AppleFree.org :: Proud To Be Apple Free? tag:applefree.org,2008-04-28://2 2008-12-01T07:41:32Z Movable Type Pro 4.25 The Computers From HELL tag:applefree.org,2008://2.1846 2008-12-01T07:39:29Z 2008-12-01T07:41:32Z I worked as a technical support manager for almost 2 years. Unfortunately half of our employees used Macs. The rest used PCs from Compaq and IBM running different versions of Windows.We had at least 20-30 issues a day with the... Amin Babaeipanah http://leomoon.net
We had at least 20-30 issues a day with the Macs and about 2-5 with the PCs. The problem was also that the issues we had with the Macs were often illogical and took huge amounts of time to solve. Another aspect was that the Mac-users never learned from their mistakes and what we told them.

I know it's prejudice to say but it sure felt like the PC-users were more self-going and interested in managing their computers themselves. I quit that job and now I work as the head of technical management at one of the largest computer manufacturers in the world.

-Ron Anderson ]]> http://applefree.org/facts/the-computers-from-hell/ Why App Store Sucks tag:applefree.org,2008://2.1836 2008-11-10T22:16:45Z 2009-05-04T07:36:30Z A year ago, we said that no iPhone SDK meant no killer apps. It came, and the apps are here in staggering numbers. But many of the amazing apps and concepts we grew to love as unofficial apps aren't here,... Amin Babaeipanah http://leomoon.net
Developers can't touch or enhance iTunes or iPod functionality in any way, shape or form--they can't even access your music directory, meaning you better like the way the iPod button works just the way it is. Don't expect any apps to use your wonderfully curated music library either.
Casualties: Instinctive Shuffle, a smart shuffle application that learns your skipping behavior to figure what you actually wanna hear next. Tap Tap Revolution became the watered-down Tap Tap Revenge.

No processes can run in the background--apps have to completely quit when exited, completely contained in their little sandbox.
Casualties: IM is a popular example, but Apple's upcoming push notifications will probably make them a moot rallying point. It also means that third-party copy-and-paste solutions won't work, since you can't move the text to another application. Also impossible is a fantasy app of ours, TrippWire, that would record phone conversations (all legal considerations aside).

Devs can't integrate apps or functions into the OS. Third-party apps will always be second-class citizens, and can't significantly alter iPhone functions, including accessing the calendar or SMS messaging or adding any content to the otherwise useless lock screen that appears when you wake up the phone.
Casualties: Intelliborn's Mario Ciabarra lamented to us that the SDK actually doesn't give you all the same APIs and tools as Apple, and is missing a whole bunch of critical ones that'd let you add content to the lock screen, access calendar events or mail, or change the way the iPhone responds to events, meaning there's no way for him to build his app Intelliscreen (above) using the SDK. Instinctive CEO Justin Smithline also told us that you simply "can't create a well-integrated app," like Instinctive Shuffle. This set of restrictions "flies in the face" of Apple's own philosophy of the creating beautiful software with the best possible user experience, says Smithline.

Pirated games, movies or whatever are a no-no in the App Store, obviously.
Casualties: NES.app, or any emulator, really, dooming us to bloated, over-priced renditions of Tetris by videogame mega-publishers. Also off limits, a dedicated video streaming app for something like the old Stage6 or QuickSilverScreen, which traffics in content that's, um, not legally spotless, to say the least.

A bit different than the piracy concern, apps using copyrights, trademarks or intellectual property of a major company are sticky, and the App Store will steer clear of them if they're not developed by the company itself.
Casualties: Apps like TiVoRemote would have to be developed by TiVo or else they'd have dicey prospects, at best. Basically anything involving a company's intellectual property or trademarks from anyone but the company themselves. An app that'll stream movies from your Netflix "Watch Instantly" account by anybody but Netflix would be another obvious foul.

Devs don't have deep access to the hardware. Jonathan Zdziarski, creator of NES.app and author of a few iPhone books, told us "much of the lower-level functionality has been hidden" in the SDK so "if your application is going to meet the necessarily political requirements, these more powerful features are off-limits."
Casualties: Stuff like Camera Pro, which gives you a ridiculous amount of control over the camera, would have a hard time complying with SDK rules. More than that, Zdziarski says, Apple has "privatized" the CoreSurface framework, which is "making it very difficult for developers to write their own movie players, 2D games, and similar kinds of renderings," especially with performance approaching passable.

