Re: [Fed-Talk] Security vulnerabilities addressed in Mav
Re: [Fed-Talk] Security vulnerabilities addressed in Mav
- Subject: Re: [Fed-Talk] Security vulnerabilities addressed in Mav
- From: Dave Schroeder <email@hidden>
- Date: Thu, 24 Oct 2013 16:29:26 -0500
Well, for what it's worth...that is the truth at the moment. It will only remain the truth if Apple is indeed no longer going to issue comprehensive security updates for 10.x-1 (where 10.x is the current release)...which, I still think, remains to be seen.
Of course, since Apple has no OS EOL policy, we will simply be stuck in limbo, wondering if another round of security updates for 10.8.x will arrive...
I don't buy the "since Mavericks is free, this must be Apple's new policy" argument, yet, because if Apple is also going to an accelerated cycle of major releases, it will be a challenge to integrate such a reality into academic/government/enterprise environments. While Apple has repeatedly insinuated, and outright directly said, that it is "not an enterprise company", a part of me still thinks Apple has to have some awareness that this is a major challenge for its enterprise customers.
On the other hand, I hope we have all come to terms with the fact that Apple is nominally a consumer company whose products happen to be a fit -- whether by function or by force -- for some enterprise environments, and that it's the IT admins' job to be the shoehorn that makes it fit.
- Dave
On Oct 24, 2013, at 4:10 PM, Taylor Armstrong - NOAA Affiliate <email@hidden> wrote:
> As a followup... a bit disturbed to see this today, but it DOES lend support to Jeffrey's original complaint:
>
> Every one of our Macs is displaying this finding in Nessus today:
>
> Plugin ID: 70561
> Plugin Name: Mac OS X < 10.9 Multiple Vulnerabilities
> Synopsis: The remote host is missing a Mac OS X update that fixes several security issues.
>
>
> Description
> The remote host is running a version of Mac OS X that is older than version 10.9.
> The newer version contains numerous security-related fixes for the following components :
>
> - Application Firewall
>
> - App Sandbox
>
> - Bluetooth
>
> - CFNetwork
>
> - CFNetwork SSL
>
> - Console
>
> - CoreGraphics
>
> - curl
>
> - dyld
>
> - IOKitUser
>
> - IOSerialFamily
>
> - Kernel
>
> - Kext Management
>
> - LaunchServices
>
> - Libc
>
> - Mail Accounts
>
> - Mail Header Display
> - Mail Networking
>
> - OpenLDAP
>
> - perl
>
> - Power Management
>
> - python
>
> - ruby
>
> - Security
>
> - Security
> - Authorization
>
> - Security
> - Smart Card Services
>
> - Screen Lock
>
> - Screen Sharing Server
>
> - syslog
>
> - USB
>
>
> Solution
> Upgrade to Mac OS X 10.9 or later.
>
>
> Take it for what it is worth....
>
> Taylor Armstrong
> Macintosh Administrator
> SID / NOS IMD
> 1305 East West Hwy Rm 9424
> Silver Spring, MD 20910
> email@hidden
>
>
> On Thu, Oct 24, 2013 at 3:10 PM, Eric Eskam - QTGBBA <email@hidden> wrote:
> On Wed, Oct 23, 2013 at 12:49 PM, John Oliver <email@hidden> wrote:
> If they want to be an enterprise contender, then they're going to have to change.
>
> I guess I would have to ask - why would they want to be an "enterprise contender"? it hasn't exactly come up roses for Microsoft in the long run. Yes, that's a gross oversimplification of many complex points but at the end of the day who's on top right now?
>
> Now, I'm not disagreeing with your other points - even as a consumer I would love to get more disclosure from them on security related issues, but as soon as they become an "enterprise" player, especially in government, look at all the crap we start to heap on vendors. Some of it good, but is all of it really necessary? If I was Tim Cook I'd be looking at the demands of "enterprise" and be saying "No thanks". Which is probably why that's basically what they do.
>
> To be fair, Apple doesn't completely ignore enterprise - but they certainly don't cater to the enterprise to the level the Wintel crowd does. Nor do I think it's sane to expect them to ever do so. They are first and foremost a consumer company - and anyone who argues it should be the other way around really needs to take a closer look at their financials vs. their competitors.
>
> _______________________________________________
> Do not post admin requests to the list. They will be ignored.
> Fed-talk mailing list (email@hidden)
> Help/Unsubscribe/Update your Subscription:
>
> This email sent to email@hidden
>
> _______________________________________________
> Do not post admin requests to the list. They will be ignored.
> Fed-talk mailing list (email@hidden)
> Help/Unsubscribe/Update your Subscription:
>
> This email sent to email@hidden
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Fed-talk mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden