Re: Mac OS X vulnerabilities

[Mike Stark <mstark@ucsd.edu>]

  Mac OS X Maintenance Agreements are available for clients and 
servers.  Since mac os 10.0 (before "X") apple has used paid upgrades 
that addressed security updates, as the release point for the next 
supported version of the OS.

  I don't personally agree with this method of major patch/upgrade 
but it has been in place at least a couple of years. This is not 
"news" that MacOS users pay for major security update bundles. At 
least they have the $200/5 user home bundle to make it more palatable 
to home users. And the education list price for volume maintenance is 
even better per copy. But you still pay.

  Apple also releases the details of what was patched and provides 
the tools to "roll your own" patches with the combination of 
developer tools CD's & darwin or samba or SSH or whatever source 
sites. We did our own patches at one period of time as an early 
adopter of MacOS, (circa spring, 2001), rather than pay for the next 
OS upgrade. If you are patching something like open SSH on solaris, 
HP-UX, and IRIX already, compiling a new open SSH for OS X is not 
much additional work once you get it down.

Mike

At 11:43 AM +0100 10/30/03, Radoslav Dejanovic wrote:
> On Wednesday 29 October 2003 02:30 am, Joshua Levitsky wrote:
>
> >  If Apple is responsible then we should see 10.2 patches backported. I think
> >  it's reasonable that 10.3 patches come, and then 10.2 patches, and Apple
> >  should have some Life Cycle policy to say if everything before 10.2 is EOL
> >  or not. It's all a new world with Apple. Let us hope that they do not let
> >  us down.
>
> As I mentioned to Thor in my previous e-mail (and got rejected by list admin
> because he thought I missed exactly that point), we should expect Apple
> patching 10.2 as well, because it still hasn't reached its EOL. I don't think
> Apple wouldn't release a patch for 10.2 but instead tell their customers to
> upgrade to 10.3.