On Jan 8, 2006, at 7:59 AM, James Fraser wrote:
on 1/8/06 6:28 AM, Mike Kauspedas at [EMAIL PROTECTED] wrote:
But that's a good thing right? The more people using OSX the better?
I'm not so sure... ¬_¬
I mean, Windows is everywhere you go, right? How has that necessarily
"improved" it in any way?
Well it IS an argument against evolution. Unfortunately for the
wingnuts, it can't really be an argument for Intelligent Design,
either ;-)
That said, because the greater mass of Windows users just don't know
any better, they think this is how computers just are.
Personally, I'd rather see OS X about where it is now in terms of
market
share for two reasons:
1) Less attractive target for black hat hackers. And, yes, I know
that
"security through obscurity" isn't supposed to work. Be that as it
may, the
more widespread a given OS is, the more attractive a target it is
simply
because the potential is there to affect more systems.
Exploits have been written (for a particular software product running
on Windows) that affected less than 50,000 systems world wide.
Security through obscurity may be a valid concept, but it doesn't
apply to Macs.
Folks have modeled virus propagation, and found that (depending on
the mode of transmission) as few as 5000 computers worldwide could be
efficiently targeted.
SQL Slammer only had a vulnerable population of about 120,000*
systems worldwide, but infected 90% of them within minutes. It was
something of a special case though. It had no payload, and it was
tiny, less than 400 bytes, so it fit in a single internet packet,
leading to very efficient transmission.
( I have several papers dealing with epidemiological modeling of
computer viruses on my system at work, if anyone wants, I can forward
them, but here is one starting place: <http://engr.smu.edu/~tchen/
papers/statmethods2004.pdf> )
Macs are FAR more prevalent than that.
Look at the latest Windows exploit, the WMF thing. That exploit has
existed since Windows has existed, and is a good example of how
Windows, as an entity, is more vulnerable.
It's a graphics file that can contain executable content, handled by
a process with Administrator privileges. AND it's susceptible to
buffer overflows.
I know that when buffer overflows started coming to light as a common
means of breaking into systems, there was a concerted effort in the
OSS (including BSD) community to root out places in the code where
this is vulnerable. Moreover, since the source code is freely
available, many many people could participate in this review. "All
bugs are shallow if you have enough eyes".
No matter HOW many people Microsoft employs, they can't match the
number of eyes n the Linux code; and since people working on Linux
are doing it solely because they want to, I suspect they're more
motivated.
As a result of this code review the various OSS *nix variants were
largely cleansed of this vulnerability, at least on the basic OS
level, and many others brought on by this enormous code review.
Finally, since these systems were designed from the very beginning to
be multi-user systems with network connectivity, from the outset Unix
has had a pretty robust security model in place.
Windows never did. In the beginning Windows was designed to be a
single user, unconnected system, or at the most connected to a LAN in
a business setting.
Remember how the advent of the "Internet" so shocked and dismayed
Microsoft in the 90's? Caused them to hurriedly incorporate all this
networking code into their systems? Buy Mosaic from Spyglass and turn
it into Internet Explorer?
The decisions made then, by programmers used to dealing with systems
secured by lack of connectivity (what determined how secure your
computer was, was the lock on your office door.) who were taking on
internet connectivity in a real crash project left Windows both as a
software product, AND a development culture, riddled with holes.
While only part of OSX is the BSD underpinnings, the vast majority of
OS X development has been directed and accomplished by folks from the
Unix world, where these issues have long been a major part of
software development.
NO I don't think that the lack of OS X viruses are due to any
"obscurity". It's just so much easier shooting fish in the Windows
barrel that the black hats don't bother.
*I doubt this oft-published number though It's derived from MS's
estimates of SQL Server installations. However, their embedded SQL
Server product was also vulnerable, and so a large number of third
party products: enterprise backup systems (arcserv, our backup
software., was affected) antivirus systems, version control software,
etc...any software that would benefit from having a database
component. That this variant of SQL Server was vulnerable was NOT
widely advertised, and worse, few of the product actually mentioned
that they had it as part of their system.
I'm certain vastly more that 120K systems were infected that weekend
--
Bruce Johnson
"No matter where you go, there you are", B. Banzai
--
G-List is sponsored by <http://lowendmac.com/> and...
Small Dog Electronics http://www.smalldog.com | Refurbished Drives |
-- We have Apple Refurbished Monitors in stock! | & CDRWs on Sale! |
Support Low End Mac <http://lowendmac.com/lists/support.html>
G-List list info: <http://lowendmac.com/lists/g-list.shtml>
--> AOL users, remove "mailto:";
Send list messages to: <mailto:[email protected]>
To unsubscribe, email: <mailto:[EMAIL PROTECTED]>
For digest mode, email: <mailto:[EMAIL PROTECTED]>
Subscription questions: <mailto:[EMAIL PROTECTED]>
Archive: <http://www.mail-archive.com/g-list%40mail.maclaunch.com/>
iPod Accessories for Less
at 1-800-iPOD.COM
Fast Delivery, Low Price, Good Deal
www.1800ipod.com
