Aaron Adams’s Lame-ass Blog

Here’s another reason why I think most discussion on the internet is practically worthless:

Godwin’s Law

Remember that because I may refer to it in the future.

Reading Godwin’s Law reminded me of a scientific law I discovered about a decade ago. I haven’t talked about it much because I’m tired of the ridicule I receive when I express such deep thoughts, but I’d like to codify it here, for posterity. It may be my most profound contribution to the science of astronomy. It is optimistically titled…

Adams’s First Law
Uranus jokes never get old.

As with most things I do, I’m sure my genius will be unappreciated in my lifetime, but alas, such is the bane of my existence. Thanks to Google, however, this law will live in their caches as long as there is a human race to stare at Uranus in awe.

Considering it’s not very complicated to make zlib or bzip2 compressed disk images from the command line, and that doing so should be trivial for a developer, why do developers distribute disk images that are zipped subsequent to image creation? Is there a reason I’m not aware of?

If I’ve realized anything in my 31 years, it’s that the conventional wisdom is often so wrong, so demonstrably false, so easy to debunk, that I find it hard to believe that it has become conventional. One piece of conventional wisdom I’d like to comment about today is the ever popular…

Macs don’t have viruses and spyware because they’re such a small share of the market! If they had the market share Windows does, they’d be just as vulnerable!

I’m not under any kind of illusion that this idea will be put to rest in my lifetime. It’s way too ingrained in the minds of too many people (hence, conventional wisdom) to die soon. What I would like to do is point out the giant logical fallacy behind this statement, and the demonstrably false implication that follows it.

Here’s the very simple logical problem that everyone who subscribes to this idea misses: It assumes that all other factors are equal, and that the only difference between the two platforms is the number of sales (?), users (?), installed machines (?), active machines (?), or some combination of the aforementioned with the additional stipulation that they’re attached to a network, or otherwise available for exploitation. I use the question marks because there is no solid definition of what “market share” means, as used by people discussing this topic. Consequently, if indeed vulnerability was directly proportional to “market share”, then Apple’s 5% (Or is it 2%? 3%? Nobody can really agree.) of the “market” would have already earned it 5% of malware infections. Obviously, that’s false.

There are all kinds of different factors for both platforms, and yes, the actual number of available machines is one of them, but not the only one, and I don’t believe the major one. Think of the company you work for, and consider its “market share”. Is your company completely free from miscreant behavior simply because it’s so small? What about the knowledge levels of the platform’s users, and the mix of those levels in the user base as a whole? What about differences in the way the OS handles security? What about the security consciousness of the developer community for your platform, and the ability of those developers to create secure applications and services? What about the reaction time for patching vulnerabilities? What about the technical information provided to users to assist them in defending themselves, and developers to correct flaws? What about other factors I’m too lazy to write down? The question is much more complicated than, how much “market share” does the platform have.

Additionally, but on less solid logical grounds, I think those discussing the topic don’t accurately take into account the human factor. People who write malware don’t write it because they’re hard-working, honest people who have just chosen a dodgy way to make a living. They’re criminals, people who don’t want to work, and who don’t give a damn about the rights or feelings of others. They’re out to pick the low-hanging fruit, to steal from the stupid, to trick the witless, to scam the slow. Others are out to make a name for themselves, to earn a reputation, to receive recognition and acclaim they don’t get in person, for whatever reason. They don’t care what platform you use or how big its “market share” is, they want to put as little effort as possible into separating you from your money, or into fulfilling their need to feel important. If something is easy to crack, it’s a target, no matter how many users it has.

The conventional wisdom is once again wrong and, considering the lack of definition in the premise of this particular bit of it, impossible to prove.

It turns out that - surprise! - the MacBook wireless networking vulnerability written about previously on this site is no such thing. David Maynor and “Johnny Cache’s” employer have this to say, according to Macworld:

“Although an Apple MacBook was used as the demo platform, it was exploited through a third-party wireless device driver — not the original wireless device driver that ships with the MacBook,” says the company’s Web site.

In addition, Apple says:

“Despite SecureWorks being quoted saying the Mac is threatened by the exploit demonstrated at Black Hat, they have provided no evidence that in fact it is,” Apple Director of Mac PR, Lynn Fox, told Macworld. “To the contrary, the SecureWorks demonstration used a third party USB 802.11 device–not the 802.11 hardware in the Mac–a device which uses a different chip and different software drivers than those on the Mac. Further, SecureWorks has not shared or demonstrated any code in relation to the Black Hat-demonstrated exploit that is relevant to the hardware and software that we ship.”

So it’s obvious that these two charlatans staged the vulnerability, and why? Because of the alleged…

“Mac user base aura of smugness on security.”

The vulnerability in the third-party wireless hardware and drivers is real and poses a legitimate threat to those who use it. But, because these two asshats have an irrational hatred for a group of millions of people based on a stereotype, their credibility is trash and the firm they conduct research for is embarrassed. Instead of informing those at risk with some level of sincerity, they decided to sensationalize it because they wanted to “…stab [Mac] users in the eye with a lit cigarette or something.”

Why is some petty, irrational hatred (and more specifically, a series of commercials) such a motivator for these two that they’re willing to risk their credibility to perpetrate what is, in effect, a hoax? Did they seriously believe that it would never be revealed? Did they not stop to consider the consequences to themselves and their organization when that revelation eventually happened? You certainly don’t make any progress toward stripping Mac users of their alleged smugness when you mislead them with phony demonstrations.

And I wonder if Brian Krebs of the Washington Post will admit to being duped, to not being sufficiently diligent in reporting a story that thousands of other people saw through immediately? Knowing the drive-by media, I doubt it.

Some day there will be a serious vulnerability for the Mac. No software is perfect. When entities who make their living finding such vulnerabilities cry wolf so many times, how will we know when to believe them?

I mentioned last week on Your Mac Life that I’d like to see some changes in Leopard to make the interface more consistent, and that there were some windows I had seen with two different kinds of drop-down selection boxes. I ran across one just a few minutes ago, so I decided to quickly post it here.

The “all”, “Feed”, “is”, and “Aaron Adams…” drop-downs each do the same thing, but they look different. (I prefer the “Feed” type.) I know there’s another combination of drop-downs similar to this in Apple Remote Desktop somewhere.

Is it a nitpicky thing I’m pointing out? Maybe. Most people don’t notice and don’t care. I’m an attention-to-detail type, and I think a new OS release is the time to smooth off the edges. The interface is a user’s first point, and later, primary point of contact with the machine as long as they own it, and making it sleek, professional, and consistent, especially in the face of Windows Vista’s dark dinginess, certainly couldn’t hurt Leopard.

Addendum: I’m writing this in response to Obi-Wandreas’s comment because I can’t post pictures in comments.

Here’s a Smart Mailbox dialog from Mail:

It does the same thing, but uses only one type of drop-down control. Let’s be consistent everyone!