News - Over 600,000 Apple Macs suffering from flashback

[Whiternoise]

Useful link perhaps? https://mashable.com/2012/04/05/mac-...-trojan-check/

"Windows is like living in a bad part of town with bars on the windows, OS X is like living in the country without any locks"

Most operating systems themselves are reasonably secure. Windows has gotten much better and OS X still has its UNIX roots to cling to. What hasn't changed is how easy it is to manipulate users into installing things and granting permissions. Nobody bothers wasting zero-day exploits on things like malware, you're better off just selling them to the government. As far as I can tell, this downloads itself via pages that have Java applets in them, so a little trickier than the usual dodgy installer.

It's a problem, OS X does warn you if you're installing or opening something that was downloaded. Does it make a difference? I bet most people just click yes, because they know what they downloaded, right? Similarly Windows has UAC, but people turn it off because they find it irritating.

What's good in OS X is that there is reinforcement whenever you need to escalate privileges - it's not like Windows where you click ok, you have to enter an Administrator password to use anything with an installer.

Unfortunately Apple uses a proprietary Java install, so you have to update through them. So this is more a problem with Apple dragging their feet than the OS (or in this case Java) being the problem. Though apparently no longer in 10.7, so the advice is still to get rid of Java if you don't need it.

[spoon_]

I'm wondering if Java update to 1.6_31 had something to do with this...

[BerZerk]

Software updating my MBP now

[crossy]

What's good in OS X is that there is reinforcement whenever you need to escalate privileges - it's not like Windows where you click ok, you have to enter an Administrator password to use anything with an installer.

Linux distro's do this too - in fact, some (see http://www.itproportal.com/2012/03/0...opensuse-rant/) may argue that they take this "requesting permissions" thing a little too far. Personally, I'm quite happy to have to confirm actions that are likely to change the system.

I'm also similarly comfortable with Windows7's UAC, and get pretty angry at these "experts" who claim it's unnecessary and should be switched off.

[watercooled]

I sometimes wish you could leave admin notes on PCs, something along the lines of 'you don't understand what it does so just leave it alone' would be good, attached to things like Win Update and UAC...