Miller on Mac OS X, Chrome, Firefox, Economics
Linked by Thom Holwerda on Fri 20th Mar 2009 13:51 UTC, submitted by google_ninja
Privacy, Security, Encryption Fresh from winning the PWN2OWN contest yesterday, Charlie Miller has been interviewed by ZDNet. He talks about how Mac OS X is a very simple operating system to exploit due to the lack of any form of anti-exploit features. He also explains that the underlying operating system is much more important in creating a successful exploit than the bowser, why Chrome is so hard to hack, and many other things.
E-mail Print r 11   · Read More · 138 Comment(s) http://osne.ws/gc3
Permalink for comment 354377
To read all comments associated with this story, please click here.
RE[4]: Operating System Security
by MobyTurbo on Sun 22nd Mar 2009 00:18 UTC in reply to "RE[3]: Operating System Security"
MobyTurbo
Member since:
2005-07-08

"OpenBSD had those security features first, but OS X has relatively few of them; Unix does not have the same level of security for all it's variants, and in fact, other than the fact that you don't run as root most of the time, Unix is not all that secure an operating system unless the flavor adds additional security features and run secure programs. (Note how many remote root security bugs there were in sendmail(1) for example, running on the typical non-OpenBSD *BSD.) Oh well, at least Safari isn't in the kernel and used throughout the OS by programs via DLLs like Internet Explorer, if it was, OS X would *really* be in trouble.


I get the point of your post but there is no use resorting to lying by claiming that Internet Explorer is in the kernel.
"
I'm not lying, it was in Windows 98. Apparently this has been changed. I haven't had extensive experience with Windows as a user since about 2002, and before then I was using Windows 95. :-)

As for UNIX - what is UNIX? its a specification; there is nothing stopping any vendor from adding additional features in the case of security such as ASLR, encrypted swap, Sandboxes, etc. etc. To some how throw all 'UNIX' under one banner is ignorant of the fact that there is no such thing as a UNIX operating system - there are just implementations of it.
[/q]

That was exactly what I was pointing out, that just because OS X is Unix(r), doesn't mean that it is secure; because Unix isn't a terribly secure (or terribly insecure) operating system when you're talking about just the basic specifications like POSIX and SUS, etc. It definitely can use some additional hardening and features such as ASLR to make it truly secure. (Though there's no such thing as a "secure", i.e. non-exploitable, mainstream OS. That includes OpenBSD.)

Reply Parent Score: 1