The Mac Sucks!

According to Computerworld and several other sources, a bug in Mac OS X Snow Leopard has the potential to delete all personal data from a Macintosh. CNET says that Apple has acknowledged the problem and is working on a fix. CNET also reports that “Snow Leopard has been plagued with bugs since its release, including problems with the Finder hanging or crashing, incompatibility with certain apps, and the AirPort connection dropping.”

I mention this because it’s important to note that every operating system update has issues after it’s first released. There were issues with Leopard when it was released, such as the “blue screen of death” problem. Similarly, there were problems with Vista when it first came out, and issues with Windows XP. There have been issues with Linux releases as well. Undoubtedly, Windows 7 will have its problems, too.

Apple’s software isn’t immune to bugs, including serious bugs like this one that can cause significant data loss. Having said that, it’s only fair to note that this bug isn’t widespread (in terms of the number of users affected) and that it does require the use of the Guest account, which I suspect not too many Mac owners utilize. What’s surprising, though, is that such a significant bug would have slipped past internal testing and code reviews at Apple.

Microsoft learned that offering Windows 7 for public beta testing was beneficial. I saw first-hand that issues which might have impacted my opinion of the software on initial release were corrected during the various beta versions Microsoft released. On my main HP notebook, for example, the earlier releases of Windows 7 caused a blue-screen at shutdown. (My desktop and netbook systems had no such issue.) I submitted those crash reports to Microsoft and a later beta release resolved the issue. Similarly, applications that didn’t work with earlier betas started working in the later ones. It was very clear to me that Microsoft was in fact receiving and acting on the feedback from users like me who had issues with Windows 7 during beta testing. Because so many thousands (if not millions) of people tested Windows 7 in real-world conditions during the betas, I believe Windows 7 will be a smoother transition than it might otherwise have been. (For instance, had I not been allowed to participate in the beta, the blue-screen issue with my HP notebook might not have been found until after Windows 7 hit the marketplace and LOTS of people had the problem.) Will it be a perfect, trouble-free transition? I doubt it, but I do believe it will be smoother than it might have been had Windows 7 been kept relatively secret and available only to developers who paid for a TechNet subscription.

I’d like to see Apple learn that same lesson. Would a public beta program have eliminated the problems being seen by Snow Leopard users? Would it have caught and fixed the “blue screen of death” issue in Leopard? There’s no way to really know. Maybe these are, as Apple implied in its public responses on various web sites, isolated issues that affect only a very small number of people. But if even a couple of these people had been given the chance to test a beta version of Leopard or Snow Leopard, it’s possible the problem could have been found and fixed when it affected only a single beta tester (who presumably would have expected potential problems) rather than hitting many users who actually paid for the software.

To be fair, Apple does beta test OS X releases. However, beta testing is generally limited to software and peripheral developers who have a paid development kit subscription and non-disclosure agreement with Apple. While it is quite reasonable and logical to expect third-party developers to report bugs in OS X that affect their products or which affect basic OS X usage, it’s not reasonable to suggest that these same people will catch the bugs a typical end user will see. End users will hit parts of OS X that developers have no need to touch. They’ll load OS X on systems that contain components and peripherals that developers (and even Apple’s own testers) may not have access to. Thus, it seems only logical for Apple to have some kind of public beta testing to catch the sort of things developers and Apple itself might miss. Unfortunately, such a program would potentially “spill the beans” about upcoming OS X features since beta testers would undoubtedly share information with others. While Apple might argue that this could hurt their sales by leaking feature data to the public ahead of release dates, public beta testing doesn’t seem to have affected the sales of Windows 7 so far. About the only way I can see it hurting Apple is if they pull a feature out of OS X between the beta and the final release, but even that could be “spun” as a way of protecting Apple customers from features that showed significant problems during testing. They’ve had to do that before.

According to the Free Trader Beowulf blog, there is a flaw in Mac OS X Leopard’s handling of Microsoft Windows Active Directory accounts that results in some users being grated root access upon login, even though they had no special privileges on Windows (and should not have any on OS X).

The details for reproducing the error are provided on the blog as they were reported to Apple.

Although blogger Charles Profitt says that this isn’t a critical bug, it does seem like a pretty big mistake on Apple’s part to grant root access to normal users when it’s not appropriate.

