Tech Pulse 20071108: Does Mac Security Suck?

Josh and Big-O discuss Google's Android phone platform announcement and the new Mac OS X Trojan spreading through porn sites, and talk at length about the pros and cons of Mac OS X vs. Windows security.

Notes and links related to this episode:

Opening Thoughts

• The iBride and iGroom have posted details about how they met and how they planned crashing the Apple Store
  

Tech News

• Google's mobile phone platform announcement: the Open Handset Alliance and "Android"
• Google is not (yet) building its own cell phone hardware
• Microsoft CEO Steve Ballmer pooh-poohed Google's efforts, calling the Open Handset Alliance "just some words on paper right now" and boasting that Microsoft has "many, many millions of customers" who use Windows Mobile on their phones
• The open, Linux-based nature of Android contrasts sharply with the closed software platform of the iPhone (at least until February when Apple plans to release an iPhone SDK)
• If Google chooses to make it an ad-supported platform, how invasive will it be to the user's privacy?
  
• New Mac Trojan horse (eloquently dubbed "OSX.RSPlug.A") is in the wild and being distributed through porn sites
• Trojan horses do not self-propagate or spread themselves automatically over a network
  
• How to prevent infection: Don't download "codecs" from porn sites (and in general, make sure you thoroughly trust any source before giving it permission to install software on your computer)
• How to check for the existence of the Trojan on a system and remove it

Special Feature: Does Mac Security Suck?

• Similarities between Leopard and Vista security:
• Leopard finally includes digital signatures for applications (and all Apple apps included with the OS are now signed)
• Leopard includes application sandboxing, which offers some level of protection against buffer overflow exploits to affect other parts of the system, etc.; somewhat similar to Windows XP SP2 and Vista's Data Execution Prevention (DEP)
• Leopard and Vista both have memory randomization (Apple calls it Library Randomization), a feature that makes it harder for malicious software to find a memory address to exploit it
  
• Cons of Mac Security:
  
• the Leopard firewall is off by default vs. Windows XP SP2 and Vista's firewalls being on by default
• being off by default makes Macs running any kind of networking services much more vulnerable to remote attacks and exploits
• plus, the Leopard firewall has been criticized as allegedly not working as well as it should
  
• lack of anti-phishing in Safari and Apple Mail vs. anti-phishing built into IE7 and Windows Mail
• the Status Bar is still turned off by default in Safari 3 in Leopard; this leaves users completely unaware of where any link will take them, which can make it easier for people to fall into traps such as phishing scams
• Pros of Mac Security:
  
• Leopard uses a proven BSD-based networking stack vs. Vista's virgin stack
• real-world numbers of viruses and spyware for Mac compared to Windows: Sophos reports that by the end of 2006 there were over 207,000 known malware threats (PDF link), and so far there have been fewer than 5 known Mac OS X Trojans in the wild; Windows is still by far the biggest target
  
• Mac OS X comes with a Web filter (as part of its Parental Controls, for non-admin accounts only) vs. Vista includes no Web filter
• Mac OS X knows when to (and more importantly, when NOT to) prompt the user for administrator approval, "without bugging the crap out of you" and "going overboard" like Vista does; Vista users can get so desensitized to these prompts that they simply dismiss them out of habit without paying attention to what's going on
  

Log Out

• Don't forget to Digg us, blog about us, tell friends about us
• Add us on MySpace / follow Josh on Twitter / follow Big-O on Twitter
  
• You (our listeners) can submit story ideas by tagging pages with "techpulseideas" on del.icio.us

Tech Pulse 20071026: Special Edition: Mac OS X Leopard Launch

Josh covers the launch of Mac OS X v10.5 Leopard, talking to several people in the line (including Victor Cajiao of the Typical Mac User podcast), giving his first hands-on impressions of Leopard, and doing exclusive coverage of the wedding-day Apple Store crashers!

