Apple's failure to update GNU software was actively impacting the security of OS X. Charlie Miller made mincemeat of OS X because of the sorry state of security of 3rd party utilities (http://rixstep.com/1/20080422,00.shtml).
1) Find some open source package they use that is out of date
2) Read the change log for that software
3) Find a good bug
4) Profit!
"The Samba on Mac OS X (on Monday) had an exploitable remote root vulnerability in it...it hadn’t been updated since February 2005!"
If anything, Apple removing GPL software creates a better situation, because fink/macports/homebrew will be available to pick up the slack and provide more timely updates.
Plus, it seems like FreeBSD is trying to get rid of as much
GNU stuff as they can, so that more of what they release is covered under a BSD license (see BSD grep, for example).
It may be that Apple is just picking up some of these changes from FreeBSD and doing a little bit of housekeeping on their end.
> It's not like Apple were keeping this stuff updated
Well, obviously as the major point of the article is that Apple clearly refuses to ship software covered by GPLv3, so you're getting the rapidly ancient, last GPLv2 versions. It's quite a rare exception for updated GNU software to be available under GPLv2--the FSF basically moved their entire code base from GPLv2+ to GPLv3+ when GPLv3 was released and that has cascading effects since GPLv2 and GPLv3 are incompatible. I was unaware of the sorry state of things on MacOS actually as I don't use Apple products, but it at least enlightened me about all the bash bashing we tend to see on HN.
Yeah, I recently realized why various bash examples I tried out don't work on OSX. I guess it's an obvious thing to check, but somehow it never occurred to me that OSX's bash would be five years old.
"Is GPLv3 compatible with GPLv2? (#v2v3Compatibility)
No. Some of the requirements in GPLv3, such as the requirement to provide Installation Information, do not exist in GPLv2. As a result, the licenses are not compatible: if you tried to combine code released under both these licenses, you would violate section 6 of GPLv2.
However, if code is released under GPL “version 2 or later,” that is compatible with GPLv3 because GPLv3 is one of the options it permits."
I use MacPorts and "oh-my-Zsh"... but thinking about it, it should not be all that hard to update all of the outdated GNU stuff in Mac OS... but I don't think the system would actually use the updated stuff, so the security problems probably would still remain.
"The Samba on Mac OS X (on Monday) had an exploitable remote root vulnerability in it...it hadn’t been updated since February 2005!"
If anything, Apple removing GPL software creates a better situation, because fink/macports/homebrew will be available to pick up the slack and provide more timely updates.
Plus, it seems like FreeBSD is trying to get rid of as much GNU stuff as they can, so that more of what they release is covered under a BSD license (see BSD grep, for example). It may be that Apple is just picking up some of these changes from FreeBSD and doing a little bit of housekeeping on their end.
Why should Apple relinquish any control over their platform? If their eyes, removing GPL code reduces risk to their platform. There's going to be a constant fear that GPL code could "contaminate" non-GPL code. Why bother?
As you note, other BSD platforms are undertaking the same endeavor, so Apple's not alone and can support that effort. Which seems to be exactly what they're doing. They remove a perceived major risk to their products and continue helping the OSS community.
Finally, again as you note, there are better ways to keep rarely used software up to date. (Rarely used by the majority of Apple's user base.) I bet Apple desperately wants to get out of the business of shipping updates to command-line-only software, just as they've gotten out of the business of shipping Flash and Java updates. Why should they exert significant effort to try and update software that's rarely used on their platform and is better kept up to date via other mechanisms. Apple can provide the base, and anyone who needs OSS libraries, utilities or apps not provided by that base can use something like Homebrew and much more easily stay up to date. And if Apple stops vending that software, systems like Homebrew are far less likely to be broken by Apple OS updates. Win-win.
For what it’s worth, the guy who writes Rixstep.com is a vitriolic asshole who has been periodically bashing nice projects for incredibly lame reasons for a decade now, and who seems to bear unreasonable grudges and fixate on them.
What he’s saying in this particular example might be legitimate, but he’s just not a credible source, in general.
I've been a Apple & FreeBSD user for decades and it really looks to me like Apple is coming up for a long cycle of public and embarrassing security failures because of this...
