Slew of OS X vulnerabilities found, Apple says to fix you must buy Panther for $129..

[Asher]

What an incredibly rational policy. Not only do you charge $129 each year for an incremental upgrade, you force them to upgrade if they want their machines ot stay secure. Brilliant.

http://news.com.com/2100-1016_3-5098...l?tag=nefd_top

Will Apple just patch Panther?
Last modified: October 29, 2003, 12:27 PM PST
By Robert Lemos
Staff Writer, CNET News.com

Apple Computer's latest version of its Mac OS X operating system, Panther, patches security flaws that affect previous versions of the operating system, leaving security experts wondering if users will have to pay the $129 upgrade fee to be secure.

On Tuesday, Apple released an advisory indicating that the Mac OS X 10.3 upgrade includes more than a dozen "security enhancements," none of which appears to have been applied to previous versions of the software. Apple's Security Updates Web page doesn't list the fixes for previous versions of the operating system.

"It is not a friendly thing to tell your customers to shell out a lot of money to stay secure," said Thor Larholm, senior researcher for software security firm PivX Solutions. "It would be a dangerous precedent, if they did."

Apple declined comment.

Typically, companies that charge for software provide security updates for the software for a certain period of time. Microsoft provides support for its products for about five years and releases service packs every year that include all the enhancements to the software. Microsoft doesn't charge for the service packs.

"Imagine if Microsoft tried to charge for security fixes--people would go crazy," Larholm said.

Linux vendors typically work things bit differently, as so much of the software they distribute is produced by developers outside the companies. Red Hat, for example, charges about $40 for its desktop edition and provides a year of updates for free. After that, users either have to pay $60 a year to join the company's Red Hat Network and receive updates or subscribe to a free service, such as Ximian's basic Red Carpet service. (Ximian is now owned by Novell.)

Apple's plan falls between the two models, offering bug fixes for free but charging $129 for the update to the operating system--the third time the company has released a new version since Mac OS X debuted in March 2001.

The current set of vulnerabilities include a flaw in the operating system that causes applications to be installed with insecure file permissions. Other vulnerabilities could let a local or remote user crash the system.

Security firm @Stake found four of the vulnerabilities and worked with Apple to fix them in time for the release of Panther. The advisories seem to indicate that Apple doesn't plan to release fixes for earlier versions of the Mac OS X. Each advisory says that users should either upgrade to Panther or turn off the affected software component.

PivX's Larholm said that Apple would have to release some patches or risk angering its users.

"They have stated that they want to release a new version of OS X every year, but this is the first time they have hinted that they will not be supporting any particular OS X version for more than that year, and that they expect all their customers to upgrade their operating system on a yearly basis," he said.

[muxec]

Is it just warez propaganda or real legalization of extortion??

[Q Classic]

hey! they're just like microsoft now with security updates!

gotta love apple. trying to beat bill at his own game, after being so thoroughly quashed trying to play his.

[ixnay]

Originally posted by Q Cubed
hey! they're just like microsoft now with security updates!

gotta love apple. trying to beat bill at his own game, after being so thoroughly quashed trying to play his.

Except that Microsoft doesn't charge $129 for each security patch.

[Q Classic]

i know! that's why job's method is better! he could get lots more money for patching than gates could.

[Asher]

Jobs knows how to milk money out of a blindingly loyal fanbase, he's one of the best there is for that. Coupled with a brilliant marketing department, Apple users gloat about the privledge of paying $130 each year for an OS.

[gunkulator]

Hmm, I notice a complete lack of details regarding these vulnerabilities. Note that Apple doesn't actually admit to any security holes in OS X. Instead we find out that a consulting firm scared Apple into paying them to "help" fix these alleged vulnerabilities. They wouldn't be very successful consultants if they found nothing, now would they?

"Imagine if Microsoft tried to charge for security fixes--people would go crazy," Larholm said.

Only because there have been so many, even MS doesn't have that much nerve.

[Asher]

Originally posted by gunkulator
Hmm, I notice a complete lack of details regarding these vulnerabilities. Note that Apple doesn't actually admit to any security holes in OS X.

Duh.
Apple doesn't provide technical details like MS does, they shove everything under the rug and label patches as "Security Enhancements" and they get to count them as one of the "150 new features in Panther!!!"

The security vulnerabilities no doubt exist, and they are no doubt fixed in Panther, but Apple seems to assume everyone pays $130 a year to upgrade.

[mrmitchell]

Who the hell wants to ruin a Macintosh owner's day? They're all arteests, connected with the gay mafia, or Asher-fighters. Don't they suffer enough as it is?

And who's going to attack an arteest? That would be like mugging a mime. It would be an easy buck but one without any dignity.

[Asher]

CNet updated the story half an hour after I posted this, adding:

David Goldstein, director of research for @Stake, a security company that found four of the vulnerabilities, confirmed that Apple said it wasn't going to patch the flaws in earlier versions of the software.

