This post was originally published in French only. We translated it in 2026 so the archive reads the same in both languages. Read the original →
MacOSX was long considered the most secure of operating systems, even though that reputation was mostly due to its small market share.
Since Lion came out last year, Apple has closed a good part of the gap with Windows. In fact, Lion was almost on par with Windows 7. For MacOSX users that's a good thing, because the feeling of security is finally matched by actual security. Even so, a few gaps remained that meant it still wasn't quite as good as Windows 7, including some specific configuration items.
Apple surprised everyone by releasing a new iteration of its operating system (now OSX). Beyond the iPad-ification of the interface, there are two known security-related additions (Apple doesn't publish all of its improvements): Gatekeeper and kernel-level ASLR.
The first one, which is the most visible to the user, blocks the execution of unsigned applications. This component, imported straight from iOS, takes on a security flavour on the desktop. By requiring all applications to be signed, it creates a "whitelist" of applications that are allowed to run. That is in itself the Holy Grail of security, since it is now hard to run malicious code. If a developer goes rogue, Apple can always revoke their certificate. An application with a revoked certificate can then no longer run on new systems, and possibly not on systems where the application is already installed.
The second one is kernel-level ASLR. This less visible feature prevents a vulnerability in an application from easily leading to a full system compromise. Add that to the sandbox that has existed since Lion, and the room to exploit an application has just shrunk considerably.
Needless to say, nothing is perfect.
For more information, you can check out these sources:
Security experts: Apple did Mac OS X Gatekeeper right