Apple's app review process is a complete mystery to developers and takes forever, which can affect app quality and horribly delays app updates.
Casualties: Aurora Feint's developers revealed to us, "How the whole review process [for applications] goes is unknown to us," and that Apple doesn't even tell developers how many times their app is downloaded--they've gotta figure it out by the size of the check or have the app report back. NetNewsWire's Brent Simmons related the cloak-and-dagger headaches to Wired, telling them that developers are "not supposed to discuss actually programming on the iPhone with anybody--even though that would raise the quality of the apps." Between July 11 and July 17, Simmons pumped out five updates to its application and none of them had showed up by the 17th.

Apple limits app testing to five devices, so there is basically is no beta testing.
Casualties: Us. We're the beta testers. Aurora Feint's developers told us that for app testing, "Apple requires special signing to be done that binds each app to a specific device for debugging purposes," and it's limited to five, so they "definitely had some people camping out in our offices" to test. Twitterific creator Craig Hockenberry notes that the iPhone app's crash report come to a dev in a form barely more comprehensible than Swahili, on top of lacking info about what's going on in the phone outside their app. And then, if you do have a fix, there's no way to test it, other than to release it out into the wild through the App Store, "the developer equivalent of playing Russian roulette."

On the upside, Apple appears to be launching a beta testing program soon that'll let devs test apps on up to 100 devices, which jibes with what Tapulous CEO Bart Decrem alluded to in a conversation with us. Hopefully it does roll out in the next couple days, as expected. But even then, putting beta software on a device will require the iPhone or iPod serial number, and will still have to snagged through the App Store.

Apple's number one priority is Apple.
Casualties: Basically anything that threatens any of the iPhone's core functions or key profit centers. Opera told us they aren't developing for the iPhone because the SDK doesn't allow apps "that interpret code, which is essentially what the browser does." Mozilla CEO John Lilly is more acidic in this month's Wired saying, "Apple makes it too hard" but they're using "a business argument masquerading as a technological" one. Any formats not supported by Apple essentially don't exist. AT&T has implied to us that it's Apple that's not allowing laptop tethering, though there's obviously network considerations for the carrier, so we're reasonably, but not totally, sure. The NY Times makes it clear that distributors of free music or video will have it tough too, so don't expect a MyWaves or a Hulu app until the rules get clearer. Steve Jobs told the NYT that this does represent a competitive threat. "We will compete" with developers' apps, he said blatantly.

As anyone running the 2.0 software knows, there are definite stability issues, lending a lot of credence to Apple's sandbox for applications--could you imagine it being more unstable? On the other hand, the massive anticipation for the Pwnage 2.0 tool, the vast universe of applications we're missing out on--not just pirated goodies, but honest-to-God mission-critical wares--shows the SDK clearly doesn't provide everything we need it to. And it might never. But the black market app economy can and does fill the void. Apple might seek to shut it down, but the iPhone's two-class app economy may prove to be its greatest strength.

Gizmodo
]]> http://applefree.org/facts/why-app-store-sucks/ Tired of the Apple smear Campaign tag:applefree.org,2008://2.1794 2008-10-04T23:15:37Z 2008-10-02T23:40:01Z I don't know about you but this smear campaign that Apple is continuing with, attaching Vista over and over again is getting on my nerves. Steve Jobs needs to accept the fact that PC has beaten the Mac over and... Amin Babaeipanah http://leomoon.net
At my multimedia company I am using Vista64bit vista on the main workstation and Vista Home Premium on 2 laptops, Vista ultimate is installed on the tablet. There are two other computers that are running Windows XP and to be honest I nor others in the company even work on them. Vista has become almost everything that is was promised to be. There are features that have made my life at the office easier and more efficient.

As far as the Mac goes I find it interesting that Apple cannot produce anything that is worthy of advertising so they have fallen back to trying to convince the world they are better than Microsoft. Seriously people get over yourselves you are beaten.

When people ask me what I do and I tell them I own a multimedia company, the most common question is "you must use a Mac?". While trying to refrain from falling on the floor laughing I explain to them that maybe in the past Mac was the platform of choice for media developers but our company is exclusively PC based. There are applications that I use that won't run on a Mac. I need heavy GPU power for 3D applications and gaming neither of which are an Apple strength. When it comes to the brute processing power required for some of my applications there is nothing better than my Quadcore Extreme 2.66ghz Cores, 8GB of RAM, 8800GTX w/768MB DDR RAM. A $3000 Machine capable of handling whatever I can through at it including playing the latest games.

