Slew of OS X vulnerabilities found, Apple says to fix you must buy Panther for $129..

[Q Classic]

Panther is a major release too...bigger than XP, actually.

really now? let's see... panther builds on the chassis of jaguar, adding a slew of new features and fixes, but no major kernel, infrastructure, or computing paradigm shift.

xp threw out the 9x kernel, adopted the nt kernel, incorporated a good bit of the 9x apis into the new os, then added a slew of new features and fixes, changing the kernel, the basic infrastructure, and created a paradigm shift for anybody using windows os.

yes, so i guess you're right. panther was a bigger launch than xp.

which is why so many more people attended the panther launch events than the xp launch event, and let's not even bother comparing it to the office 2003 launch events.

===

You provide no proof... you provide NOTHING! And yet you want to destroy Apple, you irresponsible

[Spiffor]

Originally posted by Q Cubed
xp threw out the 9x kernel, adopted the nt kernel, incorporated a good bit of the 9x apis into the new os, then added a slew of new features and fixes, changing the kernel, the basic infrastructure, and created a paradigm shift for anybody using windows os.

Didn't Win 2000 do that?

[Asher]

Win2000 was a major release, but wasn't for consumers, was for businesses and professionals.

Not to mention XP was a major revision to 2000.

[Wiglaf]

So because Apple has a rather lame security policy in hiding the details from people, all bugs are therefore minor?

You're assuming something more ridiculous: that all bugs are therefore major. You need to provide more proof than a "lame disclosure policy" to allege extortion.

Look: from the details released, it is more than enough to know it can cause serious harm. All it takes is one buffer overflow error to compromise a system: that's how MS Blast worked, and we do know that OS X suffered the same kind of flaw.

What details released? A security firm met with Apple to discuss potential security risks in Panther and how to correct them. Great. If you want to run around claiming a potential exploit, ie buffer overflow, then provide specifics of the potential exploit. Don't just say CNET heard it mentioned and therefore Jaguar is compromised.

Apple did not plan on patching earlier versions of OS X. They said this to @Stake, and they said this in their BugTraq disclosures -- they just now said they would patch them, because of the bad PR.

They would have no need to patch an earlier version of OSX if there were no major bugs. You have no specifics whatsoever; you have no clue as to the potential for an overflow or anything. For all you know the security firm was off base.

You provide no proof... you provide NOTHING! And yet you want to destroy Apple, you irresponsible

What?

Win2000 was a major release, but wasn't for consumers, was for businesses and professionals.

Not to mention XP was a major revision to 2000.

XP was a step backward from 2000. The improvements were largely cosmetic and ridiculously demanding on hardware. Don't get me started on the compatablity wizard (oh wait that's old too).

[Urban Ranger]

Originally posted by Q Cubed
xp threw out the 9x kernel, adopted the nt kernel, incorporated a good bit of the 9x apis into the new os, then added a slew of new features and fixes, changing the kernel, the basic infrastructure, and created a paradigm shift for anybody using windows os.

What paradigm shift?

Don't forget, Windows 2000 is NT 5.0, and XP is NT 5.1. Doesn't look like any major improvement there.

[Asher]

Originally posted by Wiglaf
You're assuming something more ridiculous: that all bugs are therefore major. You need to provide more proof than a "lame disclosure policy" to allege extortion.

A buffer overflow is a buffer overflow. I don't know why this is hard to understand for you.

What details released? A security firm met with Apple to discuss potential security risks in Panther and how to correct them. Great. If you want to run around claiming a potential exploit, ie buffer overflow, then provide specifics of the potential exploit. Don't just say CNET heard it mentioned and therefore Jaguar is compromised.

This is so lame -- Apple refuses to release the details, but admits they were there and did fix them. If you can use a buffer overflow to run code of your choice, it's a major vulnerabity. Period. There are no shades of grey. As soon as you have one, you can run the code of your choice. This is why they're a major headache.

So saying "yes, there was one, but they fixed it -- now prove it was major!" is beyond ridiculous, especially when Apple has an NDA on the specifics.

They would have no need to patch an earlier version of OSX if there were no major bugs. You have no specifics whatsoever; you have no clue as to the potential for an overflow or anything. For all you know the security firm was off base.

If the security firm was off base, why did Apple fix over 12 of these bugs?

