Apple's security myth

Security vulnerabilities are a fact of life. How you deal with them is what separates the serious players from just the players.

Apple earlier this week released a patch for a vulnerability in iSync. The flaw makes iSyncs "mRouter" tool vulnerable for a buffer overflow attack. Users who have local access to affected systems can then gain superuser privileges.

Apple however didn't bother plugging this hole for at least 3 months. As a Mac user, that makes me very nervous. Does Apple take the security of its users even serious?

Not if you ask Braden Thomas, an independent developer of security software and a member of the University of Southern California's Digital Security Interest Group who discovered the flaw:

"I was surprised that [Apple] did not include a fix in Security Update 2005-003," he wrote in an email to vnunet.com "In fact, an AppleFileServer DoS bug I discovered that was disclosed in February was fixed by Update 003."

So next time you claim OS X is more secure than Windows, take Apple's response to security threats into consideration. Security vulnerabilities are a fact of life. How you deal with them is what separates the serious players from just the players.