Rich here.

Yesterday I published an article over at Macworld on the New Java exploits, and why Mac users likely aren’t at risk. As with many previous articles on Mac security, I’m getting really positive feedback. Heck, I have even had people tell me that I’m currently writing the best stuff out there on Apple security overall.

(Probably not true, but I’ll take it.)

When I asked some people privately about this, they told me they like my articles because they are accurate, hype free, and practical. The thing is, there really isn’t anything special about how I write this stuff up. Some days I feel like it’s some of the easiest prose I put on the screen.

I think there is one compelling reason there are so many bad security articles out there in general (when we write about attacks), and even more crap about Apple products.

Page views.

Anytime anything remotely related to security and Apple comes up, there is a bum rush to snag as many mouse clicks as possible, which forces those writers to break pretty much every rule I have when writing on the issue. Here’s how I approach these pieces:

  1. Know the platform.
  2. Don’t hype.
  3. Research, and don’t single source.
  4. Accurately assess the risk.
  5. Accurately report the facts.

This isn’t hard. It really comes down to understanding the facts and writing without unnecessary hype. From what I can tell, this also results in solid page views. I don’t see my Macworld or TidBITS stats, but from what they tell me the articles do pretty well, even if they come a day after everyone else.

Why? Because many of the other articles suck, but also because users will seek out information that helps them understand an issue, rather than an article that just scares them. These are the articles that last, as opposed to the crap that’s merely thinly-disguised plagiarizing from a blog post.

I get it. If it bleeds, it leads. But I would rather have a reputation for accuracy than for page views. There are also a bunch of articles (especially from AV vendors) that are technically accurate but grossly exaggerate the risk. Take all the calls for the impending Mac Malware Epidemic… by my count there have only been two large infections in the past two years, neither of which resulted in financial losses to consumers. I really don’t care how much Elbonian porn is back-doored with trojans. (I have been waiting 5 years to write that sentence).

Anyway, for those of you who read these articles rather than writing them, here are a few warning signs that should raise your skepticism:

  • Are all the quotes from representatives of security companies with something to gain from scaring you?
  • Does the headline end in a question mark?
  • Is it cross-platform, but ‘Mac’ or ‘iPhone’ got shoehorned into the headline to snag page views?
  • Is more than one source cited? Multiple blog posts which all refer back to the same original source don’t count.
  • Does the article provide a risk assessment in the lead or only in the conclusion?
  • Does it use phrases like “naive Apple users”?

Then again, I don’t get paid by hit counts. Or maybe I just underestimate how many people download Elbonian porn.

On to the Summary:

Webcasts, Podcasts, Outside Writing, and Conferences

Favorite Securosis Posts

  • Adrian Lane: Ur C0de Sux. Seeing as we have not been able to blog much lately, I pulled out an old favorite.
  • Mike Rothman: Always on the Run. When I read my intro to this week’s Incite again, I realized it’s pretty good advice. To me. So I’ll bookmark it and get back to it every time I start dragging a bit. Just keep running and good things happen.
  • David Mortman: Pragmatic WAF Management – Securing the WAF.

Other Securosis Posts

Slow week – and to be honest, next week will also be slow thanks to way too much travel. We promise to get back to annoying you more consistently soon.


Favorite Outside Posts

Research Reports and Presentations

Top News and Posts

Blog Comment of the Week

Weak on comments this week, so we’re going to skip this one. Go back to your Elbonian porn.

I think I need some sleep.