FUD For Thought

Another week, and more FUD being spread about the Mac. This is a good thing of course, as it’s a sign the Mac is gaining credibility in the desktop PC market.

FUD, in case you didn’t know, is Fear, Uncertainty and Doubt. (That’s a tautology actually as uncertainty and doubt are synonyms. But of course FU doesn’t have the same ring to it.)

FUD is created by feeding half truths with whole lies. FUD takes some small negative that is true, exponentially inflates it thus blowing it way out of proportion, to be hopefully picked up and propagated by the media. FUD is obviously spread by vested interests and dates back in history to the mid-70s, with IBM trying to scare customers away from considering their rival, Amdahl’s, machines.

Thus FUD is generated to sell products or reinforce an argument. Bird Flu is a case in point. There’s so much Flu FUD flying around, you don’t know who to believe. There seems to be much exaggeration of the current risks, to the point people are refusing to eat chicken. I don’t want to digress or step into territory I’m not fully educated on, but I feel pretty safe saying you can currently, still eat chicken. Oops. Now using implication, you might automatically assume that you can catch bird flu from eating chicken. From what I’ve read so far, this is not the case. But don’t ask me, ask someone unbiased - like you’re local KFC… or pharmaceutical company…

An appropriate measuring stick when judging any argument is to ask “Who wants me to believe this?” If it’s a vested interest then you might want to counter the FUD propaganda with doubts of your own.

SANS Institute say keep Mac OS X security patches up to date
This week it was announced by the SANS Institute that Mac OS X is in their Top 20 Internet Security Vulnerabilities list. Again this reflects positively on the Mac, that it is considered worth listing, a sign that Macs are gaining more acceptance in corporate circles.

The information in the report was reasonably sound and didn’t tell us anything new. In a nutshell, it said that Mac OS X contains security vulnerabilities that as yet have not been knowingly exploited and that Apple regularly release security patches. It goes on to recommend the following:

U2.4. How to Protect against Mac OS X Vulnerabilities

  * Be sure to stay current and have all security updates for Apple products applied by turning on the Software Update System to automatically check for software updates released by Apple. Although different schedules are possible, we recommend that you configure it to check for updates on a weekly basis at least. For more information about how to check and run the Software Update System, see the Apple Software Updates webpage - http://www.apple.com/macosx/upgrade/softwareupdates.html
  * To avoid unauthorized access to your machine, turn on the built-in personal firewall. If you have authorized services running in your machine that need external access, be sure to explicitly permit them.

Nothing new there at all. Quite reasoned and sound. Certainly the first one almost all Mac OS X users would be doing, and most will have enacted the second (in System Preferences, Sharing, Firewall)

But what happens when this information falls into the wrong hands?

How you get FUDded
In an article posted on SecurityFocus website, Robert Lemos gives the FUD wagon a little nudge with these statements:

This year, the list had something different, however: The group flagged the collective vulnerabilities in Apple Computer’s Mac OS X operating system as a major threat. It’s the first time that the SANS Institute called out an entire operating system for its vulnerabilities.

Only a couple of paragraphs down in the same article, Rohit Dhamankar, the editor for the SANS Top-20 vulnerability list, is quoted as saying:

”We are not pointing at the entire Mac OS X and saying you have to worry about the entire operating system,” he said. “It is just that the Mac OS X is not entirely free of troubles.”

Now what gives? Who’s generating the FUD and why? By the subtle psychology of writing, a statement placed higher in a list is subconsciously implied to be more significant. Thus despite Lemos quoting Dhamankar to counter the opening misleading statements, the damage is done. Mac users have stopped reading and run off to get their flame throwers. Windows users have stopped reading because it’s proved to them what they thought all along about Macs, so don’t need to read any more.

Now the Mac faithful turned their flame throwers on to “vaporize” and attacked not Lemos, but the SANS Institute, who hastily posted the rather understated and restrained:

Multiple questions have been submitted asking whether the entire MacOS is a security risk. Of course not, any more than the entire Internet Explorer is a security risk. MacOS includes software that has critical vulnerabilities and Apple has a patch policy, described below, that do not allow us to be more specific in identifying the elements of MacOS that contain the critical vulnerabilities.

If you did keep reading, you’d find Lemos is now in full stride with his misinformation followed by correction style of writing, presenting one paragraph of mistruth, followed by another that corrects it.

He also reminds us that:

In its last two bi-annual reports, security firm Symantec has warned Apple users that the perceived security strengths of Mac OS X will not withstand determined attackers, especially with mounting vulnerabilities and at least one known rootkit tailored to the system. (Symantec is the owner of SecurityFocus.)

So he’s sowing quite a lot of FUD about OS X. And it doesn’t matter that he appears to do the right thing, by posing a counter-argument. Throw enough FUD and some will stick.

Oh but hang on! What’s that last snippet of seemingly unimportant information - since it’s contained in brackets - Lemos has tossed nonchalantly out? Who are SecurityFocus anyway? There is a possibility you won’t care, or assume they’re something to do with the SANS Institute. Fact is, they’re Lemos’s employer. Security Focus is the website the article is posted on. If you’ve found this article through a third party source, such as a news aggregator, you might not have become aware of that.

What was that question again? “Who wants me to believe this?”

Mr Lemos, who writes for a Symantec owned website, that’s who. Is that a vested interest in your pocket, Mr Lemos or are you just happy to see all the gullible readers?

Lemos’s article aims to be a win-win for Symantec. It either scares prospective Mac users off so they stick to Windows and buy Symantec security products; or if they are a Mac user, they might run out and buy Symantec security products for their Mac. Not much to lose for Symantec, except for a few Mac blogs flaming them. But as Sony found with their DRM root kit debacle, blogs are gaining more force in shaping the world. Blogs may be small fish, but small fish swim in big schools.

Go read Lemos’s article and the SANS Institute report and make your own mind up up about who’s spreading FUD. And remember to ask “Who wants me to believe this?”

FUD is here to stay and something us Apple (and Linux) users are going to encounter more and more. Although we have been known to fight fire with fire…