Notes and links related to this episode:

Leopard Launch

• Josh attended the Leopard Launch at the Apple Store, Victoria Gardens in Rancho Cucamonga, California
• Standing in the line:
  
• Josh met Victor Cajiao of the Typical Mac User podcast, who commented that Steve Webb from the Lifespring! podcast was also standing in line
• Victor gave his initial impressions of Leopard (which he installed that morning) and usage tips
• Josh spoke with several other people standing in line
  
• Inside the store:
• It was very loud (hence the distorted audio on the podcast, which I cleaned up the best I could, and hence the extensive notes here for those who can't figure out what I was saying)
  
• Leopard (Mac OS X v10.5 Build 9A581) was installed on all the Macs in the store
• Josh tried out Leopard on a new 24-inch iMac
• On the iMac, the Dock was on the left side of the screen, and Josh noted that the Dock's backdrop wasn't shiny like when placed at the bottom of the screen; it looks more like the Tiger Dock, but with a black tint rather than a white one. This was changed in a near-final build of Leopard after users suggested that it just didn't look right, partly because it looked like the icons should slide right off the 3D Dock
• Safari 3.0.4 is included with Leopard. Josh noted that this version apparently still doesn't have the Status Bar turned on by default. The much bigger disappointment, however, is that Apple apparently never finished developing the anti-phishing features that were included in developer builds as little as a year ago, thus making Safari the ONLY major Web browser that doesn't have phishing protection built in. So much for Apple providing the safest online user experience! (Users can always add their own anti-phishing, e.g. through OpenDNS, but the users who are most likely to fall for phishing scams are most likely to use the default configuration of the default browser)
  
• In Leopard, Safari includes a Web Clip button, which makes it super easy to take any part of any Web page and make it into a Dashboard widget
• Just click the button, select the part of the Web page you want on your Dashboard, and it will open your new widget in the Dashboard instantly
• When you double-click on Macintosh HD, you'll have a list of shared computers in the sidebar, under which several of the Macs and PCs on your LAN appear. All the Macs in this particular Apple Retail Store were named ars094.01 and up. Of course there were no PCs on the LAN so I was unable to confirm whether they show up with a Blue Screen of Death icon as had been the case in pre-release builds of Leopard, nor were there any old Macs on the LAN to see, for example, whether a Blue & White G3 or a Mirrored Drive Door G4 would appear with its own unique icon.
• As an aside, Josh noted that the wired model of new Apple keyboards has 19 function keys at the top (whereas the MacBook Pro, the new Apple wireless keyboard, and many others only have F1-F12, this new USB keyboard includes F13 all the way up through F19). The extra keys isn't quite as good as it sounds because several of the keys do NOT act as a function key by default, but instead perform operations such as invoking Dashboard or controlling the volume; you have to hold the "fn" key in order to use many of the F-keys as actual F-keys.
• Spotlight searches now include results from the contents of Web pages you've visited recently in Safari. For example, I had pulled up techpulsepodcast.com and closed it, and a few minutes later when I did a search for Leopard the site came up in the Spotlight menu! Dictionary definitions also show up in the Spotlight menu if the search keyword is a word in the dictionary.
• The buttons in the top-left corner of each window (red, yellow, and green) look a little different in Leopard, perhaps a bit brighter
• Cover Flow in the Finder is pretty cool, especially for those accustomed to it in iTunes or on the iPhone or iPod touch. A couple caveats: even on the fast, brand new iMac demo unit, the Finder had to quickly cache the icons of files inside the Documents folder... twice. The first time it happened, it really didn't surprise me, but when it happened again after returning to the same folder just a few minutes later, I was a bit perplexed to find that the icon previews hadn't been saved in the cache for even that very brief amount of time. Until the icons are cached (or re-cached), a generic icon shows up in their place, which seems a bit tacky
  
• Cover Flow even shows previews of Microsoft Office 2007 files (e.g. xlsx, docx, etc.). Microsoft hasn't released yet released Office 2008 for Mac with support for these formats, but Apple already supports those formats in iWork and apparently in Cover Flow and Quick Look (although it was unclear whether the latter is true only when iWork '08 is installed)
• The first time that you run an application that was downloaded from the Internet (or at least with Safari), it says, for example "[Invisibility Toggler] is an application which was downloaded from the Internet. Are you sure you want to open it? Safari downloaded this file [today at 6:42 PM]." Safari 2 would warn you when you attempted to download a file that could contain an application, while in Leopard the Finder warns you when you first try to run an application that was downloaded using Safari 3. The new Leopard way of doing things is similar to the way Windows warns users about running applications for the first time
• When you run an application from an disk image, it gives the aforementioned "was downloaded from the Internet warning" and then says, for example "[EasyFind] is on the disk image [EasyFind.dmg]. Safari downloaded this disk image [today...]" and then there's a checkbox "Don't warn me when opening applications on this disk image".
• Josh's freeware utility Invisibility Toggler works with Leopard, as expected
• The new purple Aurora desktop is located at "Macintosh HD/Library/Desktop Pictures/Nature/Aurora.jpg"
• Another new Safari feature: When you go to the Safari menu and select Reset Safari, the new dialog box says "Are you sure you want to reset Safari? Select the items you want to reset, then click Reset. You cannot undo this operation." It then gives a full list of each item that can be reset, and each item can be toggled off or on by a checkbox. The items (which are all checked by default, but can be unchecked) as desired are as follows: Clear history, Empty the cache, Clear the Downloads window, Remove all cookies, Remove all website icons, Remove saved names and passwords, Remove other AutoFill form text, Clear Google searches, and Close all Safari windows
• Safari for Leopard doesn't include the option to switch from Google to Yahoo! for the search bar, even though this feature is available in Safari for Windows. However, the second link in the Bookmarks Bar is to Yahoo!
• Quick Look lets you click on a document in the Finder and press the space bar to preview it instantly in a large window, which you can make full-screen (opening high-res photos this way looks awesome on the 24-inch iMac display!)
  