According to ChannelWeb, a flaw in QuickTime and iTunes paves the way for a malicious attack on the Windows platform. The new vulnerability was discovered a week after Apple updated QuickTime and iTunes. Security firm Intego says that the QuickTime tag fails to properly handle long strings of data, resulting in a heap overflow flaw in both QuickTime Player and iTunes, as well as other Mac OS X programs that stream media via the QuickTime plug-in. The error also affects the web browsers on both Windows and Mac OS X.

Reportedly, an attacker could add a QuickTime media file to a web page that executes arbitrary code and launches a malicious attack on affected systems. Blogger “securefrog” published a proof-of-concept exploit on the website Milw0rm. ChannelWeb reports that “the most recent QuickTime vulnerability is one in a long line of serious errors, particularly in its real time streaming protocol, that have left users susceptible to remote code execution attacks.”

Again, we remind Mac users that just because no one has exploited a vulnerability on the Mac in the wild doesn’t mean the system is secure… only that it’s been lucky.

InfoWorld reported today that the Apple iPhone has a security flaw that can compromise private information on the phone without the phone having to be unlocked.

Like most cell phones, the iPhone can be locked with a password or PIN number to protect the contacts, email, and other information stored on the device.

Unlike most cell phones, however, Apple has (probably unintentionally) left a back door into the device that can allow someone to read the personal information on the phone without actually entering the secret password or PIN number.

To quote the InfoWorld article, “Pressing the emergency call button at the unlock screen, followed by two taps on the home button, takes you to the iPhone’s private ‘favorites’ page without the need to enter the unlock code. If the owner of the phone has favorite entries in their address book containing URLs, e-mail addresses or mobile phone numbers, then those entries can be used to launch the browser, mail application or SMS (Short Message Service) software, and gain access to private Web favorites, e-mail messages, and text messages stored in the phone, again without entering the unlock code.”

Once again, I’m prompted to remind users that this is not Microsoft making such a fundamental security blunder here.  This is Apple, the company who slams Microsoft’s security in its television commercials, the company that would have you believe that Mac OS X (on which the iPhone is based) is some kind of impenetrable fortress.  You have to wonder, as I’ve been wondering, if their development and QA staffs are stretched so thin these days that they can’t find even basic mistakes like this one.

According to Charlie Miller, an analyst at the Independent Security Evaluators (ISE) firm, “For three months, I was walking around with a vulnerable iPhone. [Apple] had the vulnerability and the exploit, they understood the exploit because they patched it on Mac OS X, but then they said the didn’t know that [the iPhone] was vulnerable.”

This is the same vulnerability Miller used to gain control of a Mac OS X system at the CanSecWest security conference and win a $10,000 prize package.  It took Apple 3 weeks to patch Safari on OS X, much longer to patch the iPhone.

Miller reports “So Apple said ‘We ran the exploit and it ran out of memory and it didn’t do anything bad.’”  What Apple had apparently not done, he added, was to run the actual exploit line.  ”Obviously,” he said, “they didn’t do a very good job of testing.  They had the source code, and they thought that the iPhone wasn’t vulnerable.”

The article says the incident made Miller question whether Apple can effectively manage security on its multiple platforms. “I don’t think they do a very good job of that,” he said.  ”They hadn’t patched the iPhone since February. For more than four months, it’s had vulnerabilities that were patched in Mac OS X.”

We’ve covered here how there is a significant vulnerability in the DNS software used to resolve names like “www.dell.com” into their respective IP addresses. We’ve also covered how the major OS players have all updated their software, while Apple had not done so. According to ComputerWorld, they’ve released a patch for OS X that they claim fixes the problem, but which the security experts report does not.

Andrew Storms, director of security operations at nCircle Network Security Inc. tested Apple’s update, and found that even with the update applied, Apple systems were not randomizing the ports they used. Attacks using this vulnerability are reportedly already in the wild, so Internet-connected Macs are indeed vulnerable. Storms is quoted as saying “Essentially, we’re at the same place as we were yesterday before Apple released the patch.” Swa Frantzen of the SANS Institute, says “So Apple might have fixed some of the more important parts for servers, but is far from done yet, as all the clients linked against a DNS client library still need to get the work-around for the protocol weakness.”