"In my initial conversations with them, they said they weren't going to fix 10.2, but I wouldn't be surprised if they change that," he said.

[Giancarlo]

Isn't this extortion?

[monolith94]

"Apple users gloat about the privledge of paying $130 each year for an OS."

The last time I paid for an OS was probably OS 9. Right now I'm running Jaguar.

[chequita guevara]

I would imagine that isn't legal.

[monolith94]

But it IS cheap.

[Q Classic]

technically, a lot of people could say that as well.

the most i've ever paid for an ms operating system is $15, which i plunked down at uchicago. because of the academic license there, everything is heavily discounted: visual studio for 30, office xp for 15, office 2k for 10.

[Kuciwalker]

I've never paid for an operating system, other than buying the computer

Once, when I was eight, I tried to upgrade my 95 computer to 98. That experience left me horribly scarred for life

[Wiglaf]

$130 isn't that much money. The security holes are vague at best, anyway. They certainly haven't affected anyone yet. How do you know Apple isn't planning to release a patch anyway? Just because their PR guy had no comment? Come on.

The whole idea of free patches is hokey, you know. If there's no money involved then there's no motivation involved. I'd rather plunk the big bucks and know I'm getting a (stylish,) secure product.

You're missing the big picture anyway. Microsoft has the most insecure products I've ever seen, despite their patches. Explorer can infect your whole computer just because you go to certain websites (source: http://www.siena.edu/antivirus/viruses/realphx.htm).

On the other hand, if there's $130 involved per user if they find a fix to all these massive glitches, maybe an updated, stable OS would be on the horizon.

Asher, you simply don't know what you're talking about.

[mrmitchell]

So if GM sells a car that lets a Ukrainian get your credit card information, should they charge you to fix it?

[Asher]

I love you Wiglaf.

Between you, Agathon, and Mr Nice Guy/Cloud9 -- you guys are certainly helping to establish a new stereotype to replace the current Mac stereotype of starving artists.

[monolith94]

"you guys are certainly helping to establish a new stereotype to replace the current Mac stereotype of starving artists."

And I'm helping to reinforce the old stereotype of the starving artist! I am so HUNGRY right now!!!

[Urban Ranger]

Originally posted by Asher
Apple doesn't provide technical details like MS does, they shove everything under the rug and label patches as "Security Enhancements" and they get to count them as one of the "150 new features in Panther!!!"

At least Apple fixs theirs, while MS tries to sweep everything under the rug. That's why you see the technical details, because impatient third party researchers discloses them in an effort to force MS to do something.

[Asher]

Originally posted by Urban Ranger
At least Apple fixs theirs

Hello UR, welcome to this thread.

Incase you haven't noticed, the entire point is they're not fixing them.

Have a nice day ,

while MS tries to sweep everything under the rug. That's why you see the technical details, because impatient third party researchers discloses them in an effort to force MS to do something.

MS does fix them, the vast majority of them are fixed and the discoverers cited in a MS TechNet bulliten with a detailed description and link to a free ( ) patch.

There's no need for "dirty underhanded tactics" like this, UR.

Especially when they're absurd claims like MS doesn't fix things until a third party "researcher" (which, more often than not, are *nix twerps out to grind an axe) reveals them...

[Nubclear]

Originally posted by Wiglaf
$130 isn't that much money.

Anyway.... This is....beyond words

[ghen]

Of course we see more Windows bugs, its used on 95% of the home computers in the world with 10x the software, usually freeware or shareware thats poorly coded. If the MacOS was in the same position we'd suddenly see huge gaping holes in its security that it would need to fix as much as Microsoft. The fact is, hardly anyone bothers writing Mac viruses, so why bother looking for security flaws?

[Spiffor]

I suppose Steve Jobs has given up the idea of increasing his marketshare?

[Q Classic]

no, see, because you have to pay for these apple updates, they're that much better than the free microsoft ones.

i mean, we all know how much free stuff can suck. look at lindows.

shrewd move.

[monolith94]

You don't pay for just the update, though - you get the whole new revamped OS. Also, iirc, this OS is supposed to make more efficient use of the new G5 chip, so it is quite an important OS.

[chequita guevara]

Kinda reminds me how people with Windows 5.0 had to pay $100 to upgrade to Windows 5.1, aka, Win2K and WinXP respectively.

[Q Classic]

see! that's why they're better than those microsoft updates.

you get what you pay for! just imagine how much money bill--er, how much better windows would be if you had to pay for service packs!

[Asher]

Originally posted by chegitz guevara
Kinda reminds me how people with Windows 5.0 had to pay $100 to upgrade to Windows 5.1, aka, Win2K and WinXP respectively.

Huh? They didn't have to upgrade.

Windows 2000 is still supported and will still be supported for years.