• If you open Time Machine without having configured it yet, you'll get a dialog box that says "The storage location for Time Machine backups can't be found" and gives the options Cancel or Set up Time Machine (the latter requires authentication)
• Time Machine apparently does NOT work with network attached storage according to this MacRumors forum thread
• (Now the part you've all been waiting for!) A little after 7:00, a couple who had just gotten married came running through the middle of the Apple Store wearing their full wedding attire (and also a pair of black caps with white Apple logos) followed by a crew of professional photographers! The couple apparently didn't want to miss the Leopard launch even on their Big Day, so they came to grab a copy of Leopard and a pair of t-shirts and have pictures taken in front of the Genius Bar
• If I heard correctly, the groom told one of the Apple Store employees that he met his bride while working at the Apple Store, Manhattan Village in Manhattan Beach, California. The Rancho Cucamonga store employee said he knew someone who worked at the Manhattan Beach store around the same time they worked there
  
• UPDATE: The bride has posted details of how they met in the comments section of this post!
  
• UPDATE: The groom has also posted in the comments section with details about how the event was planned.
  
• Josh snapped some photos of the couple with his Treo—hence the paparazzi/Bigfoot style photographs. (Boy, the darn Treo couldn't get the audio OR the photos right! Darn you, Palm!!! [Or, said in the voice of Captain Kirk (skip to 3:04): "PAAALM!!!"]) The groom gave Josh permission to post these photographs on Tech Pulse:
  
• 
• Within an hour and a half, the store had given away almost all of their 500 free Leopard t-shirts—meaning that by the time the end of the night, well over 500 people had come to that particular Apple Store for the Leopard launch!
  

Log Out

• Don't forget to Digg us, blog about us, tell friends about us
• Add us on MySpace / follow Josh on Twitter
  
• You (our listeners) can submit story ideas by tagging pages with "techpulseideas" on del.icio.us

Tech Pulse 20070703: iPhone Hands-on Review!

Anthony King (MacMod.com) and special guests Quinn McHenry (Tech-Recipes.com) and Jeff Phillips (MacTechEdu.com) share their personal experiences with the iPhone, tips about instant messaging and secret button combos, and more! Also discussed are the iPhone's unique headphone jack, the final word on Opera Mini 4 Beta vs. Safari on the iPhone... and why Josh is ticked at MySpace.

Notes and links related to this episode:

Tech News

• iPhone Supported Instant Messaging Services - courtesy of Tech-Recipes.com
• Meebo now works! AIM, Google Talk, Yahoo!, and MSN
  

Tech Pulse 20070627: Opera Mini 4 Beta vs. iPhone, Anti-Virus and Anti-Spyware Tips

[Listen to this episode!] [Subscribe to the MP3 feed via iTunes]

Opera Mini 4 Beta launches a preemptive strike against the iPhone, but can it possibly hold a candle to the iPhone's Safari browser? Josh and Kyle also discuss anti-virus and anti-spyware solutions for Windows.

