Apple admits to 'misleading' Leopard firewall settings
Apple has fessed up to at least three serious design weaknesses in the new application-based firewall that ships with Mac OS X Leopard. — The acknowledgment from Cupertino comes less than a month after independent researchers threw cold water …
Context & Ripple Effects
The admission lands two weeks after heise Security catalogued Leopard's early security chinks and a day after CNET argued the release would open the Mac OS X floodgates and embarrass Microsoft on patching discipline. Independent researchers had already shown the new application-based firewall's default settings did not do what the interface implied, and Apple has now confirmed at least three design weaknesses rather than disputing the findings.
The response is unusually fast by Apple's standards: alongside the acknowledgment, Cupertino shipped its first Leopard point update, 10.5.1, fixing a bug list that included a Finder partition data-loss risk. Syndication across The Register, Computerworld, Engadget and others shows how much attention the first post-release stumble on the flagship OS drew.
First-order effects
- Mac users who enabled Leopard's firewall under its default settings were getting materially less protection than the UI suggested until 10.5.1 corrects the behavior.
- Apple's own acknowledgment hands security researchers documented confirmation that the Mac's security tooling, not just its attack surface, needed rework.
Second-order effects
- Independent Mac security research gains legitimacy and an audience: the CNET 'floodgates' thesis gets its first proof point, raising the cost of Apple's historical quietness about vulnerabilities.
- Enterprise evaluators weighing Mac deployments now have a named counterargument to the 'no viruses' pitch, pressuring Apple to match Windows-style disclosure cadence.
Third-order effects
- If researcher-driven scrutiny keeps landing within weeks of each release, Apple's security process shifts from reactive silence toward scheduled updates and public acknowledgment — the disclosure norm it long avoided.
- Default-configuration honesty becomes an accountability standard for consumer OS vendors: a firewall that misrepresents its own state is treated as a defect, not a design choice.
The trend: Mac OS X's growth into a mainstream consumer platform is pulling Apple's security practices into the same rapid-research-and-disclosure cycle that shaped Windows, ending the era when low market share substituted for hardening.