sound like Apple has security issues... it is not experiencing that, it has people actually trying and successfully hacking their own machines, those hacks can't spread to other machines as in the MSFT world where viruses ran unobstructed...
there still has not been a single legitimate virus for OSX where it could actually infect another machine without the user giving it permission to do so...
so what is Apple supposed to learn from Microsoft? how to create really lousy software that can be very un-secured?
jon.
Posted by jon | October 30, 2007 3:23 PM
How to beat Trolls at their own game.
"Web Ad Blocking Under Linux/Unix, BeOS, MacOS and Windows"
How To Block Ads, hence no ads no revenue!
This way you can still visit and have that fuzzy feeling that you stuck it to the man.
Posted by n0neXn0ne | October 30, 2007 3:46 PM
Ad server list for use with hosts files to block ads
last updated: 2007-10-29 14:56:15
Posted by n0neXn0ne | October 30, 2007 4:00 PM
I'm done with this thread.
**These are my opinions only and in no way are they meant to offend anyone. If for any reason you feel the need to contact me in any way regarding these post, especially for inappropriate wording or a perceived derogatory statement, please feel free to contact me. I am all over the Internet and you can find me there.**
Have a nice day.
Posted by n0neXn0ne | October 30, 2007 4:27 PM
"I spoke to three people over the weekend who had turned off UAC (User Account Control) because they found the pop-up notices to be too annoying."
"Even so, the fundamental approach is right from a security perspective."
Huh? Something is wrong here.
Posted by cesjr | October 30, 2007 4:55 PM
@Keeper
It pays to beta-test software, which is what we've been doing with Leopard for the past year.
Posted by HG | October 30, 2007 5:20 PM
Sorry Joe, we must be watching different things happening for the past few years. UNIX and every system based on it is the way to go.
Not the patch-me-if-you-can windows way to go.
We couldn't agree LESS.
Read more, document yourself, make some calculations...
One point for you: Wait 10.5.1, why rushing anyway, will be there in like 2 weeks, not 12 months...
Posted by Julien | October 30, 2007 9:15 PM
What have Vista versus Leopard teach Joe Wilcox :
1) Do NOT make any assumption unless you have actual use it . Perception kills
2) Do NOT change your standing in ONE Second :
a) Why Leopard is better than Vista
b) Why Leoprad isn't better than Vista
3) Do NOT dive your head only in consumer product , investigate and learn enterprise and business cases
a) Leopard only covers consumer market
b) Vista covers all market
4) Do NOT fall into "False-Expert Syndrome" . Comment sincerely what you know , not more than that.
5) Do NOT bash on a product constantly. Once an entry made, move to other issues.
6) Do NOT think that you can fool your reader
7) Do NOT be a fanboy of any Microsoft /Apple or Linux club
8) Do NOT get near Mr Steven of Linux Desktop
Posted by Marty | October 30, 2007 11:42 PM
In the real world: A relative is working as a temp for a large aerospace company in TX. They are tasked with producing Q/A reports involving lots of pictures imported from a digital camera and placed into Word documents. The windows XP system they were given is so troublesome and crash-prone, they brought in their personal MacBook and finished the work in record time. The department IT guy agreed that the MacBook was far more productive and said he would see about putting it on the company wireless network.
The next day a manager from corporate IT came down and demanded that the temp be fired immediately! He accused the temp of violating corporate security protocols and stated that no OS X machines would ever be allowed on the company network because of their inherent lack of security!
The Big Cheese left, my relative wasn't canned, but the MacBook had to go and now they struggle daily with a POS Windows machine that cuts their productivity in half.
Posted by Sally G | October 31, 2007 12:51 AM
Sally G, please substantiate your claim by providing real place and real name .
NASA claims that Mac Notebook is inferior as its battery life is shorter compared to a DEll Inspiron notebook running on Vista with 4GB RAM.
This experiment was done during the recent trip to ISS
Sounds real ?
But do you believe what I have just told you ?
Posted by Peter | October 31, 2007 2:31 AM
Wow, mac fanboy trap sprung!
