Thursday, 23 October 2003

Forde on the Rebel stretch run

Pat Forde has an interesting piece up at ESPN.com that takes a look at how the Rebels’ season may be shaping up this year; like Forde, I’m cautiously optimistic, and I think this Saturday’s game against Arkansas (6:15 Central on ESPN2) will be a bellweather for the rest of the season.

The virus-free fallacy

Joy approvingly points to a Wall Street Journal piece by Walter Mossberg that starts by saying:

Windows is riddled with security flaws, and new ones turn up regularly. It is increasingly susceptible to all kinds of viruses, malicious Trojan horse programs and spyware. As a result, Windows users have been forced to spend more of their time and money supporting their computers.

Almost every week, they are supposed to install patches to the already patchy operating system to plug these security holes. And every few months, it seems, Windows users must quake in fear as some horrible new virus is created by the international criminal class that constantly targets Windows.

But for consumers and small businesses, there’s a simple way out of this endless morass: Buy an Apple Macintosh computer. There are no viruses on the Macintosh’s excellent two-year-old operating system, called OS X. And the Mac is a terrific computer—as good as, or better than, Windows for the typical computing tasks important to mainstream users.

Now, Mossberg does correctly point out that OS X isn’t completely immune from virii, trojan horses, worms, and the like (sometimes collectively referred to as “malware,” although these days pretty much any “malware” will just be called a “virus” even if it isn’t one). But his argument still rests on a few problems:

  1. The “security through obscurity” fallacy: “In addition, Macs constitute such a tiny share of the world’s computers that they just aren’t an attractive target for virus writers and hackers.” True enough; however, that never stopped people from writing malware for earlier versions of the Mac OS, nor did it stop malware on a plethora of relatively obscure platforms in the past (at its peak, the Amiga probably had more virii going around than PC operating systems of the day, despite a much smaller market share).
  2. “OS X doesn’t enable users—or hackers who hijack user accounts—to alter certain core files and features of its Unix underpinnings.” True enough; however, as OS X users get used to typing their password to gain administrator access (as they are prompted to do with every Apple-sponsored update), social engineering hacks—like fake update prompts—will be easy enough for malware authors to incorporate into their tools.
  3. OS X ships with a lot of software that traces its lineage back to the 1970s Berkeley Standard Distribution (BSD) of Unix; while some of it has been audited, most notably by the OpenBSD project, some of it has not been. Until the past decade, network security was just not a serious concern of Unix programmers, and there could easily be holes lurking in some of the software included, particularly in server-side applications (which, to Apple’s credit, are normally disabled by default).

OS X, and other Unix-based and Unix-like operating systems like Linux, are no panacea for bad security practices in general. As Microsoft improves the lackluster security of its offerings, it is likely that we will see more problems as the proverbial “honeypot” that is Windows becomes less appealing to hackers.

Speaking of OS X, Mark Pilgrim has a lengthy overview of what’s new in OS X 10.3 (aka Panther).