moopark

Skype (which has notoriously complex obfuscation) had this problem for a short time when Mac OS X 10.5 was released:

http://securosis.com/blog/leopard-firewall-code-signing-brea...

You can work around this by validating only the important subset of the Mach-O contents, but it's probably not worth it. Cracked applications (rather than, say, reverse engineered serial number generators) are an annoying thing to use -- you'll have to refrain from applying updates until you get a new crack, trust the person distributing the crack, etc.

It's not something I (or, afaik, most other small Mac developers) really worry about.

It wouldn't be any more responsible/ethical/useful of me to post a "I Can Crack Your Non-Mac App With Just A Copy Of IDA Pro and HexRays" tutorial. I could show you how I can press 'F5' and decompile your code back to surprisingly readable pseudo-C, but that's not going to help you secure your application, it's just patting myself on the back and showing you how cool I am.

On top of that, the author is still flogging the PT_DENY_ATTACH horse, despite the fact that it's been documented over, and over, and over again as trivial to bypass. PT_DENY_ATTACH was added to meet the minimal contractual requirements Apple had to movie studios and record companies by preventing users from attaching a debugger to DVD Player and iTunes. It's not a real security solution. There's a simple open source kext (that was first implemented for Mac OS X 10.3!) that simply disables it across the board:

https://github.com/dwalters/pt_deny_attach

Who covers the cost (often quite high) of fixing/cleaning dings, dents, rips, missing/broken parts, broken headrests, dog hair, dirt (from plants?), gum, and other such things?

These are car maintenance issues I see all the time when using both Zipcar and CityCarShare. If I had a personal car, I'd flip if it was subjected to the level of abuse that these fleet cars are -- the depreciation due to wear and tear would be significant.

[Edit] Since I got downvoted to 0 (and have no idea why), I'll expand on the relevant answers I found in the FAQ:

  What if my car is returned dirty?

  Renters are required to be responsible and keep
  the car as clean as possible. At the end of every
  rental, you can rate the user and leave feedback.
  If they return it in a dirty condition, you should
  note this when leaving feedback.

... actually, that's the only FAQ item I can find on the subject. The cars are insured, but what's the deductible? Who pays it? Is the insurance company really going to pay out a claim for a broken headrest, a ripped seat, or a ruined floor mat?

That may make me a luddite, a terrorist, or even a social-scrooge, but you'd think it would be worthwhile to make a minor concession to your potential customer base and allow people to create accounts without having to go through (and link them to) Facebook.

[Edit] I really don't understand -- why was I downvoted here? Can someone explain why they think I'm wrong? Isn't a constant, high-frequency tone going to draw more power than variable output with significant larger gaps (and a likely lower peak voltage difference?)

The less repetitive work we delegate to human fallibility and instead delegate to a machine, the more time we have for human ingenuity.

Shit doesn't work or it breaks, then the person who sub-classed needs to fix it.

It's not that simple. The more difficult it is to understand the rules of behavior before changing the code, the more difficult it is to change the behavior. It's not just a question of expressing valuable -- but simple -- kindergarden requirements (this value may not be NULL), but higher-level requirements (this method must be called in the context of a READ-COMMITTED transaction).

The more you can express concisely, the easier it is to mutate the system over time. It's not a question of breaking code -- or noticing when it breaks -- but having the language assist in simply not breaking it at all.

This also happens with plain aggregation/composition btw.

Composition makes invariants easier to understand. If you then design your classes so poorly as to fail to enforce correct behavior through their API insofar as it is possible to do so, that is the programmer's failure.

It also happens with data-immutability (which has nothing to do with inheritance, as your object can be immutable and extend a dozen classes).

Data immutability is related to the avoidance of inheritance insofar as they both very significantly facilitate the full and easy comprehension of an implementation invariants.

This is a classic type system straw man. The language doesn't support encoding integer ranges in the type system, ergo, the type system is not ever a significant advantage and all invariants must be documented. You fool!

What you need is to document the thing:

Some invariants require further documentation. The more you can express concisely in code via the type system, the more time you and your API clients save in both development and maintenance.

More succinctly: By expressing them in code you let the compiler automate the work of enforcing them.

Or if you're paranoid and that function can totally break your code:

An assert doesn't "protect" your code from future changes (better phrasing would be: make your code adaptable to change, loosely coupled with its dependencies as to allow iteration of your code and its dependencies independently).

An assert simply causes your code to fail in an obvious way. It's still up to you to track them down (at runtime) and figure out where you went wrong.

The very few classes that may be subclassed are documented as such, and the methods that may be overridden are explicitly documented, as well as what behavior is required from the subclass when overriding those methods.

The invariants of complex inheritance hierarchies are very hard to understand. What happens if the superclass method isn't called? What happens if one of those methods is called, but another isn't, and the object is placed into an indeterminate state? What enforces that your subclass -- and all other subclasses -- will conform to these often complex and difficult to describe invariants?

