"Mac OS X hacked in half an hour"

[jæd]

Post deleted : Realised that the Editor was actually agreeing with me about the first test being flawed...

 

[jæd]

Don't wriggle please. You made a claim that I "defended the original test and its conclusions." That is a lie.

Ok, sorry. I accept that you realise that the first test was flawed....

 

[lobster]

vapourware has excisted for a long time "http://en.wikipedia.org/wiki/Vapourware"

 

[tom k&e]

(not installing the main user as root for a start)

Ah yes, but you can set the root password from the default user in about 5 clicks.

 

[dada]

pause.
a bit of side-track, but quite a , at least for me.

 

[fractionMan]

vapourware has excisted for a long time "http://en.wikipedia.org/wiki/Vapourware"

what has that got to do with the price of fish?

 

[ecadre]

The point about the original test and the news story was that it misrepresented what had actually happened. The implication was than an ordinary Mac OSX computer was put on the web in the ordinary way and was then "hacked".

Well, that was not true. People were able to log-in as a local user, and what happened then was a local escalation of privileges. The vast majority of of Macs will be sitting behind hadware or software firewalls and will have most ports blocked. My NAT firewall will not even let though an SSH request.

How many of you give user log-in accounts to anybody and everybody to your desktop computer? How many servers give user log-in accounts to anybody and everybody?

So, this was not simply someone hacking into a Mac which happend to be connected to the internet. The only thing it proved was the slack standards of journalism at zdnet.

 

[ecadre]

Are you trying to say that virii are the product of an anti-capitalist consipracy?

It's "viruses"

 

[editor]

For the record, the challenge was abandoned early because the sysadmin at the univ had fucked up and not bothered to ask permission from the university authorities first. Doh!

I bet they weren't too pleased either!

 

[Bernie Gunther]

The aspect of OSX that makes me wonder is the BSD core of the OS.

Specifically all that 30 yr old network code that nobody understands anymore.

That's a double-edged sword though.

 

[lobster]

>>The aspect of OSX that makes me wonder is the BSD core of the OS.
Specifically all that 30 yr old network code that nobody understands anymore.
That's a double-edged sword though.<<

I am sure the BSD core of the os gets audited faily regulary.
I would not say nobody understands the 30 yr old network code, it would be brave to say it.

 

[Bernie Gunther]

It's pretty obscure stuff and the level of community understanding compared to say the Linux network code is relatively low. I agree that some people probably have deep understanding of it, but I bet the numbers are very low.

That means exploits are relatively hard to find, due to maturity and obscurity, but they're also hard to fix, due to a lack of qualified experts.

 

[Dask]

Specifically all that 30 yr old network code that nobody understands anymore.

That's a bit of a dumb statement, of course people still understand the original C code that was used to write the unix network infrastructure.

There are tens of thousands of people who live and breath that code every day.

 

[lobster]

You could say the same for algorithms for performing encryption, throughout the modern maths based encryption algorithms there are not 100s, the reason being that they take several years before there actually used in applications due to frequent testing, academic papers etc..

 

[Bernie Gunther]

I think in a case like this the size of the community doing QA is a significant factor. I'm sure people like Andre Opperman understand it, but the mass of people who are actively involved in QA really matters in a case like this.

 

[cybertect]

Specifically all that 30 yr old network code that nobody understands anymore.

Hmm. If the BSD network code is a problem, then practically every OS on the planet is at risk as they all use parts of it

 

[tendril]