Miller on Mac OS X, Chrome, Firefox, Economics
Linked by Thom Holwerda on Fri 20th Mar 2009 13:51 UTC, submitted by google_ninja
Privacy, Security, Encryption Fresh from winning the PWN2OWN contest yesterday, Charlie Miller has been interviewed by ZDNet. He talks about how Mac OS X is a very simple operating system to exploit due to the lack of any form of anti-exploit features. He also explains that the underlying operating system is much more important in creating a successful exploit than the bowser, why Chrome is so hard to hack, and many other things.
E-mail Print r 11   · Read More · 138 Comment(s) http://osne.ws/gc3
Thread beginning with comment 354181
To view parent comment, click here.
To read all comments associated with this story, please click here.
RE[2]: Operating System Security
by MobyTurbo on Fri 20th Mar 2009 18:54 UTC in reply to "RE: Operating System Security"
MobyTurbo
Member since:
2005-07-08

OpenBSD had those security features first, but OS X has relatively few of them; Unix does not have the same level of security for all it's variants, and in fact, other than the fact that you don't run as root most of the time, Unix is not all that secure an operating system unless the flavor adds additional security features and run secure programs. (Note how many remote root security bugs there were in sendmail(1) for example, running on the typical non-OpenBSD *BSD.) Oh well, at least Safari isn't in the kernel and used throughout the OS by programs via DLLs like Internet Explorer, if it was, OS X would *really* be in trouble.

Reply Parent Score: 0

kaiwai Member since:
2005-07-06

OpenBSD had those security features first, but OS X has relatively few of them; Unix does not have the same level of security for all it's variants, and in fact, other than the fact that you don't run as root most of the time, Unix is not all that secure an operating system unless the flavor adds additional security features and run secure programs. (Note how many remote root security bugs there were in sendmail(1) for example, running on the typical non-OpenBSD *BSD.) Oh well, at least Safari isn't in the kernel and used throughout the OS by programs via DLLs like Internet Explorer, if it was, OS X would *really* be in trouble.


I get the point of your post but there is no use resorting to lying by claiming that Internet Explorer is in the kernel.

As for UNIX - what is UNIX? its a specification; there is nothing stopping any vendor from adding additional features in the case of security such as ASLR, encrypted swap, Sandboxes, etc. etc. To some how throw all 'UNIX' under one banner is ignorant of the fact that there is no such thing as a UNIX operating system - there are just implementations of it.

Edited 2009-03-21 00:26 UTC

Reply Parent Score: 1

MobyTurbo Member since:
2005-07-08

"OpenBSD had those security features first, but OS X has relatively few of them; Unix does not have the same level of security for all it's variants, and in fact, other than the fact that you don't run as root most of the time, Unix is not all that secure an operating system unless the flavor adds additional security features and run secure programs. (Note how many remote root security bugs there were in sendmail(1) for example, running on the typical non-OpenBSD *BSD.) Oh well, at least Safari isn't in the kernel and used throughout the OS by programs via DLLs like Internet Explorer, if it was, OS X would *really* be in trouble.


I get the point of your post but there is no use resorting to lying by claiming that Internet Explorer is in the kernel.
"
I'm not lying, it was in Windows 98. Apparently this has been changed. I haven't had extensive experience with Windows as a user since about 2002, and before then I was using Windows 95. :-)

As for UNIX - what is UNIX? its a specification; there is nothing stopping any vendor from adding additional features in the case of security such as ASLR, encrypted swap, Sandboxes, etc. etc. To some how throw all 'UNIX' under one banner is ignorant of the fact that there is no such thing as a UNIX operating system - there are just implementations of it.
[/q]

That was exactly what I was pointing out, that just because OS X is Unix(r), doesn't mean that it is secure; because Unix isn't a terribly secure (or terribly insecure) operating system when you're talking about just the basic specifications like POSIX and SUS, etc. It definitely can use some additional hardening and features such as ASLR to make it truly secure. (Though there's no such thing as a "secure", i.e. non-exploitable, mainstream OS. That includes OpenBSD.)

Reply Parent Score: 1

Read more of this thread... >
siride Member since:
2006-01-02

IE was never in the kernel. I don't know where people get this kind of stuff from.

Reply Parent Score: 4

MobyTurbo Member since:
2005-07-08

IE was never in the kernel. I don't know where people get this kind of stuff from.
It was never in the NT kernel, i.e. not in any recent version of Windows. It was in Windows 98. Sorry.

Reply Parent Score: 1

Read more of this thread... >
Kalessin Member since:
2007-01-18

Some people seem to think that because Microsoft said that it was integral to the OS and couldn't be removed that must mean that it was in the kernel. I'd say that the Windows login is integral to the OS, but there's no way that that's in the kernel. I don't see why IE would have to be in the kernel for Microsoft to claim that it was integral and unremovable.

Now, granted I don't know what is and isn't in the kernel in any particular version of Windows, but I'd be very surprised if an internet browser was ever in any kernel of any operating system.

Reply Parent Score: 1

Read more of this thread... >