Five Reasons To Ignore John Gruber’s OS X Security Pundity

Via Matasano.com -

Today’s Daring Fireball post has two objectives:

1. To tar eWeek Security pundit Larry Setzer, and the trade press in general, as biased, lazy, and incompetent when it comes to Mac security.
2. To claim that Mac security is better than Windows security.

We can get behind one of those objectives. But Gruber isn’t going to let us do that: instead, he borrows support for his defensible argument to shore up a weak argument. This isn’t a new idea; it’s straight out of the Mac zealot playbook, and it’s the same tactic Gruber used during the Mac wireless debacle when he hid behind Brian Krebs’ reporting to throw a smoke screen over OS X kernel wireless vulnerabilities.

Here’s an example from today’s article. <;/em>Seltzer’s article claims that a recently released Symantec report on OS X security “revealed a collection of vulnerabilities and potential attacks that rivaled any major operating system”, and “in fact things are getting worse.” Instead of arguing that Seltzer doesn’t (and can’t) support that argument with facts, which would be boring, Gruber plays to his base: “nowhere in the report does it indicate that the ‘collection’ as a whole rivals that of any other operating system.”

But that’s an equally indefensible argument! Seltzer himself names operating systems that are in positions comparable to OS X: Linux and Solaris. Gruber’s M.O. is simple and he counts on his audience not to notice it: when a pundit or reporter overreaches, Daring Fireball leaps on the opportunity to claim that the opposite argument is true. It almost never is.

---

Please read the full blog from the link at the top. Thomas is spot on. I couldn't say it better myself. I saw the OSX blog entry this morning and was thinking the same thing. Of course, John totally overlooks the Metasploit OS X wireless vulnerability that was released recently....and if he thinks the "shipping" version isn't open to the same type of attack...he is sorely mistaken.

Just because Apple doesn't like to talk about their holes doesn't mean that people are exploiting them already...John must remember that a blackhat world does exist and they have exploits that will never be released. How quickly we forget about the OS X kernel flaw that was released during MoKB (which BSD patched years ago)...