No sooner had much of the world gotten Leopard into their hands than this alarmist posting from a Mr. Schmidt appeared on the site of Heise Security: http://www.heise-security.co.uk/articles/98120

I'm quite disappointed that this Mr. Schmidt would choose to pull such a media stunt, which is basically to make an empty claim that Mac OS X Leopard may expose security holes due to the fact that the firewall allows inbound connections by default. If Mr. Schmidt was truly concerned about the security of Mac users, he would have realized months ago by running the beta releases that this has been the behaviour in Leopard and sounded the alarm then. I'm always amazed how people have no shame to wait until the exact day that some product gets released to sound the alarm about something that they likely knew well in advance. Other than show that Mac OS was running as it intended, did Mr. Schmidt do any further research to actually show that there is a problem? Not that I can tell.

Mr. Schmidt has apparently been clued out to the fact that beta releases of Mac OS X Leopard have been available since at least August 2006 when the WWDC 2006 was made available to Macintosh developers. Mr. Schmidt apparently has also been too busy to read this NO EXECUTE! blog and does not share my views on how to attack computer security issues. If he had, he might not have put his foot in his mouth the way he did in his posting. As I pointed out six years ago this week in this posting on Darek's Secrets (http://www.emulators.com/secrets.htm#VirusMagnet) I generally do not bother to install anti-virus software nor do I recommend to most people that they go waste their money on virus related products such as Symantec this or McAfee that. When I install Windows Vista one of the first things I do is turn off that idiotic Windows Defender service. I do so for the same reasons that were true in 2001 - anti-virus software is only effective against known attacks.

As this blog eloquently explains (http://www.zdnet.com.au/blogs/securifythis/soa/Why-popular-antivirus-apps-do-not-work-/0,139033343,139264249,00.htm) anyone writing malware is first going to check his new creation against common products from Symantec and McAfee and Microsoft. Only when he derives something that fools the existing checkers does he release his new exploit. Therefore, almost by definition it is a waste of your money to buy commonly advertised and over-hyped security products. Is it any wonder that a few days ago when I visited the Fry's Electronics in Renton, WA, the first thing I saw as I walked in the door was a rather shoddy "free software" table featuring, what else, those very same and rather useless security products? "Free" of course being in quotes and being printed with an asterisks on their sign, as this is just one of those annoying rebate scams. My new AT&T Blackjack cell phone that I took these photos with? I am still waiting since July for my $100 rebate (which at this point I doubt will arrive). I hate rebates! It is saddening to see security being relegated to these toy products which at best block poorly written malware, and at worst are a waste of your time, money, and your computer's RAM.

Back to firewalls... at best, enabling a firewall may protect your computer from some network based attacks, provided that you do not actually need those network services, say, file sharing. At worst, the firewall may give you a false sense of security and may even encourage users to act negligently when online specifically because of this false sense of security. This is similar to the false sense of security that airport screening checkpoints serve to provide, which do nothing to stop the way that most people die in airplane accidents - poor mechanical maintenance and human error.

Scanning the web I found this (http://jaraco.livejournal.com/59254.html) excellent blog posting by Jason Coombs which explains better than I can why firewalls may even do more harm than good - they tend to get in the way when you actually need the network service that's being blocked. A firewall masks a problem that may exist in a network service, but that is of little consequence in identifying and fixing the root cause of the problem. And, since a firewall is itself using operating system calls, it does not protect against fundamental bugs in the lower-level code such as the network device device driver itself. Malformed packet bugs anyone?

Not convinced by these rational logical arguments, the well known news site eWeek.com chose to jump on Mr. Schmidt's alarmist claims, running an online article entitled "Leopard Has More Holes than Spots" (http://ct.enews.eweek.com/rd/cts?d=186-8550-54-798-548400-824339-0-0-0-1). Other than being a pun, what does that title even mean? Has NOBODY in the media spent the past year or so beta testing Leopard? If they are so convinced that the firewall settings are bad, could somebody have said something instead of waiting for it to make a conveniently timed headline? eWeek.com should be utterly ashamed of itself for running that piece.

Turning the firewall on or off is a setting. It's an on/off switch that is set to some default value by the setup program that the user is free to modify. It is not a bug of the operating system. It is not a code defect. This is what all of these so called experts do not even distinguish, between a policy such as setting the firewall to some setting by default, and an actual bug in the code that makes the code behave contrary to what it is suppose to do. Remember that prior to the release of Windows XP Service Pack 2 in the summer of 2004, Windows didn't even come with a firewall that most users could easily configure. Windows XP as it first shipped was a wide open barn door. Windows 98 before was a security nightmare. All versions of XP set the default Administrator password to blank, which means it is trivial to log in with full administrator privileges to a Windows XP machine by default. Where we these experts then to denounce the security holes in XP? Or were their web sites too busy hosting Microsoft-funded banner ads? I really fail to understand the viciousness that people are attacking Leopard with without any credible evidence that there are code defects in the networking services.

