toggle

AAPL Stock: 506.04 ( + 3.83 )

MacNN News

MS blogger criticizes Apple's security

updated 09:00 pm EST, Wed March 22, 2006

Microsoft criticizes Apple

Microsoft program manager Stephen Toulouse today publicly challenged Apple to hire a security expert and overhaul the way information is released when Mac OS X updates are released. "Look, the only way you can tackle security issues is by getting out ahead of them and clearly communicating to your users the threat, and the clear guidance on how to be safe," Toulouse said. "Here's the reality, for the next couple of years the Mac OS will experience increasing security threats and mark my words, the company will have to seek outside expertise in the form of a head of security communications in the next 12 months," Toulouse added. The program manager said Apple needs a person "steeped in security issues, true technical analysis, and [who] can lead a good security team to get good guidance out there," according to a report from eWeek.com.

by MacNN Staff

(26)

TAGS :

troubleshooting

Share the Article

Facebook Twitter Delious Slash Dot Digg

toggle

Comments

bhuot
Fresh-Faced Recruit

Joined: Nov 2003

0

03/22, 09:09pm | report spam | close Reply |
must be a joke

This is a joke that anyone actually thinks that Microsoft knows anything about security. Microsoft admitted that even its latest offering - Windows XP has no security whatsoever. And people actually buy what Microsoft claims as servers from them. Windows is the only platform that people have to worry about viruses and other malware.

hayesk
Professional Poster

Joined: Sep 1999

0

03/22, 09:35pm | report spam | close Reply |
Ha ha

Agreed. Any employee of Microsoft has no business criticizing anyone on security.

dashiel
Fresh-Faced Recruit

Joined: Sep 2001

0

03/22, 09:41pm | report spam | close Reply |
glass houses

i don't necessarily disagree with this guy, hiring a dedicated security head will continue to keep apple and os x an exceptionally safe operating system. but let's be real here microsoft lecturing anyone on security is a bit like paris hilton lecturing someone on etiquette.

iamdravenman
Fresh-Faced Recruit

Joined: Mar 2006

0

03/22, 10:23pm | report spam | close Reply |
If I hadn't just gone...

to the bathroom, I'd seriously have pissed myself when I read this.

I doubt I can really add much to these comments, other than that it takes more than a chip change to make an OS weak. It takes a crappy OS to make a weak OS. OSX is not crappy. That didn't change when Apple moved to Intel, just the chip did.

Some people.

Senbei
Fresh-Faced Recruit

Joined: Feb 2004

0

03/22, 10:56pm | report spam | close Reply |
the only problem...

... is that it is difficult to find someone who is a true IT security expert. The expertise requires a breadth of technical knowledge which essentially spans the entire OSI model. To find such a person and to have them waiting to audit completed code at the end of the line would be a waste.

The place I worked for had one of these so called Information Security Officers and that person was pretty much useless aside from being a mouthpiece and point of contact. They got paid a good salary while adding an unnecessary layer of bureaucracy since even certain technical related issues (which went well beyond their knowledge level) had to go through this person.

What might be more useful is a corporate culture where every person involved is security conscious and that the auditing process involves everyone. A security team can be composed of key engineers, programmers, and security specialists who do the final audits as checks against audits done during the development instead of one security expert who for the most part will end up just being a PR mouthpiece.

Finally, it is fine that someone at Microsoft is so concerned but maybe they should tend to their own business instead of meddling in the business of others.

Interlard
Fresh-Faced Recruit

Joined: Oct 2005

0

03/22, 10:58pm | report spam | close Reply |
Mission Accomplished

Evidently this is mouthpiece from the G-Dubya-Bush school of public relations:

Talk like things are going your way. Enough idiots will believe you.

Fortunately, all the idiots already bought Windows so the rest of us are still safe.

Thorman777
Fresh-Faced Recruit

Joined: Sep 2003

0

03/22, 11:24pm | report spam | close Reply |
Stephen is right

I'm a long-time Mac user, and a Windows Admin for the last 5 years. 2 years ago I began the trek towards security administration, and now administer a rather large network of devices using Host-Based Intrusion Prevention Software (HIPS), firewalls, IDSs, etc... I say this so you'll know I have a clue, though certainly not expertise, in the area of network security and host security.

Stephen is right on the money - and I do mean money. Apple needs to directly address this issue now, because it will take years for a culture of security to begin to permeate Apple Computer. They need to conduct penetration testing and invest R&D into making Mac OS X the gold-standard for secure operating systems.

Apple has an opportunity here to penetrate the Enterprise market, and if they don't specifically address security and make it a priority the Enterprise market won't be impressed.