XP was a step backward from 2000. The improvements were largely cosmetic and ridiculously demanding on hardware. Don't get me started on the compatablity wizard (oh wait that's old too).

Tell me more.

How about the new GDI, the new kernel which handles dual processors more efficiently, etc.

[Q Classic]

If you buy a $1000-2500 computer but can't put up the $130 for a major upgrade to its operating system, then sorry, you shouldn't have bought the computer in the first place, because you're in a really interesting financial circumstance.

$130 is not easy money for everyone. but i guess i'm wrong about that, wiggy.

===

Didn't Win 2000 do that?

win2000 was the continuation of the nt line. it did not do that, unless you want to consider microsoft throwing out the nt kernel with nt 3.1.
xp, on the other hand, was the synthesis of the 9x and nt lines. instead of being primarily for business and professional applications, it was meant for everyone. that's why it was a major release.

===

XP was a step backward from 2000. The improvements were largely cosmetic and ridiculously demanding on hardware. Don't get me started on the compatablity wizard (oh wait that's old too).

i'll admit that xp comes with a bunch of **** turned on that you don't need, like the damn fisher-price theme. that's why you tweak it. with most of that **** turned off, you can have it humming along on a first-generation pentium with only 64mb of ram, as i've done it for 12 computers at work because 98 acts like **** with 2k3's active directory.
furthermore, it was a step forward: combining two separate kernel and api lines into one os is quite a feat, not unlike what apple did for osx, combining a piss-poor os9 and below api set with a beautiful freebsd chassis. osx's original release has its closest analogue on the windows side to the xp release... both are steps forward, but in different directions.

and the compatibility wizard in xp? ditch it. go d/l the application compatibility toolkit on the ms site. works a lot better.

[Q Classic]

What paradigm shift?

Don't forget, Windows 2000 is NT 5.0, and XP is NT 5.1. Doesn't look like any major improvement there.

for the average user, who used win95/98/98se/me, going to xp was a paradigm shift. instead of using an outdated kernel, they had to get used to the quirks of an entirely different sort. that xp made the crossover as easy to do as it did is quite impressive.

for the business user? i'll agree. very little change there.

[Urban Ranger]

Originally posted by Q Cubed
for the average user, who used win95/98/98se/me, going to xp was a paradigm shift. instead of using an outdated kernel, they had to get used to the quirks of an entirely different sort. that xp made the crossover as easy to do as it did is quite impressive.

It wasn't bad, but a lot of older programs (mainly games I reckon) have problems running on XP.

The NT kernel is a bit better than the 9x one, being more stable. It also has a better FS, but the underlying design is pretty much the same, namely a desktop computer OS with a networking layer kludged over it, instead of designed from the ground up as a networking, multiuser OS.

[Urban Ranger]

Originally posted by Asher
A buffer overflow is a buffer overflow. I don't know why this is hard to understand for you.

It's different depending on whether the hole is in Mindsweeper or the kernel.

[Wiglaf]

This is so lame -- Apple refuses to release the details, but admits they were there and did fix them.

You've got to elaborate on what holes Apple admits are there.

If the security firm was off base, why did Apple fix over 12 of these bugs?

Sorry, what 12 bugs? I see "security enhancements," which refers to everything from Filevault encryption to easier access to downloads. Nothing about specific bug fixes.

the only reason why i actually get some of the software i get is because i either pay student rates, work at a place where they have volume licensing, or --and i'm only half-ashamed to admit it-- what i pirate. as for games? i can usually crack the cd protection if we buy them cooperatively, or i pirate those too.

Q Cubed, basically what you're telling me is that you're a broke, software stealing cheat. No wonder $130 scares the crap out of you. Everything on a CD should be public domain, viva la piracy, whatever. Apple's fortunate not to have your crap "business."

Start paying for your goddamn software, budget your expenses for a week, month, whatever, and - assuming you've still got that drive for a foolproof OS - go and get yourself Panther. Otherwise go and crack another CD code or something. Keep your sob stories to yourself from now on and I will too.

Anyone who is responsible and has a job can hold off on an unnecessary expense and afford Panther eventually. Deliver a few pizzas, be a man, earn the money. This is the one area where Asher is worth admiring. Despite his parent's oil fortune, he supposedly works nonetheless to account for his computing expenses. There is a man who wants to work despite not having to, thus a man who wants the capitalist system in general to work. He clearly thirsts for this country despite being a Canadian or whatever. You are already in the United States, dammit. Take pride in working, and spending money. Tack on $130 to your $20000 debt if you have to.

