Related articles

• Alan: So things like “sandboxing” are designed to prevent unforeseen vulnerabilities from being transformed into large exploits. Dino: Yes, as the name suggests, “sandboxing” is meant to contain the spill in the event of a compromise. Sandboxes don’t actually prevent exploits, however. They more prevent those exploits from taking other actions on the system. For example, Google’s Chrome has a very restrictive sandbox for Web rendering processes. And while this won’t prevent an exploit from executing arbitrary code, it will prevent that executing code from harming your system. Alan: You've really been able to adapt your knowledge from PowerPC era to the Intel-Mac era. With the upcoming Snow Leopard, Apple will be implementing features such as ASLR, code signing for kernel extensions, full NX bit support, and sandboxing for many of the main applications. These are all features currently supported by Vista. How is this going to help secure the Mac? How does "sandboxing" really work when Chrome's first exploit allowed remote applications to be launched from Java, and IE8 was recently exploited at this year's CanSecWest? Dino: I haven't looked at Snow Leopard yet due to the pre-release NDA, but I am glad to hear that they will be implementing those features.   Alan: You know actually, as you were saying that, I just realized that I don’t think it’s actually 100% confirmed yet. It’s really just the blogsphere right now. But let’s assume that this is what Snow Leopard will add. How is that going to change things? Dino: I hope their implementations are sound and I will definitely be buying and installing Snow Leopard on all of my systems from Day One. All of these security features hamper attacks at multiple stages. ASLR and NX make it much more difficult for an exploit to inject or re-purpose code in an application. The sandboxing limits the actions that an application can perform so that even if it does begin running attacker-supplied code, the actions that the attacker may perform will be constrained. Finally, kernel extension code signing prevents attackers from installing new software into the core of the operating system. Attackers often install rootkits into the kernel in order to conceal their attacks and maintain access to compromised systems. There is a difference between operating system-level and browser-level sandboxing. Chrome is the only Web browser to implement browser-based sandboxing. This is a highly smart move on their part and the main reason that Chrome was not compromised at Pwn2Own this year. The limitation of Chrome's sandbox model, however, is that it cannot sandbox Web browser plugins such as Flash and Java. These plugins need full access to the system, so the sandboxing system used for Web content renderers cannot be used. The Web content rendering processes are highly limited and cannot touch the file system at all. Breaking out of the Chrome renderer process sandbox would be an impressive feat in itself.

• Apple has come a mighty long way since the first release of Mac OS X. Things have developed nicely and the next version of OS X, Snow Leopard is being primed for release. Things I would love to see Apple do: Provide more up-to-date hardware upgrades. The Windows PC world has far better hardware than the Mac crowd and it’s frustrating. Apple needs to provide more graphics card upgrade options and be quick to make them available. This is why I still have my Windows PC on stand-by, for times when I need to take a stab at the latest games. Apple doesn’t need to support every graphics card out there on the market but it needs to make at least some of the cutting edge products available. Sound products for consumers are also very limited. I’d like to see a little more variety here. There are several options out there like the Azuntech X-Fi Prelude 7.1 which does Dolby Digital Live and DTS Interactive. Apple needs to take a step forward and start working with a select few like Azuntech to bring more flavor for its users or those considering a switch. As for processors, Apple’s selection of Intel Xeon and Core 2 processors are pretty much up there. No complaints in this department. Memory wise, Mac Pro users are stuck with using expensive ECC memory, although this is understood, Apple’s online Store prices memory upgrades at stratospheric prices. This brings us to Apple’s pricing for upgrades and options. Most people already feel that a ticket into a Mac platform is already expensive and understandably so — an equivalent Dell laptop with similar specs to a middle of the ground MacBook Pro costs significantly less. But even if a customer already wants to buy a Mac, prices for options at order-time are ridiculously insane and need to be reduced to more real-world prices. Apple’s 750 GB SATA option for a Mac Pro costs $300 compared to a Seagate Barracuda 7200.10 ST3750640AS 750 GB which costs just $119.99 at Newegg. C’mon Apple. Apple’s got an 8-percent market share now and boasted that it’s the third largest U.S. manufacturer of computers means that it needs to get real with pricing schemes if it wants to poach more users from the Windows world.

• Exaggerated pricing myths on Apple systems aside, Apple’s biggest selling tool is Mac OS X and the fact that you can now run Windows XP or Vista on the same machine native. With BootCamp, you can get the best of both words in a general sense. Let’s make it clear though that if you’re a serious gamer who plays games like Crysis, you would still be held back because of the lack of high-end 3D graphics support. The latest for the Mac is a Radeon HD 3780 — good but not the best available. For most other games and everything else, it really works nicely. Windows drivers for the Mac are fully provided by Apple to enable all hardware on the Mac to work in Windows. So you get a full Mac and a full Windows system. You get the best of Mac OS X and the best of Windows on one machine. At this point, some people will say something like "well the only reason why BootCamp is provided to install and run Windows is because Windows is better." This is not the point. If you already have a PC and enjoy it and find it does everything you need, stick to it. If you’re in the market for a new system to replace a main desktop, this is the article for you. If someone is insistent on one thing, there’s no reason to continue reading. If they’re open to new ideas and new ways of doing something, then read on. The operating system continually refines itself and Apple markets this OS as the ultimate desktop experience. Lest there be any confusion, Apple also sells OS X Server although the market for OS X server is admittedly very tiny. Who needs pretty graphics in a serious server environment anyway? Most of the time, there no head attached to a server — things are administered through a remote terminal. Mac OS X is also based on a very robust UNIX foundation, which lends itself to being quite secure and powerful. However, given that the market share for Macs is much smaller than Windows, its prevalence to attack ratio is also lower. There are simply a greater number of Windows machines to be exploited. If the market shares were reversed, we would see Mac OS X exploited at a far greater level. However, keep in mind that the majority of Internet websites run on a *nix back end, it demonstrates that at the core, there are fewer holes to begin with. At the end of the day, anything that’s used more will no doubt reveal more security holes. An entire in-depth review of Mac OS X Leopard is beyond the scope of this article, and would require adding more than 10 pages, so we’ll leave that for the future. In fact, Apple is preparing the next major release of OS X, called Snow Leopard and we’ll definitely look at that release when it ships. For now, I highly recommend John Siracusa at ArsTechnica’s review of Leopard for a really good understanding of why OS X is so powerful and why it’s very good at scaling into the future. Expect to see things like the new powerful ZFS file system be introduced, which will allow for such features as byte-level delta backups. The lack of a registry makes everything a bit more agile. Applications store their own settings in .plist files or within themselves, making for installs and uninstalls a snap — just drag the application over or delete it. Rarely do you have to worry about lingering or overlapping system files. In a nutshell however, OS X delivers what many Windows users have to install several utilities for — and the majority of the good ones come with a small fee. Let’s take a look at some of these features.