Hm let me check can I get an Apple with those capabilities for $3000. Hell no that would cost tens of thousands to get that power in an apple Machine. Even with the processing power the Mac would still not be able to handle playing modern games and many of the applications I use would still not run on it. So to everyone who thinks that Mac is so great and nothing compares to a Mac for graphics, you are welcome to your opinion no matter how skewed it may be. At the end of the day all you Mac people can grab your I-Pods and shoe horn yourselves into your smart cars eating a tofu sandwich while the rest of us are going to have a LAN party laughing at your pretty little paper weights sitting on the desk that can't join in the fun.

OK so I was a little harsh with the last paragraph but I am seriously fed up with seeing these ads on TV. Apple should get out of the computer game and stick to I-Pods and I-Phones it seems that its the only thing they do well. Leave the computer industry to the people that really deliver what we want and not what you tell us we want. PC is the force that drives the computer industry, lead by Microsoft Windows face the fact that Apple can't compete.

That's my 2 cents...

P.S. Those who live is glass houses should not through stones. As far a great release blunders does anyone remember the Mac Mini ? I didn't see a huge smear campaign from Microsoft or the PC manufacturers when you morons thought that the Mini was a good idea. And what about the I-Lamp I mean I-Mac well what ever that stupid LCD on a desk lamp concept was. The PC companies just laughed and continued to build kick A$$ boxes.

Psyc3D
]]> http://applefree.org/facts/tired-of-the-apple-smear-campa/ 10 Lies About Windows Vista tag:applefree.org,2008://2.1780 2008-09-25T00:38:03Z 2008-09-25T00:43:18Z 1. Plenty of Bugs and GlitchesThis one is pure propaganda. In our experience, the only crash we've experienced happened when we installed the new version 8.0 of iTunes (how ironic!), and even that didn't result in the dreaded Blue Screen... Amin Babaeipanah http://leomoon.net 1. Plenty of Bugs and Glitches
This one is pure propaganda. In our experience, the only crash we've experienced happened when we installed the new version 8.0 of iTunes (how ironic!), and even that didn't result in the dreaded Blue Screen of Death -- just a hard lockup that required a cold boot. System Restore blew out the problem, bringing everything back to normal in minutes.
Lie Meter: 10 (Key: 10 = total lie, 0 = everything you've heard is true)

2. Upgrading Is a Hassle
Using Vista's original version, we encountered a weird anomaly with HP printer drivers where Microsoft Word would mysteriously re-launch after we closed it, but no crashes resulted. We've had another issue with M-Audio, where its USB preamp for our podcast microphone has no Vista-compatible driver, to this day. In its first days after initial launch, 29% of Vista's driver problems are allegedly the fault of NVIDIA. While we're using NVIDIA graphics cards on both the notebook and desktop, we've been lucky not to experience any video-driver troubles. And on the notebook with Vista pre-installed, the driver troubles have been nonexistent.
Lie Meter: 5

3. Nagging Security Prompts
The dreaded User Account Control, or UAC, does nag you incessantly, wanting to know if you're sure you want to do this or that. But it's easy to disable those prompts, so much so that if you can't do it, you're not even trying. The one's a favorite complaint from those who are completely clueless about Vista.
Lie Meter: 9

4. There Are Many Versions -- Expensive Versions
Microsoft is brand spamming us with all those multiple versions of the Vista operating system, and we wish there were just one. The pricing is high, too, retailing at $319.95 for a non-upgrade copy of Vista Ultimate (upgrade for $219.95), and $259.95 ($129.95 to upgrade) for the most popular version, Vista Home Premium. Cheaper versions don't even have that sweet, gorgeous Aero interface, so we're not even counting them. Keep in mind that these are retail prices, and all Microsoft's future service packs and updates are free, so you could get away with only buying Vista once and keeping it for years without paying any more. Taken in context, it's not a bad deal, and unless you're using Ubuntu (our fave OS) or other open-source software, a modern OS isn't going to be cheap no matter how you slice it.
Lie Meter: 8

