[superuser2]

Yes, it is correct that Macs can get viruses. Where people get upset is when you generalize this to say that because >1 virus exists, OSX presents no significant advantage over Windows.

Viruses are not a fact of life for Mac users. Talk to anyone who uses or services Macs; you'll be hard-pressed to find anyone who's even seen an OSX virus. Whereas for Windows power-users, cleaning viruses for friends/parents is practically a rite of passage.

OSX is still dramatically safer in terms of your actual risk of a random remote attack. Whether this is economics or superior engineering, or how Windows and OSX stand up to deliberate attackers, I will not pretend to know.

[vectorpush]

Viruses are not a fact of life for Mac users.

Neither are trojans, and that is exactly why this trojan has manifested so successfully. Windows users are mostly hardened to the basic threats of the internet (don't open a random exe etc), and are cognizant of the reality that malicious software does target them. Non-technical Mac users have been lulled into a false sense of security that will eventually make them a more vulnerable target than a Windows user (as Win7 and OSX pretty much stand shoulder to shoulder in terms of security).

OSX is still dramatically safer in terms of your actual risk of a random remote attack.

What is your evidence for this?

[superuser2]

I've done ~15 Windows reinstalls in the last few years, and every single one of them was malware masquerading as anti-virus software. OSX's reputation may make Mac users feel invincible, but Windows users' knowledge of their vulnerability opens them to pretty effective scare tactics.

In fact, it hit my house twice, and I'm not exactly incompetent: Win7, Security Essentials, kept on top of Windows Update, no admin privileges for little brother or mom, updated Firefox, etc. The last time, it turned out we were behind on Java updates - it popped up in the systray 5 or 6 times a day for a few months and the few times my dad tried to allow the update, it failed. I didn't know about that until I was in the room while my brother was using the machine and I saw a dialog that looked an awful lot like Windows reminding you to install AV but not quite right. No way anyone else would have noticed that the background gradient was just a bit off. Did a scan... MSE was showing me 20 different Java exploits and "Anti"virus 2012 wouldn't let me open Firefox again outside of safe mode. Not something my parents would be able to deal with when I'm not there; they would have had to pay somebody. Its replacement will be a Mac; they like OSX better anyway.

I worked for a small-business IT firm for 3 summers and have never seen or heard of OSX malware except from the blogosphere/HN/media. We took our clients' security pretty seriously - corporate domains, enforced Automatic Updates, no idiots with local admin, corporate endpoint antivirus, antivirus in the spam filter, Sonicwalls, Firefox wherever possible, etc. Still, we got virus calls pretty frequently. I would usually babysit the reinstalls at a reduced rate, but when I wasn't interning, businesses were shelling out $150/hour for that. To be fair, most were XP, but there were a few virus calls for Win7.

I don't have statistics, but if you're going to claim OSX has fallen as far as Windows in terms of infection rate, I think the burden is on you to show some data. Again, just as many family friends running OSX as Windows; I've had Macs die (my MBP's motherboard gave out right after 4 years), I've had Macs run out of disk space, I've had the PowerPC/Intel switch lose my family a lot of money because perfectly good ~2006 machines can't run a modern OS or Flash/Firefox/iTunes, but I've never seen malware for OSX.

[vectorpush]

I've done ~15 Windows reinstalls in the last few years

So what? I've reinstalled Windows three times since Windows 7, and it's never been due to a virus. The last company I worked at was a Windows shop that also had 0 malware problems. Anecdotes are pointless in this discussion.

I didn't know about that until I was in the room while my brother was using the machine and I saw a dialog that looked an awful lot like Windows reminding you to install AV but not quite right. No way anyone else would have noticed that the background gradient was just a bit off.

Yes, your brother was the victim of a social engineering attack, the exact technique used to infect these Mac users. Windows systems aren't inherently less secure, and every terrible ailment described in your post is the result of voluntary action taken by the user.

I don't have statistics, but if you're going to claim OSX has fallen as far as Windows in terms of infection rate, I think the burden is on you to show some data.

No. The onus is on you to demonstrate how Windows 7 is inherently less secure than OSX. You're making vague assertions about how Windows is less secure but you haven't given specific examples of why that is true, only anecdotes that anyone can counter (or bolster) with personal exeprience.

The bottom line is, short of 0-days, both systems are equally secure.

[superuser2]

You are constraining your discussing to Windows 7. I am not. XP may have disappeared from the life of a non-corporate programmer, it's still everywhere for me. Hence the impedance mismatch. Most of our shop's customers did not see a business need to upgrade, and acquaintances that can afford to buy new computers while their old ones are still running (however poorly) tend to be Mac users anyway.

>every terrible ailment described in your post is the result of voluntary action taken by the user.

No, it was a remote Java exploit. The dialog was to get you to pay for it after it had already installed.

The point is that despite all this talk about OSX viruses, malware is still not a part of day-to-day life with Macs to anywhere near the extent it is with Windows (when you include XP).

[vectorpush]

You are constraining your discussing to Windows 7. I am not. XP may have disappeared from the life of a non-corporate programmer

Well what version of OSX are you using to make your comparison? SP3 to 10.8? Either way, there isn't some nebulous security gap between OSX and Windows, vulnerabilities exist in all systems and a responsible vendor patches them when they're discovered.

