Apple is last major provider to fix the DNS bug

I really like my mac. It usually is pretty secure. However, Apple just patched their copy of BIND yesterday. I just got the software update request today. This is almost a month since Kaminsky’s coordinated release of the DNS patch. I wonder why Apple was the recalcitrant one that waited so long? Could it be because the exploit was finally in the wild and was on longer just proof of concept? Could it be that the patch was more critical on servers rather than desktops, and desktops are Apple’s mainstay?

Whatever the reason for Apple’s late release, it has made me think about Apple’s security practices. As far as I know, Apple doesn’t have a “patch Tuesday”, and the DNS patch release coincided with Microsoft’s patch Tuesday. Perhaps Apple is moving in that direction, and their patches just happen to come at the end of the month? Will this affect Apple’s security? Probably not, unless you have a release as huge as the DNS flaw. Because vulnerabilities that affect Microsoft don’t necessarily affect Apple, so there is no issue with the delay between Microsoft’s release and Apple’s.

Apple has known about this flaw for as long as everyone else has, and since they run BIND, they’ve even had the patch, so their delay in patching their systems is a little concerning. What else have they delayed so long on that we don’t know about?