As with many matters in this world, there is no possible black/white assessment, and therefore no black/white answer. 'Safety' in this context has at least three broad components, which can be called something like structural, organizational and personal.

Is it possible to introduce malware to the memory and/or storage by means of a remotely-controlled attack, as opposed to a random attack through removable media? Failing isolation from all networks and avoidance of all unproven removables, the answer is 'Yes'. However, the risk can be minimized.

Can malware control the operation of the computer? If the operating system is accessible to all applications, or if it can be circumvented by direct address of the hardware, again the answer is 'Yes'. If core operations are controlled by a single application, which is at least one remove from the user's voluntary control and which will respond only to permissible requests, again the risk can be minimized.

The most vulnerable component is the personal. If connections, firewalls, permissions and passwords (as symbols of the kinds of protective measures) are not implemented, or worse are circumvented by users, only the intrinsic strength of the organization of the OS can offer protection against malware. The curiosity, cupidity, complacence and ignorance of users, however, are powerful aids to would-be attackers.

No platform is free of users unless it is embedded, so the answer to your question has to be along the lines of 'It depends ...'.

de

Security software is typically only good against known attacks. Given a new method of attack, the security software is not able to defend against it any way so users are still at the same risk to that particular attack as those who don't run it. The only advantage comes when the security software vendor releases an update for the attack before the OS vendor. In the current MS environment, security software is a big business, so there is little incentive to close holes in the OS that allow attacks so long as additional purchased software can do the protection.

Security software vendors have tried to stir up the FUD on Mac OS X, and each time it fails. They'd like to add Mac OS back to their revenue streams, as it was in the OS 9 and earlier days, but OS X is simply much more well designed in regards to security than Classic Mac OS or Windows. That's not saying that it's particularly good, but it's much better.

Also, OS X has a built-in firewall system. Also a true multi-user system, and a privileged access system similar to (but less annoying than) the UAC of Vista. Security is there, whether the user really pays attention to it or not.

ALSO: Many PC users are under a false sense of security due to their use of security software. Many users think that if the software is there, they are safe. They don't worry about running the scans, or updates, or checking the logs. They think it's just an install-and-forget thing that is normal. Needing to spend time and money to protect yourself when your OS vendor won't design the flaws out of their software is stupid. And thus, so is the security paradigm of Windows.

I think another thing to think about might be the fact that there are so fewer Mac users than Windows users, it's easier to have a big impact if you write, even a moderately successful Windows virus, than a wildly succesful Mac virus that hits every single piece of Mac hardware on the planet.

A Mac virus that hits two Macs would have a much bigger impact than a windows virus that hits twenty million PCs.
However, that hasn't happened yet.
Back in the day, the classic Mac OS did have viruses. Was this because it had so many users?



[img:0b8653cf2d]http://www.colinfahey.com/funny_images/misc_flame_war_in_progress.jpg[/img:0b8653cf2d]

Zombie thread, I know. I ran across this book at Microcenter the other day, and it made me seriously question the security of Mac OS X as compared to Windows. It seems that most of the lack of security in Windows is in the user's configuring the machine, not the architecture. OS X still has some gaping holes, and it's surprising to me that there haven't been more high-profile successful attacks. This doesn't mean I'll stop using a Mac, but it does raise the eyebrows a bit...

Peace,
Drew