Please show me how to remotely compromise an up to date SP3 machine. Yes, there are exploits that exist at points in time, but the same is true of OSX, just google "OSX exploit".

malware is still not a part of day-to-day life with Macs to anywhere near the extent it is with Windows

All that proves is that there is more malware targeting Windows, it speaks nothing to the inherent security of the system since malware can't install itself.

[echo-unity]

|vulnerabilities exist in all systems

Couldn't disagree with you more.

[mark_integerdsv]

Your attempts at maintaining blissful ignorance of the probability of attack are very sweet and your final sentence could perhaps hold up as logically holding some water (I'd argue that you, like the poster to whom you are replying, have taken a very narrow view to support your position) ...the fact is that in practice and for the average user your assertion is flat out false.

[wallflower]

> every single single one of them was malware masquerading as anti-virus software.

I'm curious what you think about Malwarebytes Anti-Malware - this was the only product that was able to clean my father's Win7 PC for Antivirus 2012 (by booting into safe mode with networking and running the cleaner). Paid for the Pro version. A little difficult to get working with the Symantec virus scanner but worth every penny for not having to make the trip to my parents to clean malware since...

[gnaffle]

If most trojans and viruses are still made for Windows, how can this statement not be true? If you took a random sampling of infected websites or virus emails, the large majority would probably be targeted at Windows.

Actual risk of a _targeted_ attack is a different matter.

[vacri]

OSX is still dramatically safer in terms of your actual risk of a random remote attack.

It certainly was in the WinXP years due to a far superior security model, but I'm curious if this is still the case with modern windows.

[acdha]

The developer mindset on Windows is still stuck in the 90s, and most of the exploits are due to the laggards who've never taken the user experience for updating very seriously (Adobe, Sun/Oracle, various streaming video players, etc.) or treating security as an optional feature and installing with insecure defaults (see previous list).

Mac culture has been less user-hostile for a long time so Mac apps usually have e.g. automatic updaters (and rarely the crazy login-to-vendor-website-to-download insanity) and lack installers, making it less common to require authentication or slop things around the entire filesystem. This is not perfect but it avoids some of the pathologies which Microsoft (and Chrome) are slowly dragging the Windows community out of.

[muyuu]

I've had new Mac users insist that I recommend an antivirus for them. Users who had very safe habits, didn't download basically any software or visit warez sites. They simply - and very sadly IMO - cannot reconcile the idea of a world where AV software is not completely necessary.

They'd only make their computer slower but hey, it's their choice.

[brazzy]

Dude, you need to update your mental threat model. These days, there's no such thing as "safe habits" - you're up against drive-by downloads that exploit browser or plugin vulnerabilities and are delivered by all kinds of perfectly normal websites that just happen to be vulnerable to SQL injection.

[muyuu]

My cousin, for instance, uses her Mac as a word processor, email reader, Wikipedia reader or DVD player 90% of the time. Works in TextEdit, doesn't download basically anything at all. Does everything basically inside Apple's walled garden. The only "dangerous" thing she did in the past is using MSN for Windows. This could mean automatically receiving payloads and run them by just having an infected contact, because of Microsoft's "wise" defaults. This doesn't happen on Adium. I think she doesn't login to that network much anymore, now it's all about Jabber (gtalk) and Skype I reckon.

Unless Apple started injecting payloads there's basically no plausible way to get her infected. She doesn't even "browse the net" for the most part, doesn't click on links, doesn't give a f.

There are safe habits. AV companies would like to have you thinking you're always about to have your nix based system rooted, but this is damn unlikely for most people not using dodgy sites. I fancy my chances to get struck by lightning above her chances of having her system compromised, and I don't get out of my house scared.

[mkr-hn]

Malware creators are going to get more creative and more dangerous now that Windows is better and Macs are more popular. Technical countermeasures can only do so much against a determined mind with a strong incentive.

[super_mario]

Windows is now better? What the fuck. You do realize this is Java exploit, and that recent versions of OS X don't even ship with Java. And on top of that this "malware" asks user for their admin password to install itself. And on top of that if you have dev tools or any of the popular system monitoring utilities it gives up!

Contrast that with typical Windows situation where no user cooperation is required to get infected.

[prophetjohn]

Cool down, turbo, he's saying that Windows has improved from what it was in previous versions, not that Windows is better than OS X (the horror!)

[super_mario]

He's also edited his post to make it less ambiguous.

[mkr-hn]

I don't recall it being more ambiguous at any point, but my brain is bad at keeping revisions. Even if you're right, it doesn't excuse the tone.

[mkr-hn]

Drop the hostility and reread what I said. I didn't say "Windows is now better than Macs."

[jister]

>> Viruses are not a fact of life for Mac users. Talk to anyone who uses or services Macs; you'll be hard-pressed to find anyone who's even seen an OSX virus. Whereas for Windows power-users, cleaning viruses for friends/parents is practically a rite of passage.

That's because the market share of Mac is so small that no smart virus developer would even bother wasting their time creating one.

On the other hand, create a powerful virus for Windows and the next day your on CNN.

[simonw]

These days I think you'd be much MORE likely to get press coverage for a virus that targets OS X than for one that targets Windows.