Zero-day exploit for QuickTime in the wild

Wait, a multi-billion dollar company doesn't answer every little e-mail it gets, and so the responsible thing to do is get huffy and post damaging information that could potentially inconvenience millions of people?

Smooth. Ethical. Mature. Jerk.

Actually, Address Space Layout Randomization (ASLR) was never fully implemented in Leopard. So little of it was, that it may as well not be in there at all.

I was rather disappointed to learn of this, after the promises by Apple.

The Matasano blog posted some technical details about a year ago:
http://www.matasano.com/log/986/what-weve-since-learned-about-leopard-security-features/

(Numerous others have corroborated the findings, but that was the first link I had handy)

It's time to end the delusions of OSX security. I love the OS, but Apple has been very lucky in that it's avoided scrutiny for this long. There are plenty of technologies available, and there's no reason that they can't spend a little money on this before it really becomes a target. Every other OS has gone through it, and ours will be no different.

"Code execution may be possible." Oh really? You know, if you want to get Apple's attention, get some code to execute otherwise it's just another browser crash. Apple is either not taking this seriously or more likely, they've looked into this and considered it's not really a serious threat and it's on the bug-fix list.

It's amazing the number of anti-Apple people who sneak out of the woodwork every time some hacker finds a little bug—no matter how severe—and spouts FUD about how insecure Mac OS X or how it'll become the virus-laden minefield that Windows is if the user base ever grows.

Some concern is definitely merited, especially with the already released open source software Apple bundles with the OS. In some aspects Apple is a couple versions behind what the latest point release is and usually all it takes is a recompile to get up-to-date. I agree with the article—Apple could take security a little more seriously but this is hardly front-page news.

Curiosity killed the cat!

When will people learn not to open unknown downloads, not to click links embedded in email messages... This is not exactly rocket science!