Yes, Mac OS X has holes in it - every OS does. Secunia lists 64 advisories since 2003 (http://secunia.com/product/96/), with 67% of them remotely exploitable. Apple, by publishing Darwin, has made it easier for the bad guys to figure out how Mac OS X ticks...

True believers will scream that "Apple is secure, you're a jerk!" and plug their ears. Those of us who want secure systems and want to use Mac OS X in the Enterprise will ask hard questions of Apple and watch to see if they take security more seriously. Case in point - check out the lame 'security' web page linked in small text at the very bottom of Apple's support page - http://www.apple.com/support/security/. Pathetic. Where are my white-papers? Where are the downloadable security tools that will walk me through securing my host or network of hosts? Where are the links to third-party vendors that can further secure my systems?

Working in Enterprise, this is the first time ever that I've heard people mentioning wanting to purchase Macs for servers or desktops... Primary reasons? Unix and security....

ZinkDifferent
Fresh-Faced Recruit

Joined: Jan 2005

0

03/23, 01:00am | report spam | close Reply |
That's fresh...

..Microsoft, security risk #1, lecturing Apple on security.

This must be part of the new Microsoft "Do as I say, not as I do" strategy.

zep79

Joined:

0

03/23, 01:27am | report spam | close Reply | delete
THIS JUST IN...

Osama Bin Laden says the Pope is an evil S.O.B.

kw99
Fresh-Faced Recruit

Joined: Nov 2001

0

03/23, 02:22am | report spam | close Reply |
Here we go again...

Since it is apparently very difficult (based on real-world evidence) to pose a real-world security threat to Mac OS X, other than "concept" malware that has to get the user's permission before taking action, the "security experts" are now resorting to challenging Apple's (supposed) lack of a "security expert" as the security threat to Mac OS X.

How desperate can these people get...?

vickys_box
Fresh-Faced Recruit

Joined: Jan 2003

0

03/23, 03:24am | report spam | close Reply |
We have product

The only reason Microsoft are mouthing off about this now is because of their Windows Defender software. Suddenly, they 'do' security so they feel the need to undermine competing organisations that don't appear to do so.

zep79

Joined:

0

03/23, 05:18am | report spam | close Reply | delete
developers

DEVELOPERS DEVELOPERS DEVELOPERS DEVELOPERS DEVELOPERS DEVELOPERS DEVELOPERS DEVELOPERS DEVELOPERS DEVELOPERS DEVELOPERS DEVELOPERS DEVELOPERS DEVELOPERS DEVELOPERS DEVELOPERS

legacyb4
Mac Elite

Joined: May 2001

0

03/23, 09:32am | report spam | close Reply |
Clear communication?

"Clear communication and clear guidance"...

Microsoft's updates always read something along the lines of:

"Vulnerabilities exist in Microsoft Windows that could allow remote code execution" and "...to be safe by always updating".

That's clear communication and guidance?

nat
Junior Member

Joined: Mar 2002

0

03/23, 09:59am | report spam | close Reply |
yellow journalism

you repeat it enough, people believe. the right has done this with "liberal media, liberal media, liberal media...". how many people out there now believe this without acknowledging the very real conservative media? what's that ms slogan? "Secure by design, default and deployment"? yeah, must be true... I BELIEVE!

and for the guy who has a clue, so suddenly these enterprise people are going to ask hard questions about Apple, these same people that apparently never asked any (let alone hard) questions about Windows security?

here's an experts take on OSX and Windows security...

http://www.theregister.co.uk/2003/12/16/windowsstyle_security_hell_stalks_mac/

groundwork
Fresh-Faced Recruit

Joined: Aug 2001

0

03/23, 10:04am | report spam | close Reply |
2 pages of comments....

...and only thorman had something worth saying. I guess even that ratio is surprisingly good.

ivandejesus
Fresh-Faced Recruit

Joined: Sep 2001

0

03/23, 10:06am | report spam | close Reply |
My biggest fear...

I run my W2K box behind a firewall with almost every port closed by default. It's never left on all the time. Even then, I'll be retiring it apart for a rare need for a Window application.

Whereas my OS X Powerbook is wide open to the net and I don't think twice about leaving it on the net all the time. There is no doubt the OS X is superior to W2K in security. However, the more I see zealots keep insisting that OS X is bullet-proof, the more I see people being more careless with security. I can bet you that these zealots aren't even system admins or programmers. If they were, they would know better than to insist that OS X is some sort of holy relic that is free of any security defects. It's a tired argument. Yes, OS X is secure. No, it's not invulnerable. Apple should be more proactive in security, lest they let their guard down and give up a huge advantage they have over Microsoft. Look what zealotry got the Taliban.

aristotles
Grizzled Veteran

Joined: Jul 2004

0

03/23, 11:21am | report spam | close Reply |
Hypocrite

I see he mentioned a security update going awry on some machines with Apple pulling back the update and re-releasing. Does anyone remember when the initial public release of XP SP2 resulted in 70% of machines not being able to come back up after reboot?

