Re: Mac OS X vulnerabilities

From: Mike Stark (mstark_at_ucsd.edu)
Date: 10/30/03

  • Next message: Francis Favorini: "RE: Internet Explorer and Opera local zone restriction bypass"
    Date: Thu, 30 Oct 2003 11:14:03 -0800
    To: bugtraq@securityfocus.com
    
    

       Mac OS X Maintenance Agreements are available for clients and
    servers. Since mac os 10.0 (before "X") apple has used paid upgrades
    that addressed security updates, as the release point for the next
    supported version of the OS.

       I don't personally agree with this method of major patch/upgrade
    but it has been in place at least a couple of years. This is not
    "news" that MacOS users pay for major security update bundles. At
    least they have the $200/5 user home bundle to make it more palatable
    to home users. And the education list price for volume maintenance is
    even better per copy. But you still pay.

       Apple also releases the details of what was patched and provides
    the tools to "roll your own" patches with the combination of
    developer tools CD's & darwin or samba or SSH or whatever source
    sites. We did our own patches at one period of time as an early
    adopter of MacOS, (circa spring, 2001), rather than pay for the next
    OS upgrade. If you are patching something like open SSH on solaris,
    HP-UX, and IRIX already, compiling a new open SSH for OS X is not
    much additional work once you get it down.

    Mike

    At 11:43 AM +0100 10/30/03, Radoslav Dejanovic wrote:
    >On Wednesday 29 October 2003 02:30 am, Joshua Levitsky wrote:
    >
    >> If Apple is responsible then we should see 10.2 patches backported. I think
    >> it's reasonable that 10.3 patches come, and then 10.2 patches, and Apple
    >> should have some Life Cycle policy to say if everything before 10.2 is EOL
    >> or not. It's all a new world with Apple. Let us hope that they do not let
    >> us down.
    >
    >As I mentioned to Thor in my previous e-mail (and got rejected by list admin
    >because he thought I missed exactly that point), we should expect Apple
    >patching 10.2 as well, because it still hasn't reached its EOL. I don't think
    >Apple wouldn't release a patch for 10.2 but instead tell their customers to
    >upgrade to 10.3.


  • Next message: Francis Favorini: "RE: Internet Explorer and Opera local zone restriction bypass"

    Relevant Pages

    • Re: A cheapo Acer laptop matches Macbook Pro in benchmarks!
      ... MS holds onto security updates and presents them on an artificial schedule ... So does Apple. ... patches are critical. ... Microsoft is not alone in releasing a patch from ...
      (comp.sys.mac.advocacy)
    • Re: OT: Apple ROOLZ!!!!!
      ... hear it through your Ipod and you will toss the IPOD in the trash. ... And exactly how does Apple 'tell' you how to transfer your files? ... It seems Mac ... I prefer my box because I can upgrade the hardware at my leiasure plus ...
      (rec.music.makers.percussion)
    • Re: 22 Apple patches in 30 days!
      ... How do the Maccies keep up with the frantic pace of the Apple patches? ... *free* upgrade (Aperture 1.5, for those who have purchased Aperture, of ... major upgrade to iTunes, so it can download movies ...
      (comp.sys.mac.advocacy)
    • Re: they add a dot - you pay $129.99
      ... Whether you get charged for OS X when you buy a Mac is, as Sandman says, ... Work out what happens if Apple stop funding OS X ... Leopard looks like it will be a significantly larger upgrade than Tiger. ...
      (comp.sys.mac.advocacy)
    • Re: Just installed Leopard
      ... Being that an Apple update caused this same problem ... what do my other Macs have that the above ... Once you get your Leopard running properly, ... trip to Phoenix to visit my son & upgrade his 1 yr old MacBook. ...
      (comp.sys.mac.advocacy)