You should be ashamed of yourself Joe for trolling these people.
John
info@steamteam.ca
Posted by john | October 31, 2007 4:01 AM
Maybe Micro$oft can teach Apple how to make their OS more prone to virus infections! After all, that's something at which Windows excels.
Micro$oft's approach to security is all wrong. They hva eot overhaul the entire OS. But, of course, that would break compatibility with legacy programs. But there's no other way if they want to realy secure their OS.
A practical middle approach for M$: write a totally new OS and market it in parallel with their insecure Windows product. When enough users begin to switch over, slowly kill Windows.
M$ probably won't do it though.
Posted by Maddog | October 31, 2007 4:31 AM
Dear Maddog , may be I can teach you to spell Microsoft correctly
It is Microsoft , not Micro$ft.
Every business is profit oriented , don't tell me you Maddog lives on oxygen only
Posted by Peter | October 31, 2007 5:17 AM
Peter
Maddog is upset because Linux doesn't make as much as microsoft does, in other words a very bad case of ....ENVY !!
Posted by Neil | October 31, 2007 6:23 AM
Joe,
You have been trolling Mac users for eons now. I remember you from Apple's 'beleagured' days.
Funny that M$ is the beleagured one now! If not financially (yet) at least in so many other ways.
How is Zune doing? Talk about a dog. Also, it seems Vista can't hunt.
I have an idea for Microsoft you could pass along to them.
Market a new verion of 'Vista' only call it Leopard P. I mean, they did it once with XP after X came out, why not try this approach again?
Posted by Brian | October 31, 2007 9:06 AM
maddog, neil: grow up.
joe: "Security: What microsoft can teach apple" . Yeah right...
Another one of these articles and I am removing this site from my RSS feed reader.
Posted by aha | October 31, 2007 9:28 AM
Peter, I gave an example about worker productivity and a corporate IT department's knee-jerk reactions and you want to talk about battery life?
WTF, over?
Posted by Sally G | October 31, 2007 11:14 AM
Sally G, my story of DELL battery is as dubious as yours , get it ?
Posted by Peter | October 31, 2007 7:56 PM
Sure Peter, everything we see, hear, or read is a lie, except of course Microsoft's EULA. Keep carrying that torch. It lights the way for all of us benighted fools.
Posted by Sally G | November 1, 2007 11:29 AM
It is really interesting to listen to the debate as to which system is more or less prone to software bugging.
A paraphrase of the old joke: The more monkeys that are given typewriters the more novels they will produce.
Once Apple has sold as many computers as there are Windows-based systems the number of malware attacks will probably equalize. The threat is based upon the reward of recognition; or in the case of spyware, audience.
Meanwhile, Mr. Gates and Mr. Jobs are laughing all the way to the bank.
Posted by hal | November 1, 2007 1:46 PM
Hmm...i see that blind, supid Apple sheeps are available everywhere, specially in USA :-)
C'mon people, Microsoft had the best software out there, even if i dont like them much i must confess that Vista is excellent OS with top security...
Times has changed...
Posted by 6205 | November 2, 2007 3:34 AM
Maybe if no ports are open then the firewall doesn't have to be enabled....
Posted by Partners in Grime | November 24, 2007 11:42 AM
Joe, I strongly object to turning off UAC on Vista. Anyone turning it off should realize that the UAC dialogs show up most frequently only the first few days that you have installed the OS. This should probably happen because you are changing some settings and installing lots of new programs. Once the system is setup, the UAC dialogs are very infrequent. I can attest to that as a power user. But here is a tip for any power users who actually get frequent UAC dialogs and gets annoying:
[] Create a desktop shortcut to cmd.exe.
[] Right click on the shortcut, go to properties->Advanced and check Run as administrator.
[] Keep the "elevated" command window opened at all times.
[] Run any elevated processes that you need to run from this cmd window, so you won't get any UAC dialogs. Even better, create aliases for your most frequent "elevated" programs.
Posted by moron | November 28, 2007 5:51 PM