Heads up, security mavens! If you're always feeling left out because your Windows-using buddies are off having oodles of fun trying to keep up with incessant patches and holes in Microsoft's Big Stinkin' Ball O' Code, you can now take solace in the fact that the Mac has a hole, too. (Finally, Windows users have no excuse not to switch!) The one that everyone's talking about right now is the buffer overflow in Screen Effects. Faithful viewer Anthony tipped us off to this doozy over the weekend: as described by SecuriTeam, if you're running Mac OS X 10.2.6 and leave your system "locked" by turning on Screen Effects and requiring a password, all anyone needs to do to access your Mac is wedge an eraser in your keyboard and come back five minutes later. D'oh!

See, it seems that Screen Effects is expecting people to enter a password that's maybe ten or twelve characters long; cram an extra thousand or so down its throat and it chokes something fierce. SecuriTeam claims that the overflow is triggered by entering "between 1280 and 1380 characters" into the password field and then pressing return, but we take that to mean at a minimum, and not that, say, 1400 characters is just fine and dandy. Although if it's the latter, that's pretty keen.

Now, it turns out that this could have been a real inconvenience here at the AtAT compound, since, paranoid dweebs that we are, our passwords tend to be sorta long. Like, for example, Act I, Scene iv of Hamlet. (We've always felt that the extra two or three hours we spend typing in lengthy passwords each day is more than offset by the feeling of security such a precaution imparts.) We don't actually use Screen Effects to lock our Macs, and now that we know it'd be less than thrilled with our impression of an infinite number of monkeys, we're not about to start. But what about the security implications for folks with sane passwords?

Well, basically, what this exploit means is that someone who has physical access to your Mac for five minutes can crash your screensaver and get at your stuff. Of course, if they only had three minutes, instead of dorking around with overflowing your screensaver they could always just restart your Mac in single-user mode-- and get at your stuff. And even if you set an Open Firmware password, with physical access to your Mac they could just remove some RAM and reset it-- to get at your stuff. Sensing a pattern, here, people? We're pretty sure that this all means that-- brace yourselves, folks-- if someone has physical access to your Mac, they can get at your stuff. (Dadadadummmmmmm!)

"Ah, but what if I set an Open Firmware password and physically locked the enclosure of my Power Mac to prevent the removal of RAM?" Well, then, genius, you're obviously not the type of person who would be relying on a frickin' screensaver for security in the first place, so the point's sort of moot. That said, the moral of the story is, physical access equals, well, access. If you're really worried about people getting at your private stuff, don't let them get near your Mac, especially if they're carrying erasers and five-minute egg timers.