I'm sure someone will say that Apple has to support less hardware but think about how many mac models Tiger supports. They often have different chipsets between revisions for things like Firewire, USB and IDE controllers let alone between new product lines.

http://www.apple.com/macosx/upgrade/requirements.html

jhorvatic
Fresh-Faced Recruit

Joined: Apr 2005

0

03/23, 11:24am | report spam | close Reply |
What a Joke!

What Joke considering he comes from a company that has the worst record in the industry when it comes to security and systems being compromised just about every single day. Let's see Apple at this time, ZERO! Who's more secure? It doesn't take a mathmatics major to figure that out. Apple can easily meet your challenge but it seems you are having difficulty even getting your product released.

jhorvatic
Fresh-Faced Recruit

Joined: Apr 2005

0

03/23, 11:29am | report spam | close Reply |
Apple has been all along

Apple has been focused on security all along. Why do you think there hasn't been an OSX system compromised since it came out 5 years ago. The latest challenge from that college with the Mac mini proved how secure OSX really is. Unlike the cheat test that gave users local accounts and access to the machine that was published before. Apple picked the BSD unix enviroment because of its 25 plus year history and stability and most of all it's security. Apple has already proved itself as far as security goes.

mapleman
Fresh-Faced Recruit

Joined: Feb 2006

0

03/23, 01:35pm | report spam | close Reply |
$$$ seeds of doubt....

I don't see this as a friendly reminder in any way, I call this "undermining the competition". It's standard crass marketing practice....You just keep making negative statements about your competitors, and pretty soon the marketplace (and the media, which in this case LOVES stories about smug Apple users) starts repeating the babble as gospel. So if Apple overeacts on this, they're called desperate, and if they under-react, they're called smug. These "security experts" are basically a bunch of overpaid pariahs, if you ask me. Am I cynical when it comes to computer security? You better believe I am.

resuna
Fresh-Faced Recruit

Joined: Jan 2005

0

03/23, 03:24pm | report spam | close Reply |
microsoft first

Apple's biggest security problem is that they have copied Microsoft's appallingly stupid idea of having a single set of applications for use with local documents and documents offered by web pages. Microsoft, in addition, has a huge mass of other interconnects between the desktop and the browser that make that seem almost safe by comparison...

And given the amount of damage this has caused and continues to cause to the computer industry as a whole, already.

Let's get a competant security officer at Microsoft and give him the authority to do whatever it takes to fix Microsoft's appalling security failings. THEN we can start worrying about Apple.

milhouse
Senior User

Joined: Jan 2001

0

03/23, 04:03pm | report spam | close Reply |
Sound advice

Becuase M$ produces the most insecure OS on the planet doesn't mean that Apple won't need greater expertise in security.

I think the general message is on point: Better to be prepared for greater exposure on X86 systems.

sdf
Fresh-Faced Recruit

Joined: Aug 2004

0

03/23, 06:24pm | report spam | close Reply |
a czar as a substitute...

A "security czar" is nothing more than putting a face to security issues, rather than tackling the issues. If Apple has a lick of clue, each member of teams relating to security know more about the issues than this fool.

Appointing a "security czar" (what a stupid term) will do absolutely nothing to reduce the number of vulnerabilities in an OS unless he has time to sit at the shoulder of every developer and in on every meeting.

zep79

Joined:

0

03/24, 05:27am | report spam | close Reply | delete
What a joke

NOTHING can stop the iPod

machappy
Forum Regular

Joined: Jan 2000

0

03/28, 03:36pm | report spam | close Reply |
Amen brother

bow down to the ipod...NOTHING can stop the ipod! NOTHING!

gadallah

Joined:

0

04/12, 02:00pm | report spam | close Reply | delete
the core issue

It's hard to argue that Apple paying more attention to security would be a bad thing. However, it seems to me that the focus is on the wrong thing here (the platform).

Computers are tools, just like cars. They can be used in safe and unsafe ways. Their attributes may influence how easy (or difficult) it is to use them safely, but they do not possess any inherent saftey. A decrepit old Ford Pinto can be safely driven to the grocery store and back, and a new Volvo with all of the latest safety features can easily be wrapped around a telephone pole. The results are tied to the deployment and use, not the the vehicle. It is important to note that the results are also tied to a knowledge of the attributes and charateristics of the vehicle.