This is very similar to multi-threading with mutable vs. immutable data. By making your data immutable, you grossly simplify the understanding of your system's behavior.

The problem isn't solved. You now know what the type is for that particular moment. What you don't know are the invariants of the don_t_know_the_return_type() function.

What types/subtypes is can return, whether it can return None, what exceptions it can throw, and whether those will change in the future. That information can only come from a type system and/or documentation. Simply reading the implementation only tells you the current state of the system, not the rules that will govern future iterations of it.

The more invariants that can be expressed concisely by the language itself and enforced by the compiler, the less work is left to the user of the function to review documentation/implementation.

This is one large reason why well-designed advanced type systems are so valuable -- you can express complex invariants using them, and then let the compiler enforce those invariants.

No. I'm sympathetic because it was a very stupid prank, not because of the target.

What was the actual damage caused? It certainly didn't "paralyze" Palin's campaign.

What Apple technology in specific do you think is so advanced?

I don't think that is in conflict with my original statement, and the remainder of the Maps API is truly bad. I regularly make the mistake of using the scroll wheel, get stuck trying to figure out how to show (or hide) street view, etc.

Regarding GMail -- it's a poor approximation of an existing, very basic desktop experience. There's not a lot of design innovation there, if you look beyond webmail.

As for "not having a sense of history", that's a strange ad hominem, but I'll lend it a response:

- I was on the internet when there was only gopher (from terminals at the library).

- I was also on the internet when Netscape 1.0 was the shiny new thing (and the 56k frame relay I used to download it was considered quite fast).

- I used Mapquest, Altavista, and Yahoo, but before that, I used people's random collections of favorite links that you found on their home pages.

I don't lack perspective on history, but I don't equate Google's technological improvements in "advancing the state of the art" with overall quality UX design. The minimalist home page was brilliant in comparison to Yahoo at the time, but it's not an aesthetic they've been able to continue to apply successfully.

Google consistently produces fantastic technology, lackluster design, and then rarely, a design outliers that is actually good.

Except that, as far as I can tell from the vast majority of Google's products, Google (perhaps not Marissa?) has a design sense that ranges from "poor" to "incredibly poor". Chrome, perhaps, being a singularly notable exception.

http://www.azlyrics.com/lyrics/rickross/hustlin.html

I think it's a minor but telling difference of perspective of what we, respectively, do in business.

If a locally repurposed word like hustler has a very strong meaning outside your circles, chances are good that when you start talking about hustling in relation to business, a fair number of people are going to think swindler or worse.

It seems that a number of people like to use it as a self-description because it does have negative, edgy traits -- in the same sense of 'ninja'. Unlike 'ninja', however, 'hustler' can easily lie a bit too close to the truth.

hustler

  n 1: a prostitute who attracts customers by walking the streets
    2: a shrewd or __unscrupulous__ person who knows how to circumvent difficulties

Perhaps repurposing 'hustler' without negative connotations will work, but this is a word with a lot of ugly baggage, and the first thing I thought of when I saw it used in reference to startups: dishonest businessmen.

[Addendum] For completeness, a dip into the modern lexicon:

http://en.wikipedia.org/wiki/Hustler_(disambiguation)

  Hustler is a monthly pornographic men's magazine
  and general brand of Larry Flynt Publications.

  Hustler or hustlers also commonly refers to:
    - A practitioner of confidence tricks
    - Someone who deceives others by hustling, usually in sports
    - An American hip hop slang word for a pimp,
      drug dealer or male prostitute

http://www.quantum.com/Products/TapeLibraries/index.aspx

http://www.dell.com/us/en/enterprise/storage/tapebackup_auto...

Here's why you're wrong:

Unlike Linux, Mac OS X ships with a standard, stable, and exceptionally complete set of libraries. Apple goes to great lengths to maintain binary and API compatibility, and this means a few things:

- Most applications will only require Apple-supplied libraries, as there's very little that isn't provided by the OS libraries.

- Apple keeps the OS libraries up-to-date.

This feature-complete ABI/API-stable environment is not free for Apple to provide -- it takes a lot of effort to provide a consistent API across libraries and maintain the API/ABI compatibility across releases, but the advantages are tremendous. Mac OS X has been able to skate by without package management for years because this approach allows for drag-install drag-uninstall application distribution.

UNIX derivatives, on the other hand, were faced with a lack of standardization of core application libraries, a huge number of incompatible libraries to fill in the gaps, and a software distribution model that involves splatting files all over the disk. The end result is that you need a packaging system to maintain security updates, manage all the files on disk, and upgrade the world in lockstep due to API/ABI compatibility issues across libraries shared by wildly disparate applications.

So -- tl;dr -- it's not a security 'nightmare' because the core libraries that everyone uses are already shared and updated by the OS vendor.

This is also what makes Mac OS X so much nicer to develop and distribute applications for as compared to platforms that require a centralized package manager authority to keep things sane.