full-disclosure - Re: Question about Mac OS X 10.4 Security

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <9EE7EC161F19F7B659A25780@utd59514.utdallas.edu>
Date: Wed Mar  1 23:18:18 2006
From: pauls at utdallas.edu (Paul Schmehl)
Subject: Re: Question about Mac OS X 10.4 Security

--On Thursday, March 02, 2006 09:42:47 +1100 mz4ph0d@...il.com wrote:

> At 4:20 PM -0600 1/3/06, Paul Schmehl wrote:
>> So, Apple hasn't fully addressed this problem yet.  (Trust me, I've
>> tested it.)
>> If you are responsible for Macs and you haven't read this yet, you need
>> to:
>
> Safari and Mail. Sure, agreed, but they do move quickly to fix problems
> publicly known, and I'm very confident that they'll shortly also release
> a fix for the filetype/app problem (what could be considered the main
> problem I guess).
>
I suspect it will take a while.  The underlying problem has to do with how 
metadata in files is parsed by the OS.  Fixing that will likely take some 
serious brainwork, perhaps even a rewrite of some parts of the OS.  I don't 
think they'll be fixing it any time soon, although they may come up with 
some intermediate measures that lessen the exposure.

> Apple actually *do* tend to position security over functionality, unlike
> Microsoft (do?/has?), when the way something that was introduced as
> a feature is shown to be insecure, they change it to make it more
> secure, rather than saying "It's what our users want! It's a feature,
> not a bug."
>
I could care less about that.  Every vendor has their good points and their 
faults.  What I want is a vendor who recognizes when they've done something 
stupid, admits it and fixes it - permanently.

Paul Schmehl (pauls@...allas.edu)
Adjunct Information Security Officer
University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/ir/security/