Storms suggests that Apple made a mistake somewhere to produce the “nonpatch patch” just released. “Is Apple modifying the BIND distributions from ISC, and somehow didn’t realize this repercussion? Or is there some kind of configuration file that they forgot to change? It must be one of those two,” Storms said. “If you take the BIND distribution from ISC and patch your system on a Linux box, you’re patched,” he said. “I don’t know what happened to Apple’s.”

For more information about this “nonpatch patch” click here to visit ComputerWorld.

We’ve been suggesting for a while here that Apple’s development team seems to be overburdened and that they appear to be making significant mistakes that are quite simply beneath the caliber of individuals we know to be working there. We know that they work hard. We know that they care about what they’re doing. The only reason for mistakes like this that we can imagine is that the developers are overworked, and QA staff are either similarly stretched too thin or are non-existent. We hope Apple is able to correct this situation. Their reputation is already starting to tarnish…

Walter Mossberg of the Wall Street Journal is usually very positive about Apple and its products, so it was a surprise to many of the Apple Faithful that he posted an article highly critical of the new MobileMe service. In that article Mossberg makes these essential points based on his experience with the service:

“Unfortunately, after a week of intense testing of the service, I can’t recommend it, at least not in its current state. It’s a great idea, but, as of now, MobileMe has too many flaws to keep its promises. I am not referring to the launch glitches that plagued MobileMe earlier this month, such as servers that couldn’t keep up with the traffic and email outages that, for some users, persist as I write this…[snip]… The problems I am citing are systemic.”

“…in my tests, using two Macs, two Dell computers and two iPhones, I ran into problem after problem. One big issue is that while changes made on the Web site or the iPhone are instantly pushed to the computers, changes made on computers are only synced every 15 minutes, at best.”

“My MobileMe calendar, which originated on a Mac, didn’t flow into the main Outlook calendar, but appeared as a separate calendar in Outlook, which was visible only by changing settings. My address-book groups on the Mac, which are simply distribution lists, didn’t show up as distribution lists in Outlook, but as separate address books, and they also weren’t immediately visible. Apple blames Outlook quirks for these issues, but in my view, it should have overcome them.”

Mossberg also points out other flaws with the service, concluding his article by saying that “If Apple does get MobileMe working smoothly, it could be a terrific service. But it’s way too ragged now.”

The Baltimore Sun’s David Zeiler reported on June 26, 2008, that flaws in OS X Leopard’s Time Machine feature raise reliability questions about the platform. To borrow a bit from his article, “Losing important data stored on a PC – your music, your photos, your financial records – is one of the worst nightmares that can befall a computer user…That’s why Apple developed the automated backup feature Time Machine, introduced with Mac OS X Leopard. In concept Mac users need only attach a spare hard drive, switch on Time Machine and never work about losing important data again.” Sounds pretty good, right? Zeiler continues, “But a spate of bugs with Time Machine has me wondering whether I can fully trust it. If nothing else, backup software must be absolutely reliable.”

Zeiler goes on to say that on his Mac Pro, “Time Machine occasionally craps out in the middle of one of its hourly backups.” He later ponders the significance of these occasional errors, saying, “… it makes me wonder if all my data is getting backed up properly. Has some of it become corrupted? How would I find out? Ferreting out the problem files would be no trivial task – I have over 400 gigabytes of data on my backup volume.”

We’ve highlighted before how Apple’s culture of secrecy often backfires. We see an example of this in the article, when Zeiler tells us that “the company’s refusal to acknowledge whether it’s aware of an issue and whether its engineers are working on it leaves users frustrated and confused.” And here I thought frustration and confusion only applied to poor, misguided Windows users…

Zeiler’s parting comments say it all, “At this point, I plan to continue using Time Machine on my Mac Pro while crossing my fingers my data is safe. But just in case I’m also going to dust off my copy of Super Duper to run a second backup to my external network drive. Wasn’t Time Machine supposed to make performing backups easier?”

According to Daniel Nicholas of eNews 2.0, “Leopard Doesn’t Seem to Be a Secure Operating
System.” The author points out that while people gushed over
Leopard just before and immediately after it was released, problem
reports are starting to mount. He suggests that this is evidence that
Apple rushed Leopard to market to meet the October deadline.

