<<< Date Index >>>     <<< Thread Index >>>

Re: Mac OS X vulnerabilities



Mac OS X Maintenance Agreements are available for clients and servers. Since mac os 10.0 (before "X") apple has used paid upgrades that addressed security updates, as the release point for the next supported version of the OS.

I don't personally agree with this method of major patch/upgrade but it has been in place at least a couple of years. This is not "news" that MacOS users pay for major security update bundles. At least they have the $200/5 user home bundle to make it more palatable to home users. And the education list price for volume maintenance is even better per copy. But you still pay.

Apple also releases the details of what was patched and provides the tools to "roll your own" patches with the combination of developer tools CD's & darwin or samba or SSH or whatever source sites. We did our own patches at one period of time as an early adopter of MacOS, (circa spring, 2001), rather than pay for the next OS upgrade. If you are patching something like open SSH on solaris, HP-UX, and IRIX already, compiling a new open SSH for OS X is not much additional work once you get it down.

Mike

At 11:43 AM +0100 10/30/03, Radoslav Dejanovic wrote:
On Wednesday 29 October 2003 02:30 am, Joshua Levitsky wrote:

 If Apple is responsible then we should see 10.2 patches backported. I think
 it's reasonable that 10.3 patches come, and then 10.2 patches, and Apple
 should have some Life Cycle policy to say if everything before 10.2 is EOL
 or not. It's all a new world with Apple. Let us hope that they do not let
 us down.

As I mentioned to Thor in my previous e-mail (and got rejected by list admin
because he thought I missed exactly that point), we should expect Apple
patching 10.2 as well, because it still hasn't reached its EOL. I don't think
Apple wouldn't release a patch for 10.2 but instead tell their customers to
upgrade to 10.3.