5. It's Not Simple or Intuitive
This is so subjective, one person might think all computers are near-impossible to use while the person next door thinks they're all simple. We've found Vista to be full of usability enhancements, and see no difficulty using it. We particularly like the way menus stay on the top of an application window, and not at the top of the desktop -- this is especially useful when multiple apps are open across our dual-monitor setup. We also like the two mouse buttons on our Vista laptop.
Lie Meter: 10

6. Windows Defender Slows Everything Down
It's true that Windows Defender is a memory hog, but that's the case with most antivirus software. It's unfair to single out Vista's software on this one. And if you're careful (like us), you don't need antivirus software, anyway. It's like closing the barn door after all the horses have already run out. Virus paranoia is a trumped-up piece of fear mongering planted for propaganda purposes. Are we just lucky? Windows Defender doesn't slow us down, because we shut it down without consequence. Maybe it's because we know better than to click on strange attachments (and use Gmail), we have a hardware firewall with a strong password, we always use Firefox, or we just don't wander around sleazy websites -- but virus trouble on Vista is rare.
Lie Meter: 5

7. It's Generally Slow
If you have an old PC, just about anything you do short of MS-DOS is going to seem slow. Yes, Vista and its Aero interface require more resources, and Vista needs a modern processor and multiple gigs of RAM. But hey, this is 2008. Also, Microsoft made a mistake in quoting the minimum system requirements way too low. But overall, in my tests of XP vs. Vista on the exact same machine, Vista was 15.28% faster.
Lie Meter: 10

8. Slow File Transfers
This was a problem with the original Vista, but it's been largely solved in Vista Service Pack 1 (SP1). When we tested SP1 (a pre-release, not the shipping version) file-transfer speeds, they felt slower than Windows XP's, but a lot of that difference had to do with the way the transfer is displayed on the screen. When XP's file-transfer window closed, the transfer wasn't really complete, but Vista was more true to the actual transfer and the subsequent file checking that goes on. But yes, the file transfers aren't as fast in Vista, but in the shipping version of SP1, the difference is hardly noticeable.
Lie Meter: 6

9. Activation Issues
Windows Vista must communicate with the mother ship in Redmond if you want to keep on using it, or you must enter a special activation number after you contact Microsoft. But it's really no big deal. On the laptop we received with Vista already installed, activation wasn't even an issue at all -- it was already done. On the desktop machine where we installed Vista Ultimate, the activation was done online in about two seconds and if we weren't looking, we would have hardly known it happened. If we were constantly swapping out a lot of hardware, this would be annoying, but usually, complaints about activation come from only the most inept software pirates who aren't aware of numerous activation workarounds.
Lie Meter: 10

10. Start Menu Is Hard to Navigate
This is a really lame complaint. If the start menu is hard for you to navigate, it's probably pretty tough for you to operate a close-and-play record player, load a DVD, and start your car, too. We saw this complaint in a lot of places all over the web, and find it to be vacuous.
Lie Meter: 10

Conclusion
Most of the disinformation floating around about Windows Vista is simply not true. Yes, you've been fed a pack of lies, accompanied with a healthy dose of "truthiness." Sure, a lot of that static originated at Vista's clumsy release 18 months ago, but since SP1 was rolled out, Vista is a different animal now. We originally planned to dump Vista after we finished this half-year test, but now that we've experienced it first-hand, we're sticking with it. In fact, we like it. A lot.
Lie Meter: 0 ]]> http://applefree.org/facts/10-lies-about-vista/ Apple Is SO Creative! tag:applefree.org,2008://2.1705 2008-09-13T03:27:26Z 2008-09-11T03:59:00Z If any of you had watched the September 09 2008 keynote of Apple, you probably saw the iPod nano-chromatic thing. Well the way that Steve Jobs said it, it looked like that they spent WEEKS to figure out what colors... Amin Babaeipanah http://leomoon.net
Here is the exact line:
"They come in some amazing colors. The best colors we've ever done. Johnny and his team came up with some, just some fantastic colors and here is, here's what they are."
Yea your Johnny team did some fantastic job copying some other company. Gooz Job (You have to be Persian to get what is "Gooz")!

I think I've seen these exact colors somewhere else!