Eyeballs Versus Tools

A serious crime against consumers in my opinion is when the irresponsible attitudes of online web sites spill back to the print media. Just last week, the October 31 2007 issue of The Wall Street Journal published another questionable piece by Lee Gomes. He is the same guy I singled out in the Sep 3 posting of NO EXECUTE! for running the rather irresponsible piece in the August 29 2007 edition where he practically laughed off security concerns of surfing the web. This past week, in a piece on page B1 titled "Rage, Report, Reboot, And, Finally, Accept Another System Crash", Mr. Gomes describes how he is simply resigned to the fact that his computer will crash regularly, so his solution is to just back up his files more often.

First telling your readers that it's ok to accept any old email attachment and then telling them to except regular crashes is just downright irresponsible and hollow. There is nothing constructive is article. Mr. Gomes would better serve his reader to call in sick and stop writing. Mr. Gomes fuels the flames of misinformation by finishing his piece with a quote from a computer teacher which advocates that Microsoft should allow more people to look at the source code to its operating system as "a million eyes beat two dozen any time". Such a simplistic mindset is naivety, squared.

More eyeballs does not equate to fewer bugs. Linux has been open source from day one and it too still contains security holes and bugs even after more than 15 years of "many eyeballs" development. Mac OS X, which is largely built upon BSD Unix and various open source components, same thing. The eyeballs looking over open source code may not understand the code they are looking at, may not spot the bug, and worst, may belong to someone who then write an exploit. I am not against open source, but the argument that open source code is less buggy by virtue of more eyeballs is just plain unproven. I challenge anyone to point me at the data to back up that claim.

The bottom line is that software bugs and security exploits exist in all types of software at all levels of software stack, right on down to the low level drivers and operating system code that the security products themselves rely on. Security and reliability needs to be addressed at the very fundamental level of code generation and code execution. This means that developers need tools to help them identify and fix software bugs before they release their software to the public. It also means that computers must execute code assuming that the code is nevertheless buggy and malicious, even the operating system code itself. The key to security and reliability is testing, verification of new code, and giving developers the tools to make those tasks to perform each and every day, even each time they compile their code.

Just as nobody in the heterosexual community took HIV seriously in the 1980's, and thus allowed a containable infection to turn into a preventable worldwide epidemic that is now ironically a profitable cash cow for the drug industry, the computer industry has not taken security and reliability seriously. Instead, the industry is marketing false hope and the fear of security exploits as a mechanism to sell new upgrades of software (and even hardware, think "NX" bit) and worthless security products that end up having to be given away at Fry's Electronics. It is a shameful exploitation of the consumer.

Recall how at one time Norton Anti-Virus could be disabled with a single Windows registry change: (http://www.securiteam.com/windowsntfocus/5GP0C2A4UO.html). Much as a firewall relies on the network driver being secure, an anti-virus utility relies on the operating system being secure and is rather useless when one can simply ask the operating system to disable it! Security checking cannot exist in the same sandbox as the malicious code it is protecting against. It needs to be done one level of execution lower. But how can you go lower than native machine code being executed directly by the microprocessor?

As I have been explaining for many weeks now, this is the fatal flaw of most security products and of the current wave of hardware virtualization based virtual machines. Only a binary translation based virtual machine (a.k.a. a virtual execution runtime) can provide the mechanism to indirect the execution of code that one extra level. A virtual execution runtime can give developers the needed ability to run their code in a sandbox and analyze the execution of their code. A virtual execution runtime can also give end users security protection by detecting code sequences that may trigger CPU errata, by doing software-based buffer overrun checks, and by performing the checks in a way that is not "visible" to the code being virtualized. This is a fundamental property of the buffer overrun checks in something like Java or .NET. Now it just needs to be extended to all code, native and managed.

In summary, please stop falling for the rhetoric from these so called "security experts" that are just trying to sell you band-aid products that might throw a few speed bumps down at malware but don't actually fix anything. Companies such as Microsoft, McAfee, and Symantec should stop misleading consumers with their "free" products and focus on producing developer-oriented tools to detect and stop buggy code from shipping to the public in the first place. Between the irresponsible journalism of eWeek, The Wall Street Journal, and the rush of so called security experts making unsubstantiated claims against Leopard, consumers are being misinformed and are rightfully confused. A lot of different people should be ashamed of themselves.