Slew of OS X vulnerabilities found, Apple says to fix you must buy Panther for $129..

[Gatekeeper]

I'd hope so. They don't call it MacCentral for nothing. That said, there are some PC users there ... but like Mac folks at 'Poly, they're outnumbered 100 to 1.

Come to think of it, there are folks there who use both systems as well, and find both useful to some degree.

Gatekeeper

[Wiglaf]

so wiglaf, try and remember not everybody is out of the woods, financially. some of us have other, quite tangible things we're responsible for, ones which take up a larger chunk of our resources than we'd like.

stfu.

If you buy a $1000-2500 computer but can't put up the $130 for a major upgrade to its operating system, then sorry, you shouldn't have bought the computer in the first place, because you're in a really interesting financial circumstance.

***** and moan about extortion once you can prove a) there are major holes in your current OS and b) that Apple intends to provide only a paid option to fix said holes.

But you can't purchase a $1500 computer and then act like $130 is over your head. Does anyone here actually have a serious computer? And a need for every little security hole in their new OS to be patched? Then if you can't afford a $130 pricetag to quench your need for perfection, I'm very suprised indeed.

"I'm poor and offended" gets you the moral high ground, but not much else.

[Asher]

Originally posted by Gatekeeper
The day I see Asher go to the Web site link I provided and post what he posts here — along with the arrogant attitude that seems to permeat his Apple-related topics — there is the day I'll grant him more respect when it comes to his views on Apple. If he can go there and defuse the counter-arguments they throw at him, more power to him.

Those people are more than welcome to PM me.

I am not going to go to some Mac fansite so I can be inundated with people like Agathon and Drake who don't have a clue what they're talking about and think they're right.

My best friend is a loyal Mac user, and he's very competent with computers (same year CS as me, builds RAIDs and computational clusters for the biochem research at the uni), and he concedes virtually every point when I debate with him about it -- his only response is "So? I like it". Which is basically the only valid response there is.

[Kuciwalker]

Wiglaf - microsoft fixes security bugs for FREE, and continues support for years. Apple doesn't continue support beyond the next release, and CHARGES to fix bugs.

[Wiglaf]

XP was not free.

http://www.info.apple.com/

[Asher]

Originally posted by Wiglaf
XP was not free.

http://www.info.apple.com/

Of course XP was not free -- XP was a major release.

MS is on a 5-year release cycle, for $99 upgrades. Apple is on a 1-year release cycle, with $129 upgrades.

Do the math.

[Wiglaf]

http://docs.info.apple.com/article.html?artnum=25524

http://docs.info.apple.com/article.html?artnum=61798

[Wiglaf]

Of course XP was not free -- XP was a major release.

Panther is a major release too...bigger than XP, actually.

http://www.apple.com/macosx/

[Kuciwalker]

However, with the release of XP they are still releasing FREE security fixes for 2000.

[Asher]

Originally posted by Wiglaf
Panther is a major release too...bigger than XP, actually.

http://www.apple.com/macosx/

It is in no way a bigger release than XP...not even close.

[Wiglaf]

Asher-

"Security firm @Stake found four of the vulnerabilities and worked with Apple to fix them in time for the release of Panther."

Are there any more specifics about these "vulnerabilities" ? You haven't said anything more about them. Who do they affect, what do they do, have they done it before, etc etc. Is there a formal writeup on them anywhere?

Skywalker, if Apple has no need to continue supporting its old software then it will not. You have no reason to think there are security vulnerabilities in previous versions of Mac OS that weren't already fixed on Apple's support site. Unless you buy this as yet unwarranted article.

And even if there were a minor security flaw Mac OS, $130 is nothing. You bought the computer, you're serious about security. Don't be a cheap bastard now.

It is in no way a bigger release than XP...not even close.

What makes you think that?

[Asher]

Originally posted by Wiglaf
Asher-

"Security firm @Stake found four of the vulnerabilities and worked with Apple to fix them in time for the release of Panther."

Are there any more specifics about these "vulnerabilities" ? You haven't said anything more about them. Who do they affect, what do they do, have they done it before, etc etc. Is there a formal writeup on them anywhere?

You can blame Apple for that one -- they don't have the same full disclosure policy of Microsoft.

The @Stake people contacted them and worked to fix them, Apple told them they didn't plan to patch anything prior to 10.3 and all of the Bugtraq postings in the "vendor response" section said "Upgrade to 10.3" to fix the bug.

Since the bug was resolved, Apple was very vague in what they were and didn't release details. MS releases the details, Apple doesn't.

What makes you think that?

WinME -> WinXP was like OS 9 -> OS X.

[Wiglaf]

The @Stake people contacted them and worked to fix them, Apple told them they didn't plan to patch anything prior to 10.3 and all of the Bugtraq postings in the "vendor response" section said "Upgrade to 10.3" to fix the bug.

To me that means the bug is minor at best. To you it means there's a major glitch that Apple is holding over its desperate consumers. We can go back and forth and this all day.

You have no proof there is any real danger to users who don't purchase Panther and you certainly cannot accuse Apple of holding anyone hostage. This thread is irresponsible.

You can blame Apple for that one -- they don't have the same full disclosure policy of Microsoft.

This is ****ing hilarious. For one thing, you're assuming a major security breach simply because Apple doesn't write up essays on harmless glitches. For another, you assume that a full disclosure policy means something, when in fact its completely nonbinding and policed internally.

After all this, your real complaint is that Apple's "vendor responses" haven't met your every whim. Give me a break and don't waste everyone's time like this again.

[Spiffor]

Originally posted by Wiglaf
You have no proof there is any real danger to users who don't purchase Panther and you certainly cannot accuse Apple of holding anyone hostage. This thread is irresponsible.

You hear Asher?

You provide no proof... you provide NOTHING! And yet you want to destroy Apple, you irresponsible

[Asher]

Originally posted by Wiglaf
To me that means the bug is minor at best.

So because Apple has a rather lame security policy in hiding the details from people, all bugs are therefore minor?

This is ****ing hilarious. For one thing, you're assuming a major security breach simply because Apple doesn't write up essays on harmless glitches.

Look: from the details released, it is more than enough to know it can cause serious harm. All it takes is one buffer overflow error to compromise a system: that's how MS Blast worked, and we do know that OS X suffered the same kind of flaw.

Just because Apple doesn't release the details on how it's exploited doesn't make this a minor flaw -- a buffer overflow that leads to elevated privledges and running the code of an attacker's choice is bad, period.

After all this, your real complaint is that Apple's "vendor responses" haven't met your every whim. Give me a break and don't waste everyone's time like this again.

Haven't met my every whim?

Apple did not plan on patching earlier versions of OS X. They said this to @Stake, and they said this in their BugTraq disclosures -- they just now said they would patch them, because of the bad PR.