Now here is Creative Zen which was introduced a long time ago. :)



I guess they don't think different! They copy different! :)

]]> http://applefree.org/facts/apple-is-so-creative/ The Soup iPhone 3G tag:applefree.org,2008://2.1681 2008-09-08T05:40:02Z 2008-09-08T00:38:22Z Here is another funny iPhone video.... Amin Babaeipanah http://leomoon.net
]]> http://applefree.org/facts/the-soup-iphone-3g/ Don't Hack the iPhone tag:applefree.org,2008://2.1664 2008-08-31T09:27:33Z 2008-08-29T09:30:36Z A funny clip about hacking iPhone.... Amin Babaeipanah http://leomoon.net
]]> http://applefree.org/facts/dont-hack-the-iphone/ Beautiful Gallery of Smashed iPhones tag:applefree.org,2008://2.1649 2008-08-26T09:31:41Z 2008-08-21T09:37:54Z Amin Babaeipanah http://leomoon.net









]]> http://applefree.org/facts/beautiful-gallery-of-smashed-i/ LOOSER! tag:applefree.org,2008://2.1648 2008-08-23T09:28:03Z 2008-08-21T09:31:26Z Amin Babaeipanah http://leomoon.net ]]> http://applefree.org/facts/looser/ iPhone 3G Not So Fast After All! tag:applefree.org,2008://2.1630 2008-08-19T09:42:36Z 2008-08-21T09:22:05Z The iPhone 3G may seem to load the web pages VERY fast in commercials, but in reality, it's not so fast after all!It's obvious that in the commercials they have cut the load time at least by 21 seconds!See the... Amin Babaeipanah http://leomoon.net
It's obvious that in the commercials they have cut the load time at least by 21 seconds!

See the power of Apple advertisement? That's why I say DO NOT believe them! Or believe them if you want to be stupid. :)



BTW, In the video says "I like apple products." Well I don't. I didn't make this video...
]]> http://applefree.org/facts/iphone-3g-not-so-fast-after-al/ Apple users stunned by Trojan virus tag:applefree.org,2008://2.1629 2008-08-14T00:16:30Z 2008-08-12T00:18:50Z Security holes in the most up-to-date versions of Tiger and Leopard enable attackers to install malware onto OS X without a user having to type in an administrator's password.This flaw means that hackers could get access sensitive data on a... Amin Babaeipanah http://leomoon.net
This flaw means that hackers could get access sensitive data on a machine or even take over the machine for use in botnet attacks.

Speaking to The Register about the Trojan horse program, Dino Dai Zovi, a security researcher who helped dissect the Trojan, said: "This shows that there is an active community of researchers who are looking for vulnerabilities in Mac OS X and not reporting their findings to Apple."

Sites such as iChat and Limewire are said to have been spreading the malware unknowingly.

Written by: Marc Chacksfield
Sent by: massoccer88 ]]> http://applefree.org/facts/apple-users-stunned-by-trojan/ Top 10 Jobs for a Mac Programmer tag:applefree.org,2008://2.1619 2008-08-09T09:38:29Z 2008-08-05T09:39:51Z 10. Microwaving at McDonald's - Years of experience of button pushing.09. Designer of a battery operated battery changer - good for changing it's own batteries.08. IBM home technician - checks to see if everything is plugged in.07. Microsoft hardware designer... Amin Babaeipanah http://leomoon.net
09. Designer of a battery operated battery changer - good for changing it's own batteries.

08. IBM home technician - checks to see if everything is plugged in.

07. Microsoft hardware designer - counts the number of pins at the end of the plugs.

06. Speed bump - cheaper than tar.

05. Golf ball manufacturer - used to working with computer chips that size.

04. Roasting marshmallows with a toothpick (and they wonder why they set their hands on fire.)

03. Designer of an underwater electrical socket.

02. Writing jokes about themselves to go on this web site.

01. Suicidal counselor - helps people realize they could be worse!

www.anti-apple.com ]]> http://applefree.org/facts/top-10-jobs-for-a-mac-programm/ Think Different! tag:applefree.org,2008://2.1618 2008-08-05T08:59:33Z 2008-08-05T09:38:16Z Amin Babaeipanah http://leomoon.net ]]> http://applefree.org/facts/think-different/ Get Your F***ing Hand Off My PC! tag:applefree.org,2008://2.1560 2008-08-01T01:59:42Z 2009-05-04T07:28:20Z Apple is really pushing the boarder line with their bloatware crap!Remember when Apple got shady with Windows users by pushing out Safari via its own software update tool to everyone, even if you didn't have it installed already? Well Windows... Amin Babaeipanah http://leomoon.net

