OSNews

Who's talking about advising Norton?

Apple should be responsible. They should've released an official MAC Defender-removal tool within days of its arrival. They should've updated applications like Safari, the unzipper, Mail.app, and so on right away to recognise and block the trojan.

We know Apple’s security process is slow on the uptake—that’s the real issue—but we can’t jump to the conclusion that Apple won’t ever do those things.

sorry I wasn't talking about the Norton part, although its good to mandate an AV solution on corporate computers.

This is social resposability:
http://www.microsoft.com/security/pc-security/antivirus-rogue.aspx

Microsoft cares about user security more than any other company. Microsoft Security Center offers info about different kinds of malware and social enginering scams. Also, Microsoft gives an Antivirus for free.

They do care about security more than any other company, but they we're dragged there with a gun to their heads, it wasn't always (or mostly) like this.

Not more than any other company, maybe more than Apple. MS provides an AV because due to the legacy of its terrible security in the recent past, there are many orders of magnitude more Windows viruses, than viruses for any other OS.

oh damn that's funny. Where you making a joke or did you actually type that with a strait face?

If Microsoft cared more than any other company we would have a modular Windows install. Everything including a web browser and basic image rendering libraries wouldn't be deeply embedded into the kernel. Privileged separation would be implemented in a strong manner instead of the wet cleanex separation between regular users and administrators. We'd never have had regular programs needing administrator rights to run. They would deliver anything but "good enough" quality product. We wouldn't have the immense "antivirus echosystem" that's remained so well supported by every Windows version so far. In all likelihood, Microsoft would be producing Windows under an open source license to take advantage of the expert peer review available; it seems to work for Cryptology and they tell me that relates closely to security.

I mean; keep some perspective. Microsoft cares more about user security than Apple. Sure. But "more than any other company"?

NortoN? You're kidding right? Just use the OS X port of ClamAV http://www.clamxav.com/ OSS to the rescue again...

Nah, you get whats coming to you if you blindly follow every advertisement and install random sketch files because the flashy thing says to.

Take it the same way as the "Nigerian", everyone has revived some variant of this, it's been floating around for DECADES, and yet every few months we hear yet another story of some moron that tossed their life's savings into the abyss.

Exactly. I've been around Windows machines for ages and have seen dozens of scams like this where a real-looking window pops up that says you have a virus and would you like us to scan/clean for you? HELL NO! I realize not all users are educated enough to realize this UNSOLICITED offer is not legitimate, but the whole process does require you to enter your administrator password, and then later enter your credit card number, which one would think would look awfully suspicious, but I guess it doesn't to the "average" user. To me this is even stretching the definition of a virus, which to me is something that takes over your computer completely without your knowledge or authorization having simply gone to an evil web page or opened a legit-looking jpeg file from someone you know in an email from them.

I do think Apple should inform customers if something is found on their computer and cleaned up, such as this problem is, it is a very easily remedied problem, only taking 5 minutes to get rid of. Then the customer would be educated next time they see something like this pop up on their machine.

In old lingo, it would be classified as a Trojan; a program which apears desirable while hiding an undesirable function.

In the newer lingo, it would be classified as "computer based social engineering; exploits a social situation or emotion with something delivered by computer versus delivered by more direct human interaction.

- fake AV (exploits fear of malware while actually delivering a malware payload)
- addware (exploits desire for a program while secretly stealing information)
- email spam (often exploits greed or fear to elicit a response)

All computer based social engineering. Human based social engineering would be the more traditional:

- phone calls
- impersonation

I wonder if you are missing the point. If there is a real security threat, Mac Users should be informed, especially since it is their heedlessness (those that are affected, not all Mac users) which contributes to the problem. There is NO need to recommend that users use Norton. There IS a need to reinforce the notion that no unsolicited software should ever be allowed to install by typing in your password. By not admitting the problem, Apple ignores a great opportunity to use this as a teaching point in the One-on-one program, which many of the unsophisticated users purchase. The same goes for Genius appointments. Both of these programs provide exceptional value for Mac users. Why undermine them?

They should educate users to either buy through the App Store or to NOT just type in their password and hit 'OK' when they're web surfing and happen to get a sudden prompt. But God no, don't push Norton or crap like that - not to mention, exploits routinely get past those until they have them in their profile, which means... yeah, you better just not blindly type in your password when the prompt shows up.

But then, somehow that escapes large numbers of computer users.

Maybe Lion will have a 'lock-down' by default to red-flag any software not signed / delivered through a secure channel. That's not to say it shouldn't allow it (I know I'm personally not interested in having a full-fledged machine that I can't even do my own development anymore!), just that many non-tech users would be safer if it had more warnings about the software being unsafe - or even making users go to Preferences to specifically authenticate and click on 'Allow Unsafe Programs'. Maybe people would thing a second time?