*braces for a gripping explanation on why Q Cubed blew $1700 on a college computer*(was the video card a necessary expense? )

[Q Classic]

Everything on a CD should be public domain, viva la piracy, whatever.

wiggy, wiggy, wiggy... don't try and stuff politics which are not mine into my mouth. i've never said anything saying that everything should be public domain, or that piracy is a good thing.
just because i like linux as a toy does not mean that i'm one of the open-source fundies.

Apple's fortunate not to have your crap "business."

well, with apple users like you, no wonder people are switching in droves.

wiggy, i'm tired of this argument. you obviously are so right that there's no point in continuing this, because i'm just wrong wrong wrong wrong wrong. everybody can **** out $130, i guess i'm just not using the right laxative.

[mrmitchell]

Originally posted by Wiglaf
Anyone who has a job and a computer can wipe his ass with $130 bills any day of the week.

Mr. Wiglaf, thanks for letting us know that you're the one counterfieting those odd $130 bill fakes we've been seeing recently. It is a shame that such an outward patriot could be a godless unamerican communist. This information will be turned over to the federal authorities.

[Kuciwalker]

Originally posted by Wiglaf
Asher-

"Security firm @Stake found four of the vulnerabilities and worked with Apple to fix them in time for the release of Panther."

Are there any more specifics about these "vulnerabilities" ? You haven't said anything more about them. Who do they affect, what do they do, have they done it before, etc etc. Is there a formal writeup on them anywhere?

Skywalker, if Apple has no need to continue supporting its old software then it will not. You have no reason to think there are security vulnerabilities in previous versions of Mac OS that weren't already fixed on Apple's support site. Unless you buy this as yet unwarranted article.

And even if there were a minor security flaw Mac OS, $130 is nothing. You bought the computer, you're serious about security. Don't be a cheap bastard now.

So, after paying that much for the computer, I should expect to pay money to fix problems that SHOULDN'T HAVE BEEN THERE IN THE FIRST PLACE?

[Wiglaf]

Again, you and Asher have no specifics as to what problems are even there. So don't get carried away and assume the worst when in fact there is no hard evidence that any security risks exist at all.

And secondly, my point was that $130 isn't much money in general, not necessarily that patches should cost anything. Panther, though, provides minor security enhancements to Jaguar (i.e. easier downloads) and various overhauls in other aspects. It is more than a patch. And neither you nor Asher has shown that there's any need for a free patch to even be released in the first place. EXACTLY what is Apple holding over our heads here?

Q Cubed seems to think that $130 is an ungodly amount of money, but then again he is a burglar. For everyone else, it is a mangeable expense anyway. There are really two arguments at work here: whether $130 is a lot of money and whether or not there are any security flaws in Jaguar to begin with. I win both of them, so everyone's happy.

Mr. Wiglaf, thanks for letting us know that you're the one counterfieting those odd $130 bill fakes we've been seeing recently. It is a shame that such an outward patriot could be a godless unamerican communist. This information will be turned over to the federal authorities.

Nothing is more american than wiping your ass with $130 bills, COUNTERFEIT or not. And step back a second, look at your avatar, and leave the country. That is disgraceful.

[Q Classic]

$130 an ungodly amount of money? that's not what i said. then again, i've retracted all of my ad hominems against you, because you're so right, and i should be shitting money out of my ass.

[Wiglaf]

If that's your term for "buying things" then yes, shitting money out your ass would be a good thing.

The problem with robbery is that you are easily irritable and confused when confronted with the need to actually pay for something. Be more economical, responsible, and legal, and you're fine.

[muxec]

I can not understand people who are discussing Plug&Pay product for a merely 110 posts... Not less than 500 posts should be here tommorow!

[Kuciwalker]

Wiglaf. There was a bug. Apple is releasing a new version and discontinuing support for the old version, forcing people to pay money to keep getting support. Microsoft doesn't do this - it keeps support OS's even after a newer version is out.

[Gatekeeper]

Originally posted by Asher
I am not going to go to some Mac fansite so I can be inundated with people like Agathon and Drake who don't have a clue what they're talking about and think they're right.

