Mac OS security

Question

Sorry if this is the wrong place, I couldn't find another place to ask this.
Can anyone give me as much information as possible about the security of the linux kernel and why it doesn't get viruses. A lot of PC users say that it isn't secure, it just doesn't get viruses and stuff because people don't write them for Macs. Is this true? Also what about how hard it is to hack macs vs. PCs?
This is an issue I want to understand. Be as technical as possible. I will follow it. I really want to know the nitty-gritty details between Windows and Mac when it comes to security and the debate about macs getting less viruses than Windows.
Please provide as much information as possible. Any links to webpages with information regarding this information is appreciated also. Hopefully you all understand about what issue I am trying to gain information about here. It seems to be a common one.

Answer 1

> Can anyone give me as much information as possible about the security of the linux kernel and why it doesn't get viruses
I don't know anything about the Linux kernel, but I can answer some of the questions related to Windows vs. everything else.
First, bear in mind that your question is very broad and that not everything is going to apply to all cases - Macs, Linux and UNIX systems can be configured to be insecure, just like Windows can be secured if you're prepared to go out of your way to make it so, and that's the crux of it.
At its simplest level, by default, out of the box the entire Mac OS X system is setup so that users can do what the need to do and have to go the extra mile (usually including some form of authentication) before they do anything that might impact the OS or other users.
For example, on Mac OS X you can't install any code that runs at the system-level (e.g. drivers, keystroke loggers, trojans, etc.) without authenticating. Sure, these pieces of code can exist (writing a key logger isn't hard) but getting them deployed is a major headache.
By comparison, on Windows a trojan can install itself when the user does nothing more than view an email or visit a web page. There's no warning, notice or visual clue that it's happening.
Now, Windows Vista does change that somewhat - at least it now tells you that a trojan app wants to install itself, but it doesn't do it in any way that authenticates the current user and, by all accounts, pops up its warning messages so frequently that users are already tuned to just acknowledging the alert without reading or considering the consequences (you may have seen the Apple ad hinting at this one).
So the first level of security is a big one - you need to authenticate in order to make changes to system-level configurations.
Note also that this can change in a Windows network where the network admins control everything at the server-level. These setups are common in enterprise setups and the accounts are managed centrally, often to the point where users cannot run applications other than those on an 'approved' list. This enforces the concept of authentication before doing anything that might be malicious, but is only available in a network, not standalone environment. Of course, Microsoft would love for everyone to deploy a Windows Server and buy client licenses (tax) for every device they want to connect to the server, but that's just not going to happen in a home environment.
There is some weight behind the argument that the Mac and Linux markets are smaller and therefore smaller targets, but that's only part of the picture.
If the Mac OS was as insecure as Windows, and the malicious code author had the same chance of infecting a Mac as he has infecting a Windows machine then the Mac would be more of a target.
I don't know the exact numbers, but lets say there are 100 million Windows PCs and 10 million Macs. 10 million is still a big target and any hacker would love to infect 10 million boxes. However, the chance of infecting the PC may be 80% (the default is to install the malware) whereas the chance of infecting the Mac may be 5% (remember, the Mac requires authentication before any malicious code could be installed, so it's still possible to do if the user isn't cautious).
That means that the actual 'market' for the hacker is 80 million PCs vs. 500,000 Macs. Now you see why the raw market share value isn't so relevant. Even if Macs had 50% of the market, there would still be a lower chance of infecting the machine (40 million infected PCs vs. 2.5 million infected Macs).
Now, that's not to say that any OS is truly secure. Bad programming can lead to problems on any system. There's a lot of press attention at the moment regarding 'buffer overflow' attacks where malicious users can force an application to do something it wouldn't normally do by passing it invalid data. A well-written program would examine the data before processing it, discarding anything that isn't valid, but often applications try to process the data and crash.
These kind of problems can exist anywhere. Even OpenBSD, considered one of the more secure OSes, was recently identified as having an exploitable buffer overflow problem.
This leads into the whole 'open source' argument of whether open source code is more secure or not.
Windows Vista is reported to be about 50 million lines of code.
Those 50 million lines of code are proprietary to Microsoft and few people outside of Microsoft have seen them or been able to verify them for buffer overflow problems.
By comparison, Mac OS X contains approximately 86 million lines of code, which is significantly more, but a good chunk of that is available as open source, either through the Darwin project, or via the numerous open source products that are bundled in with the system.
All that open source code is viewable by anyone. A number of people would argue that this means anyone can find and target any bug in the code, but it also means that anyone can find and fix any bug. If you prefer to believe that there are more good people in the world than then are bad, this model seems to work in the Mac's favor. Despite Apple's smaller market and smaller engineering/development teams, there are more people able to look at the code and report problems that Apple can fix in future updates.
There are many more facets to the argument, but my fingers are waning. I'll let others post their thoughts, too and come back later.