Whether ACLs are present or not makes little difference. When a user is logged in, he either has access to do something or he doesn't. Only one line of that ACL really matters, and that's the same on a system with permission control but no ACLs (such as traditional Unix).

If the user is able to escalate his privileges (whether with UAC or sudo, the OS doesn't matter) in order to install malware then he loses.

I completely agree, I was merely refuting the authors point. Not stating that security does or does not rely on ACL's.

The recent malware entirely (as I understood) depended on the user putting their password into an OS prompt for permissions for the bad program. How can the OS make the line between that and something safe like Growl or Virtualbox?

Stating the obvious: App Store only software installs, and other DRM solutions. And yes, that has a price that people may or may not be willing to pay.

It's somewhat scary, but I'm starting to think that we will be forced to adopt something like that. Computers are used for serious stuff too (payments, medicine, things like that), and, apparently, way too many people can't be trusted to administer their computers securely. Right now people are mostly damaging own life, but if this starts happening to medical records, it's going to go beyond personal security.

It's too bad, really. Even if "developer programs" were free -- i.e., just required asking the corp for a developer key (this could be enforced on state level), it would be more of a hassle than it should be.

So lets see an option in 10.8, aka Ocelot, where there is a fairly hidden button called Allow non-app store app installs, with a readable (unlike itunes eula), in Security.

on a unix server, you have to be root to read everyone's data.

on an os x laptop, you can be the logged-in user and read everyone's data. file permissions don't really mean much when everything of importance on the system is owned by one user (which is running dozens of applications with large attack surfaces).

that's not really a criticism of mac os, because it's the same on a windows desktop. you need elevated privileges on both systems to be able to do certain things to the system, but if all you want to do is steal sensitive documents, spy on the system's webcam, launch DDoS scripts, or add a command to the startup/login sequence, there's no need to bother elevating privileges.

one way to fix that problem is to make the system actually use the file permissions and user separation that the system already has, so that safari is running as a separate user with no access to the operating user's home directory, and that itunes has no access to the machine's webcam.

i haven't really looked into the sandbox feature of lion, but i'm assuming it does pretty much that, just like ios' concept of each 3rd party application being segregated from each other and not able to read files it's not supposed to.

> on a unix server, you have to be root to read everyone's data.

> on an os x laptop, you can be the logged-in user and read everyone's data

Shenanigans. Unless you have the password of the logged in user, you can't read stuff belonging to other users. Further, if the user in question does not have an Admin account, you're shit out of luck even if you do know their password.

> Shenanigans. Unless you have the password of the logged in user, you can't read stuff belonging to other users

Their home directory defaults to world readable, and the default umask is set so documents created are world readable, so you can read things in their home directories.

The Desktop, Documents, and so on directories are 700, so things in those should be unreadable.

I think his point was that on a laptop, everyone is often just the one logged in user.

reboot into single user mode, be root, read anything.

if you have physical access you can do anything

This article is not about physical access, it's about remote security.

If you have physical access to a machine, then you can almost always read the files off of it, except in certain cases with encrypted volumes.

"[Unix permissions] were much better than what was available in Windows for the longest time"? Try DOS. Windows 1.0 - Me were never multi-user operating systems, which was largely the purpose of having permissions, until the world realised just what a mistake it is to have full, unguarded permission to your system files.

MS's first multi-user OS was Windows NT in 1993, which shipped with ACLs.

Microsoft Xenix, 1980.

Huh, well I never. Still a UNIX though, so let's say NT was the first one they designed, perhaps.

I found this article to be very poorly written, although it does makes some good points.

That said, I agree with pretty much all of what you said.