Of iSync Protector, and why no one really cares

iSyncMinoki released a small utility that fixes the iSync local root exploit I've talked about a few times.

From a cursory glance, it basically does the terminal commands I gave back in a prior post, which means you'll have to rerun it every time you repair permissions and such.

Still, if you're not inclined to enter terminal commands, or keep them around to reenter them, and don't sync to a Symbian cell phone, this could well be for you. The site isn't in English, but it looks as though they have an English localization in the .app and Google can translate the site easily enough.

I keep getting asked about this exploit, and most of it isn't pretty... this one is really starting to touch a nerve with some people for reasons I don't quite understand yet. Some of them seem to think I've let Apple off too easy, some seem to think I may have some idea of what the hold up might be to cause it to go unfixed.

I've really said all I know about it and what might be causing this to go unfixed for months, or why it wasn't included in 10.3.8 or in the most recent security update, but I suppose I haven't said why I haven't shaken my fist in anger at Apple over it.

When it comes to why there's been no fix after this long from Apple, or why what fix they have missed both patch windows, it really could be any number of reasons. The problem isn't those reasons, it's that we have no idea of what's going on, let alone when to expect the fix or even that they're working on it. We can assume they know about it and it'll now hopefully be in 10.3.9, but we don't really know.

We don't know because enough people just don't really care about security on the Mac because there hasn't really been 'digital pearl harbor' on the platform. About the closest we've come is the LaunchServices exploit, which was potentially incredibly damaging and dangerous, but for reasons I've gone into great detail before never really took off.

They just don't really care

Pundits and long-time Mac users generally just don't truly get it, because their frame of reference has been so co-opted by not having to deal with it. The discussion is purely taking what you know or want to be true and working backwards, and anything else is really just foreign.

Their frame of reference has been co-opted to such a degree that their mental equation is always going to be missing variables, and always going to come out a bit off, and leads pundits and users who aren't stupid to say some really stupid things regarding security on the Mac platform.

This isn't fear-mongering or bashing. Whenever there is a security hole , and it's unpatched, you're playing russian roulette, and the Mac has a hell of a lot more empty chambers than other platforms in other situations. If you've used a Mac for a long time you're just not going to care as much if you know there's a bullet in the chamber, let alone what's being done to get it out. If all you've ever known is the click, you're really not mentally prepared for the bang.

Out of all the normal Mac users, the vast majority who email me asking questions about these types of things are those who have come over from Windows, and while they may not understand the specifics they understand the danger. The vast majority of long-time Mac users give me a hard time for theoretically scaring people about something that they're sure is being fixed and isn't really an issue because there's no worm or trojan in the wild actively exploiting it.

Real developers do get it and care, because they understand the specifics of how these things work, and that there's no magic barrier from malicious code on the Mac, but developers are generally the last ones to really be heeded.

The press doesn't get it because their readers don't get it, and they aren't going to spend time on something most users aren't really that concerned about or clamoring for updates on. Most Mac users just don't even know the vulnerability is there, let alone that it hasn't been patched, and a huge percentage of those who may have seen it here or somewhere else promptly forgot about it not long after. Users don't know because they haven't been told, and a website with drunk in the name prolly isn't how they should be finding out about it.

What we ask of Apple won't make a difference, and we'll be in the dark until sites and magazines with the word "Mac" somewhere in their title are actually asking Apple what's going on. If the Mac press thought their readers were really worried about security, they would do so. Conversely, If Apple thought enough users really cared about what was going on, what the problem was, and what the damn ETA for the fix was, they'd come out and say it.

It wasn't long ago that Apple didn't really have obvious channels for security problems, let alone following up on them, and didn't even really specify details of what was being fixed when they did release patches. Apple didn't change how they did some things because it was the 'right time' to finally start doing it or because they had some epiphany. They were getting hammered for it and being asked uncomfortable questions, and the cost of not doing it was higher than the cost of doing it.

Apple is not going to tell us what's going on with this vulnerability, what the holdup is, or what the ETA for a fix is, because the press isn't asking them about it and reporting "no comment" everywhere.

The press isn't going to ask them about it, because users and pundits just don't really care all that much; they've just heard too many clicks when the trigger has been pulled. It's a non-story on all sides, and will probably be rolled into 10.3.9 and mentioned in a footnote when reported on various Mac sites.

That's just the cycle of how this is going to work, and shaking one's fist isn't going to do it. It's not going to change until enough things in the Mac market change that there's not a click when that trigger gets pulled. Then you'll have your story, and then we'll be better informed about the vulnerability that follows the one that went bang.

yummy alcohol posted button Posted by drunkenbatman
    April 04, 2005, at 09:08 AM


Comments (16)




Post a comment



Anonymous comments are allowed, but please enter something for a name.

And do endeavor to appear sane.









Remember personal info?