Being a long time fan of the OpenBSD operating system, I understand the main reason for its reputation of security is not that it is inherently secure, but that it is installed preconfigured such that the user must take explicit action to open up potential security vulnerabilities. I don't know how OS X stacks up these days in this regard, but generally, there is an inverse relationship between how easy a system is to deploy and configure and how secure its configuration is. This is a bit of a problem for Apple who has always promoted ease of use.

As to making OS X the gold-standard for OS security, I think that title goes to some Windows variant that crashes within 5 minutes, resulting in an absolutely secure system :-). There will always be a conflict between making an OS useful and desireable and making it secure (particularly in this heavily networked era), so pronouncements of this sort are not very productive.

The only religious comment I am compelled to make is that I think that OS X, Linux, FreeBSD, etc. are all inherently easier to secure than Windows is, because Windows has a number of deep, architectural security flaws that cannot be solved in a practical way. Undoubtedly there are flaws in OS X, FreeBSD, Darwin, etc. but it seems unlikely that any of them are as entrenched in the OS as the Windows problems. No matter how much MS dances about, this legacy design problem will haunt them forever until there is a clean break and a move to a completely new architecture (not bloody likely :-).

In the final analysis, I think the issue needs to be put this way: What is the best way for Apple to make users aware of security issues and provide them with mechanisms for dealing with them? This usually boils down to money: You can provide the users with more security support and hand-holding, and charge them more money, or you can leave them to their own devices, and charge them less money. I would not want to be responsible for setting the point between these extremes.

Personally, I don't have any problem with the kind of support Apple provides now, but I have to agree with the forecasts that say that the more OS X systems there are out ther

Show More Comments

Login Here

toggle

Network Headlines

02/17	Mountain Lion may drop support for...
02/16	Google, others said bypassing Safari...
02/16	Google now known to be patenting own...
02/16	SumOfUs criticizes FLA head, plans...
02/16	Safari 5.2, Xcode 4.4 seeds reach developers...

Show All

02/17	Mountain Lion may drop support for...
02/16	Google, others said bypassing Safari...
02/16	Google now known to be patenting own...
02/16	Cook sees merging of notebooks, tablets...
02/16	Apple claims backing for rights to...

Show All

02/16	Cook sees merging of notebooks, tablets...
02/15	Apple upgrades iBookstore with screenshots...
02/15	Congress asks Apple to answer questions...
02/14	Apple attempting to disrupt Siri hacks...
02/14	Readability iOS app delayed, Android...

Show All

02/17	Get $300 off refurbished 1.4GHz MacBook...
02/16	Garmin nuvi 4.3-inch Portable GPS Navigator...
02/15	Monster iCarPlay Wireless FM Transmitter...
02/14	Refurb. 16GB iPhone 4, now only $259...
02/13	Refurb. Flip UltraHD Pocket Digital...

Show All

toggle

MS blogger criticizes Apple's security

updated 09:00 pm EST, Wed March 22, 2006

Microsoft criticizes Apple

must be a joke

Ha ha

glass houses

If I hadn't just gone...

the only problem...

Mission Accomplished

Stephen is right

That's fresh...

THIS JUST IN...

Here we go again...

We have product

developers

Clear communication?

yellow journalism

2 pages of comments....

My biggest fear...

Hypocrite

What a Joke!

Apple has been all along

$$$ seeds of doubt....

microsoft first

Sound advice

a czar as a substitute...

What a joke

Amen brother

the core issue

Login Here

Register for our weekly email newsletter:

Connect tools:

Subscribe

to our RSS

Follow us

on Twitter

10 Most Read

10 Most Discussed

MacNN Marketplace

MS blogger criticizes Apple's security

updated 09:00 pm EST, Wed March 22, 2006

Microsoft criticizes Apple

Related Articles

Recent Articles

must be a joke

Ha ha

glass houses

If I hadn't just gone...

the only problem...

Mission Accomplished

Stephen is right

That's fresh...

THIS JUST IN...

Here we go again...

We have product

developers

Clear communication?

yellow journalism

2 pages of comments....

My biggest fear...

Hypocrite

What a Joke!

Apple has been all along

$$$ seeds of doubt....

microsoft first

Sound advice

a czar as a substitute...

What a joke

Amen brother

the core issue

Login Here

Register for our weekly email newsletter:

Connect tools:

Subscribe

to our RSS

Follow us

on Twitter

10 Most Read

10 Most Discussed

MacNN Marketplace