There you go again with your stereotypes and assumptions. MacCentral isn't a "fansite" so much as it is an overall site, of which the forums are only a part of. Furthermore, you would find out that not all people who use Apple's products are "fanatics" if you could be bothered to even scope those forums out a bit. One person who's posts are quite interesting is MikeS, and he's far from being a reactive Apple user.

My best friend is a loyal Mac user, and he's very competent with computers (same year CS as me, builds RAIDs and computational clusters for the biochem research at the uni), and he concedes virtually every point when I debate with him about it -- his only response is "So? I like it". Which is basically the only valid response there is.

Hey, cool. There are also folks who have opposite experiences, or experiences somewhere in-between of the Mac/PC relationship you have with your friend.

Gatekeeper

[Asher]

Originally posted by Gatekeeper
There you go again with your stereotypes and assumptions. MacCentral isn't a "fansite" so much as it is an overall site, of which the forums are only a part of. Furthermore, you would find out that not all people who use Apple's products are "fanatics" if you could be bothered to even scope those forums out a bit. One person who's posts are quite interesting is MikeS, and he's far from being a reactive Apple user.

Then tell him to come here.

I've been on Mac sites before (MacAddict, MacNN), and they truly depressed me.

In fact, a few minutes ago I was looking for information about Athlon 64 support in Photoshop 8/CS, and I ran across some MacNN comments about the PCWorld benchmarks...

they have to be lying i use both pcs and macs i do like the apple **** better but they even have the prices wrong $2999 For a single 1.8 its 2,399 not 2999 they have a hidden agenda.

the tests they run are all retarded (except for the photoshop ones, which the G5 wins) Premiere? (why not final cut, there is a reason they don't make Premiere for the mac anymore) Word? (gee, I wonder what operating system that will run better under) Quake III? (I think game speeds have a little more to do with video cards, and video drives, which I would say are still better on the PC end). These tests are no surprises, but they really arn't that good of tests..

Any more posts like that and my head would explode.

[Wiglaf]

Asher, you think you're so hot, you can't even tell me what exactly is wrong with Jaguar that Apple supposedly doesn't want to fix. Both you and skywalker. You have provided nothing but one crappy CNET article that talks about rumored security flaws that for all you know turned out to be nothing serious.

LAME

[Asher]

Originally posted by Wiglaf
Asher, you think you're so hot, you can't even tell me what exactly is wrong with Jaguar that Apple supposedly doesn't want to fix. Both you and skywalker. You have provided nothing but one crappy CNET article that talks about rumored security flaws that for all you know turned out to be nothing serious.

LAME

Yes, it is LAME.

And if you want the technical details of how the buffer overflow is obtained, ***** at Apple for not releasing the details. I can't pull them out of my ass and give them to you, Apple's being "LAME" and has an NDA on the details.

All we know is the buffer overflows did exist, and once you have a buffer overflow it doesn't matter the technical details of how it's obtained -- the result is always (ALWAYS) the same.

[Fve Crathva]

If there aren't any big bugs to fix, then $130 is especially ridiculous.

SP

[Q Classic]

If that's your term for "buying things" then yes, shitting money out your ass would be a good thing.

that's not my term for buying things. that's my interpretation of what you seem to be saying about money: it's easy come, easy go. we all have oodles of it, and shouldn't think twice about spending it.
guess i'm just wrong when i don't see things that way.

The problem with robbery is that you are easily irritable and confused when confronted with the need to actually pay for something.

wtf? i have no confusion in regards to actually having to pay for goods and services. i know that's how the economy works. and i do actually pay for goods and services, believe it or not. unlike you, my **** isn't made out of money, so i can't be as free-spending as you.
there's also a difference between burglar and thief. i haven't burgled (broken into) anybody's house or computer, so i'm not a burglar. a thief? yes. do i wish i weren't? yes. do i feel that developers should be paid for their efforts? yes, particularly since i am one, at least for my personal use. do i need some of the software i can't afford? yes. if they had libraries that allowed you to borrow some of that software, i'd use 'em. but they don't.
so please, wiggy, don't wig out because not all of us have your circumstances.

