[32236] in bugtraq
Re: Mac OS X vulnerabilities
daemon@ATHENA.MIT.EDU (Mike Stark)
Thu Oct 30 15:40:15 2003
Mime-Version: 1.0
Message-Id: <p06002019bbc7075176cc@[132.239.50.203]>
In-Reply-To: <200310301143.55622.radoslav.dejanovic@opsus.hr>
Date: Thu, 30 Oct 2003 11:14:03 -0800
To: bugtraq@securityfocus.com
From: Mike Stark <mstark@ucsd.edu>
Content-Type: text/plain; charset="us-ascii" ; format="flowed"
Mac OS X Maintenance Agreements are available for clients and
servers. Since mac os 10.0 (before "X") apple has used paid upgrades
that addressed security updates, as the release point for the next
supported version of the OS.
I don't personally agree with this method of major patch/upgrade
but it has been in place at least a couple of years. This is not
"news" that MacOS users pay for major security update bundles. At
least they have the $200/5 user home bundle to make it more palatable
to home users. And the education list price for volume maintenance is
even better per copy. But you still pay.
Apple also releases the details of what was patched and provides
the tools to "roll your own" patches with the combination of
developer tools CD's & darwin or samba or SSH or whatever source
sites. We did our own patches at one period of time as an early
adopter of MacOS, (circa spring, 2001), rather than pay for the next
OS upgrade. If you are patching something like open SSH on solaris,
HP-UX, and IRIX already, compiling a new open SSH for OS X is not
much additional work once you get it down.
Mike
At 11:43 AM +0100 10/30/03, Radoslav Dejanovic wrote:
>On Wednesday 29 October 2003 02:30 am, Joshua Levitsky wrote:
>
>> If Apple is responsible then we should see 10.2 patches backported. I think
>> it's reasonable that 10.3 patches come, and then 10.2 patches, and Apple
>> should have some Life Cycle policy to say if everything before 10.2 is EOL
>> or not. It's all a new world with Apple. Let us hope that they do not let
>> us down.
>
>As I mentioned to Thor in my previous e-mail (and got rejected by list admin
>because he thought I missed exactly that point), we should expect Apple
>patching 10.2 as well, because it still hasn't reached its EOL. I don't think
>Apple wouldn't release a patch for 10.2 but instead tell their customers to
>upgrade to 10.3.