Or perhaps I should say, I don't think Apple is going to either update the lagging GNU utilities to current or put for the effort to migrate to current BSD alternatives until they have a protracted public shaming which demonstrably impacts the bottom line of iOS sales. Which sort of reminds me of what MS went through before they started taking security more seriously. (I haven't used Windows in years, so I can't really comment on the state of MS security today).
Which is a shame because there is a lot of opportunity in the eddies of GNU, BSD, and Darwin. We all could benefit from an Apple sponsored security focused FOSS code review / bug hunt / development effort. Sort of like what Google does only focused on Security.
I don't think that is the case, there won't be a requirement for public shaming, Apple is already removing more and more GPL licensed tools each release cycle and it won't be long until they are using more up-to-date BSD licensed tools.
Also, one thing I have noticed is that Apple has started reacting faster to security threats and is at least willing to acknowledge the researchers behind them in their updates, which is much better compared to what previously happened. Not only that but before Lion was released many security researchers received an advanced copy.
The other thing is that almost all of the GPL utilities are command line utilities and are not shipped with iOS so even if there are vulnerabilities in them it is highly unlikely that there will be a target painted on iOS's back. I don't foresee that there will be any major impact on their iOS product line.
Actually what I was inferring is that between the rate of migration from older GNU tools to current BSD tools and the rate of response for security issues would combine to create a series of security failures in Mac OS. If that went on long enough and is publicized enough, it will effect iOS simply by guilt by association.
Certainly I have also noticed a slight improvement on the way Apple handles security problems but I don't really think it's an adequate response. More importantly I have the general impression that long term Apple is moving away from Mac OS & workstations and towards iOS & devices. So them ignoring Mac OS problems or becoming slower to react on them would not really surprise me... at least until people started to view iOS in an equally negative light because of it.
In any event, I honestly wish that Apple would maintain a larger presence in the FOSS community and put more effort into a more positive two way relationship.
> In any event, I honestly wish that Apple would maintain a larger presence in the FOSS community and put more effort into a more positive two way relationship.
With respect, I think that what you really mean is that you wish they would have a greater presence in the FSF-adherent "free" software community. Their credentials in the open-source world are pretty well burnished: Bonjour, Darwin, WebKit, LLVM and Clang, and so on. They do not, however, care much for the GPL, and I do not blame them.
Apple have always acknowledged whoever found any exploits in their OS. It may not be in the update docs, but it is in the security-announce mailing list Apple uses for all updates that have security fixes. https://lists.apple.com/mailman/listinfo/security-announce
I've been a Apple & FreeBSD user for decades and it really looks to me like Apple is coming up for a long cycle of public and embarrassing security failures because of this...
Apple isn't going to allow Mac OS X security to degrade. Apple does a lot of behind the scenes activity with security that they don't talk about much.
Every Mac OS X and iOS update addresses many security vulnerabilities; here's the list for 10.7.3 as an example: http://support.apple.com/kb/HT5130
I am only using Linux on both server and client and I am happy to have a consistent development experience since 6 years.
I am interested why isnt just Apple or just FreeBSD enough for your purposes? Why do you need to use both? Just as a hobby or do both have any use special case?
Personally, I use FreeBSD for anything that's headless, and OS X is the only OS I'll touch for a desktop. FreeBSD makes for a fantastic, consistent experience for servers of all kinds, and OS X has everything I could want on a desktop. (I do still use bootcamp occasionally for games, but that is getting rarer)
As Charlie Miller noted in his '07 BH presentation: (https://www.blackhat.com/presentations/bh-usa-07/Miller/Pres...)
How to Find a Mac OS X 0-Day:
1) Find some open source package they use that is out of date
2) Read the change log for that software
3) Find a good bug
4) Profit!
"The Samba on Mac OS X (on Monday) had an exploitable remote root vulnerability in it...it hadn’t been updated since February 2005!"
If anything, Apple removing GPL software creates a better situation, because fink/macports/homebrew will be available to pick up the slack and provide more timely updates.
Plus, it seems like FreeBSD is trying to get rid of as much GNU stuff as they can, so that more of what they release is covered under a BSD license (see BSD grep, for example). It may be that Apple is just picking up some of these changes from FreeBSD and doing a little bit of housekeeping on their end.