Notes and links related to this episode:

Tech News

• Opera Mini 4 beta tries to take on the iPhone—and fails, based on Josh's testing compared with the iPhone demo videos
  
• features | demo video | anti-iPhone ad (warning: really lame!)
• image quality is really low, but the browser is mostly pretty fast
  
• it's fairly glitchy on Josh's Treo 680, but it is still a beta

Tech Tips
Kyle's

• Scan with Trend Micro HouseCall before installing anything
  • You can also scan with Panda ActiveScan (removes viruses, but only tells you where spyware is so you can manually remove it) and/or X-Cleaner Micro Edition (the latter is very fast and only removes spyware)
    
• Kyle suggests that NOD32 is the best anti-virus available ($30, but he feels like he's donating rather than buying)
• NOD32 is the best at detecting unknown threats with the least false positives, according to http://www.av-comparatives.org/ (as an aside, the worst overall according to the site is Microsoft OneCare)
• AVG Free (free for personal home use) is Josh's recommendation
  
• ClamWin (free and open-source)
  
• Lacks on-access scanning
  
• Low footprint, good for people who only need an occasional scan
• ClamXav is for Mac OS X, and is based on the same ClamAV engine
  
• Products to Avoid
• McAfee products
• except VirusScan Enterprise, which is actually pretty decent in Josh's experience, but definitely stay away from the consumer/home version as it's notorious for slowing down PCs
  
• Norton anti-virus products
• same thing for Norton as McAfee: enterprise version may be good, but avoid the home edition
• Kyle mentioned that he reformats and reinstalls Windows ever couple months, and that slipstreaming comes in handy. You can learn more about slipstreaming at these sites:
  
• Wikipedia article on slipstreaming
  
• How to slipstream SP2 into a Windows XP CD
• Kyle also mentioned the Apple commercial "Security," in which the PC is bothered incessantly by Vista's built-in security notifications. You can watch it online here.
  

Josh's

• How to avoid spyware infections on your Windows PC
• Immunize your PC with SpywareBlaster and Spybot-Search & Destroy (both are freeware)
  
• Josh explains how to set up Spybot to automatically download updates and re-immunize whenever you manually open Spybot
• Josh recommends using a browser other than Internet Explorer (e.g. Firefox) and setting it as the default
• Kyle suggests that on-demand scanners may not be enough for everyone, and he recommends using real-time scanners such as AVG Anti-Spyware Pro or Microsoft's free Windows Defender
• Kyle also suggests trying Arovax AntiSpyware
• Josh also mentions that new releases of Safari 3 Beta apparently need to be downloaded manually—don't expect the beta version to auto-update!
  

Tech Pulse 20070616: iPhone, Safari 3, YouTube on Apple TV, and Parallels 3

[Listen to this episode!] [Subscribe to the MP3 feed via iTunes]

Tech Pulse podcasters Josh, Kyle, and Anthony introduce themselves and discuss the iPhone, Safari 3 Public Beta, YouTube content on the Apple TV, and Parallels Desktop 3.

Notes and links related to this episode:

Predictions about the Apple iPhone

• Will it affect how other mobile phone makers design their most basic models?
• How many units will Apple sell in 2007?
• via Macenstein.com, Apple allegedly placed an order for 500 million Samsung NAND flash chips last monthThese were apparently only ~512 MB chips
• How soon until they really open it up to third-party developers? Like actual apps downloaded onto the phone, usable even when you can't get a phone signal?
  
• Steve Jobs recently said in the Walt Mossberg interview that it would be opened up eventually: "We're working through a way—we'll find a way to let third parties write apps and still preserve security on the iPhone."
  
• At WWDC this week, Steve said developers can make Safari-compatible Web apps using AJAX and other "Web 2.0" technologies
• The release of Safari 3 for Windows was mentioned alongside this announcement
• Why should anyone care about third-party iPhone apps?
• Skype/VoIP, for one thing

Safari 3 Public Beta

• Now available for Mac... and Windows!
• Neither Mac nor Windows version has the rumored anti-phishing features
• Safari is now the ONLY major browser without anti-phishing built-in (Internet Explorer 7, Firefox 2, Opera 9, and Netscape 8 and 9 all have it)
• This makes Safari a poor choice for anyone who might potentially fall for such scams—which is a huge portion of Internet users
• Only the Windows version has the choice of Yahoo! search from the toolbar
• Reasons for opening up Safari to Windows users:
• Get Windows users more accustomed to the "Apple experience"
• Make moolah off the search revenue
• Make it easier for Windows developers to develop iPhone apps without having their hands on one yet

Apple TV gains YouTube support

• So... how exactly does it work? Are all videos reencoded as H.264? Has this been done for all videos, or only the most popular ones? Will this be done for all new uploads to YouTube instantly from now on?
• What kind of interface does the Apple TV have for browsing YouTube videos?

Parallels Desktop 3.0 released

• Now with support for 3D gaming!!!