Replies

This is the last comment on Sophos' website from your link you provided:

"I agree that it's a great idea for Sophos to offer this product free for Mac home users. Our company has used Sophos for several years on Mac and Windows systems. I like being able to tell our users that they can have all their Macs protected with a free version.
However, as the admin who receives automated alerts about everything Sophos finds on our Macs, I can tell you that it is very, very rare to see any threat with OSX in the name. I have never had any Mac threat on any of the Macs I use at home, and that is even with teen-agers using them. This is not my head in the sand, this is still the reality that Mac threats are exceedingly rare, and virtually every one of them requires users to do something stupid to become affected or infected. I await Mr. Cluley's response! ;-)
I save every Sophos alert generated from one of the several hundred Macs in our business. Right now, I have 1,068 of them going back to 2005 -- so that in itself is not a huge number. Out of those 1,068 alerts, only four of them contain the letters OSX in the threat description. Now I suppose some of the others could be cross-platform?

Sophos' Brian Cluley did not respond. I think that more than makes the case for the LACK of any threat! Again you are hoist on your petard, Flint.

A comment? Wow, consider me "hoist on my own petard." (Verb tense agreement, your mortal enemy, would appear to have hoisted you on your own petard.)

I am not (nor have I ever) argued that there is a plethora of OSX-specific malware out there. I take issue with the idea that security through obscurity is in fact any security at all. This applies to Unix in general as well. If malware exists, either as proof of concept or otherwise, then a security vulnerability exists. If an application-level vulnerability exists (such as those in Safari that allow Macs to be given away at CanSecWest), then by definition a security vulnerability exists. If Apple patches security vulnerabilities, then again by definition security vulnerabilities exist. This argument is completely idiotic - it's like saying that because you've never gotten into an accident in your car then it's accident-proof.

By the way, cross-platform malware has increased substantially and will continue to do so as the heterogeneity of the computing market increases.