Remember when Apple got shady with Windows users by pushing out Safari via its own software update tool to everyone, even if you didn't have it installed already? Well Windows users should get ready for another bloatware from Apple. If you have iTunes 7.7 installed on your machine, you will get an unwanted MobileMe control panel without asking! And from what it seems, this is just the begging for Windows users. There will be a lot more bloatwares coming from Apple. My advice is to not use iTunes at all. There are plenty of other media players that are SO MUCH better and RAM friendlier than iTunes and they support iPod, iPhone and other media devices. But if you can't live without iTunes, just block Apple Update to access the Internet. :)
]]> http://applefree.org/facts/get-your-fing-hand-off-my-pc/ Apple Fails to Patch Critical Exploited DNS Flaw tag:applefree.org,2008://2.1572 2008-07-28T23:54:28Z 2008-07-28T23:56:20Z On 08-Jul-08, a massive security patch was released by dozens of vendors for a major vulnerability in DNS (Domain Name Service), discovered by security researcher Dan Kaminsky. DNS is one of the fundamental underpinnings of the Internet, translating domain names... Amin Babaeipanah http://leomoon.net
All users who connect to Mac OS X-based servers for DNS lookups are at risk: Apple has not yet provided a patch, unlike dozens of other companies that make or distribute operating systems or DNS server software.

Apple was clearly distracted by the largest set of launches in its history: the iPhone 3G, the iPhone 2.0 software, the .Mac-to-MobileMe transition, and the App Store. Nonetheless, their customers are now in danger and Apple needs to respond immediately.

All companies that provide DNS service to their customers should have already updated their DNS servers. Many have not. You can determine whether your ISP is at risk by visiting Kaminsky's site and clicking the Check My DNS button. If the site says your DNS is at risk of being poisoned, contact your ISP or your company's IT department immediately.


Poisoning the DNS Well -- Kaminsky accidentally discovered a new technique attackers could use to compromise DNS servers, allowing ne'er-do-wells to convince servers to accept an incorrect IP address for a given domain name from a source other than the one that properly controls information for that particular domain. (This is called cache poisoning.) The attack doesn't affect the DNS server software - it doesn't compromise the software itself - but rather the attack changes the information the server stores, or caches, to provide answers about domain names that the server has retrieved from elsewhere.

Thus, when you type www.tidbits.com into a Web browser's URL field, rather than your computer receiving back the correct IP address from its built-in DNS resolver - 216.168.61.78, in this case - an attacker would indirectly convince that resolver to believe the address was something else, like 172.31.0.16.

Your browser would obligingly use that IP address to make a connection to a Web server while displaying www.tidbits.com in the address bar. That site could be - certainly would be - loaded with malware. This is a particular problem for Windows users, whose systems could be infected simply by visiting a site. With no active exploits for Mac OS X that currently result from visiting a Web page, Mac users are more likely to fall victim to social engineering after visiting a site and being told to re-enter a password or provide details that a trusted site doesn't normally ask for.

DNS is distributed and can be recursive, meaning a server keeps working through a set of linked responses it gets from other DNS servers until it gets an authoritative answer. Your computer has a "stub" resolver, which knows to ask a full-blown DNS server for the name-to-number conversion. The full-blown DNS server is typically run by your ISP or the company you work for. That DNS server, in turn, asks root nameservers - run by a variety of organizations - where to find details about, say, .com.

The root nameservers direct your ISP or company's DNS server to the server that has the lookups for that domain. This can go on and on for every dot-separated part in a domain name, but it typically follows this path: root server, top-level (such as .com) domain server, and corporate domain server.


Weakening SSL/TLS, But Not Killing It -- This attack does not directly disable secure Web connections, although it weakens the signals you rely on for trust, and requires that you be more alert. Secure Web connections use SSL/TLS (Secure Sockets Layer/Transport Layer Security), a mechanism that encrypts a connection and also relies on trust outside that connection to validate the connection. The digital certificates used as the basis of these connections require that a domain name match a particular IP address; but if your DNS has been poisoned, a bogus certificate becomes a much more serious risk.