Sadly, the first two commenters to Nicholas’ article didn’t
refute what he said, didn’t provide evidence to the contrary, or
suggest an alternative explanation for the facts he presented. No, they
just picked on his writing style, which I didn’t take any particular
issue with. Is it any wonder Mac users are increasingly seen as
“form over function” people who care more for how something
appears than what it really is?

In case you think I’m
agreeing with Daniel Nicholas just because I have the same point of
view, let’s share some evidence from around the web showing that
there is cause to question the security “improvements” in
Leopard and that it appears to be riddled with bugs and inconsistencies:

• The first significant Mac OS X Trojan has been found in
  the wild.
• According to ZDNet, “Researchers Pooh-Pooh Mac OS X Leopard
  Security“.
• Gizmodo points out issues with the Leopard firewall allowing traffic through that
  it shouldn’t.
• Chris Pirillo points out a number of
  UI inconsistencies and issues in Leopard in his
  blog.
• Harry McCracken of PCWorld shares his “21 Quibbles I have with Mac OS X 10.5 Leopard“.
  
• John Siracusa of Ars Technica posted his extensive review of Leopard showing many
  inconsistencies and issues.

Don’t
lecture me about inconsistent interfaces in Windows and Linux.
That’s irrelevant in this discussion. What we’re talking about
here is whether Leopard’s interface is inconsistent. (Got evidence
that Siracusa and Pirillo are wrong?) We’re also talking about OS X
having incompletely implemented security features, not Vista or Linux.
(Can you refute what the ZDNet and Gizmodo articles are reporting?) If
people have this many serious complaints about Leopard already, is it
that unreasonable to think that maybe, just maybe, Apple pushed Leopard
out the door too soon?

Perhaps
the rush to get the iPhone to market and patched to prevent third-party
apps from running on it took too much development effort away from Mac
OS X Leopard. According to security researchers who spoke with
Robert McMillan of the IDG News Service, “The security features
introduced in Apple’s Leopard operating system need work. That’s
according to security experts who have been putting the new version of
Mac OS X through its paces, since the upgrade was introduced last
Friday. Leopard introduces a number of important security features to
the Mac, but they are often implemented incompletely, leaving users
vulnerable to attack.”

According to Thomas Ptacek, a
researcher at Matasano Security, “They’ve done a really good
job of robbing Microsoft advocates of their talking points, but I
don’t see anything that they’ve done out of the box, where
it’s realy more resistant to attack than Tiger was.” Ptacek
says two of Apple’s biggest security enhancements, Sandboxing and
Library Randomization, are great ideas that are imperfectly applied in
Leopard.

For example, while Library Randomization is a
good idea that makes it much harder “if not impossible” for an
attacker to exploit a buffer overflow or similar bug, Apple did not
randomize all of the parts of Leopard it should have.

Sandboxing, while potentially making OS X more secure, isn’t used on
the most commonly attacked applications – such as Safari, Mail, or
iChat. That means the Mac is still vulnerable to attacks against these
packages. The researchers also tell us that “the programs that have
been sandboxed have not been walled off as thoroughly as they should
be,” citing examples where the software can still be used to write
malicious files where they will be automatically launched.

The experts also took exception with the OS X Firewall implementation,
saying that it “suffered from a confusing interface that made it
very difficult to control access to individual services on the
Mac.”

Ptacek said it best at the end of the article:
“I like the direction they’re headed. I’m just
saying that they’ve got a long way to go to catch up with
Microsoft.”

Earlier, I wrote an article about how
crappy the Finder is at copying large numbers of files and folders
.  It takes the Finder a very long time to even start copying
files. 

What's even more interesting is that OS X has
problems even COUNTING how many files it's going to copy or
delete.  Consider the undoctored, unmodified, real OS X 10.4.8
screenshot below, taken during the emptying of the trash.

align="baseline">OK Mac fans, there's no excuse for this one. 
The other day I was moving some files to my trash, something that
happens in a couple of seconds on Windows XP or Linux, when I saw the
following progress meter.  It counted down to zero files and kept
going.

That's
right… The Mac has "-37,226" items to delete from the
server.  Umm… does that mean it's putting some BACK? 
What the heck?  What's the point of counting the number of
files if you can't do it correctly?

 

align="center">

Tell me the
Finder's file handling capabilities don't have some
bugs…