Miller on Mac OS X, Chrome, Firefox, Economics
Linked by Thom Holwerda on Fri 20th Mar 2009 13:51 UTC, submitted by google_ninja
Privacy, Security, Encryption Fresh from winning the PWN2OWN contest yesterday, Charlie Miller has been interviewed by ZDNet. He talks about how Mac OS X is a very simple operating system to exploit due to the lack of any form of anti-exploit features. He also explains that the underlying operating system is much more important in creating a successful exploit than the bowser, why Chrome is so hard to hack, and many other things.
E-mail Print r 11   · Read More · 138 Comment(s) http://osne.ws/gc3
Thread beginning with comment 354167
To view parent comment, click here.
To read all comments associated with this story, please click here.
RE[2]: Comment by sadyc
by sadyc on Fri 20th Mar 2009 17:57 UTC in reply to "RE: Comment by sadyc"
sadyc
Member since:
2005-11-10

Let me get this straight, you are implying we all should take our hours of work and donate it for free for the betterment of a corporation?

No ;)
Let put it in another way: If somebody is spending a significant numbers of hours to find a way into your home, without you asking him to do so, means it is ok for him to sell that information and make money from it?
BTW, people that make phishing sites also spent hours of work; does that makes it ok for them to make money from them?

Finding security holes (especially without being hired by the target party) is a gray area because the usage of the found breaches totally depends on the moral of the person.
Greed for money usually leads to questionable moral choices.
Exactly the moral choices differentiate between a white hat and a black hat.

Reply Parent Score: 3

RE[3]: Comment by sadyc
by Bounty on Fri 20th Mar 2009 18:14 in reply to "RE[2]: Comment by sadyc"
Bounty Member since:
2006-09-18

Let put it in another way: If somebody is spending a significant numbers of hours to find a way into your home, without you asking him to do so, means it is ok for him to sell that information and make money from it?


Nobody is doing that though, and regardless of what Mr. Miller does, there will be people spending hours breaking into Apple and Microsoft. If I knew for a fact that people were spending hours trying to figure out how to break into my home, I would happily pay a grey hat to preemptively find those bugs. And I completely understand if a grey hat didn't want to give that info to me for free.

Mr. Miller works for a security company. Obviously they are not getting paid by Apple for their bugs. They probably are paid by banks etc. So Mr. Miller does some Apple research to let the banks know what their risks are for using Apple software. It's like working as a plumber. I don't see plumbers going around notifying us of potential leaks in our houses that could cause damage.

Hell I wish I could be so lucky as to have an electrician come over, audit my house, demonstrate a fire hazard, then ask for $ to fix it. If he can't he walks away broke. Does anyone go around inspecting car brakes for free?

Reply Parent Score: 4

RE[3]: Comment by sadyc
by soonerproud on Fri 20th Mar 2009 18:16 in reply to "RE[2]: Comment by sadyc"
soonerproud Member since:
2008-03-05


No ;)
Let put it in another way: If somebody is spending a significant numbers of hours to find a way into your home, without you asking him to do so, means it is ok for him to sell that information and make money from it?
BTW, people that make phishing sites also spent hours of work; does that makes it ok for them to make money from them?

Finding security holes (especially without being hired by the target party) is a gray area because the usage of the found breaches totally depends on the moral of the person.
Greed for money usually leads to questionable moral choices.
Exactly the moral choices differentiate between a white hat and a black hat.


You are comparing apples and oranges. (literally when talking about Apple ;) ) I don't make billions of dollars from my home by claiming it to be the most secure house and almost all houses are as easy to break into as knocking out a window. Apple makes billions promoting OSX as the most secure OS and yet they have failed to lock it down properly. They need to hire guys like Charlie if they are to actually ever fully secure the OS and browser.

Charlie finds a exploit in a proprietary OS and browser after many hours of careful research. He is not obligated to give Apple that info for free when Apple sells OSX for $129 each copy to millions of users world wide. Charlie works for a legit security company and he used this exploit to display his talents so that in the future, Apple would give his company business to find exploits. There is nothing fishy going on here and there is no selling to the highest bidder. It was advertisement pure and simple, yet you keep reading his comments on the subject that he implied that his exploits were for sale to the highest bidder. He never said that nor implied it whatsoever.

Reply Parent Score: 3

RE[4]: Comment by sadyc
by sadyc on Fri 20th Mar 2009 18:34 in reply to "RE[3]: Comment by sadyc"
sadyc Member since:
2005-11-10


You are comparing apples and oranges. (literally when talking about Apple ;) ) I don't make billions of dollars from my home by claiming it to be the most secure house and almost all houses are as easy to break into as knocking out a window. Apple makes billions promoting OSX as the most secure OS and yet they have failed to lock it down properly. They need to hire guys like Charlie if they are to actually ever fully secure the OS and browser.

True.
However, don't forget this "finding security holes in others products for money" is called a gray area for a reason.

Reply Parent Score: 1