However, the outside trust element should save you. Certificates must be signed by third parties, known as certificate authorities, like Thawte or Comodo. These authorities are supposed to verify the identity of a party requesting a certificate before the authority signs their request. Authorities charge fees from tens to thousands of dollars depending on how much background checking and control over the certificate is asked for. Details about these authorities are pre-installed in browsers and operating systems completing the circle of trust: Your browser knows an authority's signature, which enables your system to validate the authority's approval of a Web's site certificate.

If an attacker's fake site tries to present you with a certificate that alleges it's www.amazon.com, your browser will alert you that the certificate hasn't been signed or at least wasn't signed by a known certificate authority. That's always a reason to refuse a connection, unless you're connecting to a Web site run by a trusted party that's given you explicit information about the certificate they've chosen to use.


A Coordinated Fix, Except for Apple -- While cache poisoning has always been a problem for DNS, the technique Kaminsky discovered is faster and more effective than any previous known exploits. Kaminsky's flaw allows an attacker to overwrite existing DNS entries that a server has already cached - something never before possible. This vulnerability is a flaw with the protocol itself, and thus affects nearly every DNS implementation in use.

After determining this flaw was legitimate and widespread, Kaminsky immediately contacted major vendors - operating system makers and DNS software developers - and other DNS experts who met secretly at a meeting hosted on the Microsoft campus in March 2008. In an unprecedented move, the vendors all agreed on a simultaneous release of fixes for their products, coordinated with the help of the United States Computer Emergency Response Team (US-CERT).

To obfuscate the nature of the vulnerability, the companies all agreed to use a fix - port randomization - that didn't necessarily reveal the details of the flaw, thus slowing down the ability of bad guys to reverse engineer it and attack servers before organizations could patch. This lasted for 13 days, until the vulnerability was disclosed by a security researcher who accidentally published a draft blog post with all the details. By 24-Jul-08 exploit modules appeared in the popular Metasploit penetration testing tool, empowering any attacker capable of downloading the tool and using a web browser.

(The brief explanation of the flaw is that by forcing a DNS server to look up certain domains by sending it requests, an attacker can take advantage of a predictable sequence of port numbers to send a massive number of fake answers to the DNS server. If just one of the fake answers gets through, the attacker "wins"; it's essentially a race in which the bad guy can have a million marathon runners and the good guy thinks they're off for a solo jog in the park. This can be accomplished in a couple of minutes with Metasploit. Randomizing the sequence of ports used in requests vastly increases the complexity of a bad guy winning. The general vulnerability of predictably used ports was understood in 2001 and built into the DNS server djbdns. The real answer to this problem is DNSSEC, which combines public-key cryptography with DNS, allowing only the legitimate domain owner to provide answers to DNS queries about its domain. DNSSEC has been bogged down for years, but a logjam broke in March 2008, and we're likely to see real use due to this basic DNS flaw being revealed.)


Apple Punts, Doesn't Patch Yet -- Apple has yet to patch this vulnerability, which affects both the desktop version of Mac OS X and Mac OS X Server. While individual computers that look up DNS are vulnerable, servers are far more at risk due to the nature and scope of the attack.

Apple uses the popular Internet Systems Consortium BIND DNS server which was one of the first tools patched, but Apple has yet to include the fixed version in Mac OS X Server, despite being notified of vulnerability details early in the process and being informed of the coordinated patch release date.

All users of Mac OS X Server who use it for recursive DNS must immediately switch to an alternative or risk being compromised and traffic being redirected. Installing the above-mentioned BIND should be relatively trivial for anyone who can compile software at the command line. The Mac community could take this up if someone created a compiled version of BIND 9.0.5-P1 and distributed it for simpler installation.

With active exploit code available in a common attack tool, it is imperative that Apple fix this vulnerability. Due to their involvement in the process and the ability of other vendors to fix their products in a timely fashion, it's hard to imagine any possible justification for Apple's tardy behavior.

If you are unable to patch a server system with new code, you could reconfigure those servers to forward DNS requests to alternative platforms, such as BIND on Linux or Unix, or Microsoft servers, until Apple issues a patch. Ask your ISP or network provider for assistance.

Although the desktop version of Mac OS X is also technically vulnerable, current attacks are directed at servers, so there's no need to panic.

This is an extremely serious security issue and we hope Apple will act responsibly and address it immediately, despite their initial tardiness. ]]> http://applefree.org/facts/apple-fails-to-patch-critical/