Be more economical, responsible, and legal, and you're fine.

wiggy... how many times do i have to say this? economical and responsible i am. otherwise, i wouldn't be at that school or be able to afford the books. sure, i could fork over $130 yearly on an os upgrade, or spend it on other things. does that mean $130 is chump change, easy to spend, easy to use, easy to earn? no. and the crux of our argument here, wiggs, is that you seem to imply that $130 isn't a lot of money, while i'm saying it is. $130 is anywhere from 5% to 10% of most computers when they're first purchased. after usage and depreciates it, it can ballon to 50 to 75%. if that's what you consider just a cheap, small investment, then so be it, but i'm saying it's not.

[Wiglaf]

Asher -

Apple would be retarded to release details on how to obtain a buffer overflow. It's actually their policy not to.

And while it puts you in a tough position, if you want to talk extortion, you really do need more details as to the vulnerabilities and their affects on Panther versus Jaguar. Sorry.

For all you know Jaguar doesn't even suffer from some of this crap: http://docs.info.apple.com/article.html?artnum=61798

And contrary to what your *****ing and moaning, Apple is still patching Jaguar anyway.

You owe them an apology.

[Asher]

Originally posted by Wiglaf
Asher -

Apple would be retarded to release details on how to obtain a buffer overflow. It's actually their policy not to.

So why the hell are you getting on my case for not providing details?

And while it puts you in a tough position, if you want to talk extortion, you really do need more details as to the vulnerabilities and their affects on Panther versus Jaguar. Sorry.

Look, it's VERY simple. We already know that it involved buffer overflows. ALL buffer overflows allow you to run code that you shouldn't be able to run, called an "elevation of privledges". This means that with any buffer overflow, you could write code to simply delete everything it has access to, replicate to spread to others, etc.

So it doens't matter if Apple doesn't release the specifics, Bugtraq and CERT have already published enough information that we need to know that it is a buffer overflow, and therefore a major vulnerability.

And contrary to what your *****ing and moaning, Apple is still patching Jaguar anyway.

You owe them an apology.

I owe no one an apology, Apple is patching Jaguar BECAUSE of all of the *****ing. They said clearly to @Stake and in their "vendor response" section of their release, that the solution was to "upgrade to 10.3". They've now changed their minds due to the bad publicity.

Perhaps you owe people like me an apology.

[Wiglaf]

So why the hell are you getting on my case for not providing details?

You alleged extortion...

Look, it's VERY simple. We already know that it involved buffer overflows. ALL buffer overflows allow you to run code that you shouldn't be able to run, called an "elevation of privledges". This means that with any buffer overflow, you could write code to simply delete everything it has access to, replicate to spread to others, etc.

So it doens't matter if Apple doesn't release the specifics, Bugtraq and CERT have already published enough information that we need to know that it is a buffer overflow, and therefore a major vulnerability.

We seem confused here. From where I'm sitting, Panther has vulnerabilities that only a patch compatable with Panther will fix. From where you're sitting (Canada?), Jaguar has vulerabilities that only Panther will fix. Give me a link or something.

I owe no one an apology, Apple is patching Jaguar BECAUSE of all of the *****ing. They said clearly to @Stake and in their "vendor response" section of their release, that the solution was to "upgrade to 10.3". They've now changed their minds due to the bad publicity.

Perhaps you owe people like me an apology.

Well if they've changed their minds, everything's dandy. It's not like MS never cornered the browser market to eliminate healthy competition. All people like YOU have done is make apple release a dummy patch to get people to shut the hell up. Thanks for the dummy patch but I would rather shoot myself than download it.

If there aren't any big bugs to fix, then $130 is especially ridiculous.

It's a deal, actually. http://www.apple.com/macosx/

Q Cubed - $130/yr is peanuts to maintain a computer that you claim you're serious about. Do you have a job? Consider it a necessary expense. And next time you go to buy a laptop, don't overspend so much. Some decent apple laptops go for $1090. You wasted what, $700 just on the laptop in the first place. How responsible...

[Asher]

Wiggy:



If you're some kind of DL, this is brilliant stuff.

[mrmitchell]

And next time you go to buy a laptop, don't overspend so much.

He's already said he wanted it to stay fresh and not obsolete as long as it could. And remember that prices were higher when he bought it, as well.

You owe them an apology.

Your unpatriotic self owes the US an apology. Turn on FOX--Rumsfeld just held a special press conference to say he was coming out of the closet.