'Day One' for Safari for Windows Becomes Zero-Day Nightmare
By Scott M. Fulton, III | Published June 12, 2007, 11:20 AM
It took security engineers perhaps less than two hours yesterday to introduce Apple's surprise entry in the field of Windows browsers to the big, cruel world of exploits and vulnerabilities, following its introduction yesterday morning at WWDC. As a result, much of the clout Safari had received as the secure browsing alternative to Internet Explorer and Firefox -- as long as it was on a Macintosh -- was burned off like fire to a flash fuse.
Errata Security engineer David Maynor had a report posted on the first vulnerability he found by 1:48 pm, complete with screenshots of the pre-crash letdown dialog produced by his fuzzing tool. As he admitted, it wasn't a difficult crash to find, posting a screen shot of the memory dump revealing both a stack corruption and an access violation, and then giving credit to Thor Larholm for posting a complete report on the calamity not an hour later.
"I downloaded and installed Safari for Windows 2 hours ago, when I started writing this," Larholm wrote, "and I now have a fully functional command execution vulnerability, triggered without user interaction simply by visiting a web site."
Both Larholm and Maynor have made it clear their intentions are simply to discover vulnerabilities and warn the vendor and the public as to their implications, not to profit from their exploitation...because, quite frankly, the exploits don't appear to be that difficult.
Apple's Web site touts, "Apple engineers designed Safari to be secure from day one." As Larholm explained on his blog, that may very well be correct: Its engineers obviously designed Safari to take advantage of security protocols in the OS X operating system, as evidenced by function calls to those protocols Larholm located inside the source code for the Windows version - calls which would obviously go unfulfilled.
"On the OS X platform," he continued, "Apple has enjoyed the same luxury and the same curse as Internet Explorer has had on the Windows platform, namely intimate operating system knowledge." As a result, Safari for Windows may be expecting other layers of the operating system to provide security - layers which aren't present on Windows, especially since Microsoft has naturally adapted its transport layer security for optimum use with IE7.
As an example -- one which may be as important for Firefox as for Safari -- Larholm demonstrated the use of an inline frame <IFRAME> element with embedded JavaScript code. When delivered to Safari, it passes on an unfiltered request to the old Gopher protocol, which on his system is handled by Firefox. That browser then processes the unfiltered request raw, with the result being that CMD.EXE is called, pulling up the command line.
If Larholm wished to go further with this demonstration, he could have passed a default command to CMD.EXE - which, of course, would also have been unfiltered.
Safari is built on top of an open-source Web browser engine called WebKit, whose developers announced on their blog this morning that the first nightly build of the Windows version of WebKit will be released sometime today. At that time, perhaps veteran Windows developers may become available to flesh out and plug the holes which Safari's disconnection from Mac OS X left open.
One good reason to avoid trying new browsers.
Score: 0
Cut these guys some slack...at least their trying!! Its only in BETA for goodness sakes!
Score: 0
Ok this build had some issues that need to be addressed...The next build should fix those as well as any other bugs found. If they follow through then the Beta is doing what it's supposed to do. Apple however should refrain from crowing about what may or not be true. MS has been the poster boy for that. I'll sit this one out, the browser field startin' to get crowded. IE7 sucks
Score: 0
I installed safari for windows, and there is no text on screen. No menu, no text, nothing but the graphics.
help
citaps
Score: 0
No real surprise that safari on windows is having a rocky start, it's always tricky when you move from one system to another even in stuff that's meant to do it. I imagine it'll get there eventually.
Score: 0
Won't use until I can block ads. Is there a way to block ads like in Firefox or with admuncher?
Score: 0
Safari v.3 in XP just like version in Mac but standard function is still being crash on my pc.
I can not save bookmarks, I can not search inside URL and I can not post any comments by Safari for XP.
Score: 0
Worst than Konqueror (which is rather bad itself). Not bad compared to IE6, rather good compared to IE7 which is a complete piece of junk.
Score: 0
Firefox/Mozilla or Opera are the only serious alternatives to IE at this time.
Switch from Microsoft to Apple? Why would I want to replace Darth Vader with his whiny little brother?
Score: 0
I would suggest, instead, that IE7 is the only serious alternative to FF.
Score: 0
This [Safari 3] is a incredible Browser! I never thought that I would ever change IE [Internet Explorer] as my "Default" Browser but I have switched, after all of these years. Furthermore, the "speed" of Safari 3 is what made me switch! I need the speed when I Surf, and check my E-mail. Nevertheless. I will be suggesting Safari 3 to all of my friend's, and Client's!!!
Thank you, FmlyRnn
Score: 0
lol, I seriously hope you've tried Firefox or Opera on Windows... lol
just a thought.
Score: 0
it sucks!!!!!!!!!!
I have to tell apple: don't bother me until you are able to create a browser, because safari is not a browser, it's a piece of crap with rounded bars
Score: 0
Hahahahah excelent comment! Loved the rounded bars part hahaha. Awesome!
Score: 0
Beta means there should have been extensive testing on thier part beforehand, and we're here to help clean it up and find any bugs that slipped through the inital gauntlet of testing.
jenny
http://www.spaml.com
Score: 0
Nope.
That's what RC's are for. Everything's, done, polished, and ready. Last chance to find the straggling glitches.
Beta's are the bug-hunting, "we've got a GUI on there", let's see how this baby runs stage.
Alpha's are initial design and building stage.
Everyone seems to believe this is an RC.
Score: 0
Any way you cut it, this is a beta, it's insecure, and shouldn't have been released publicly with an ANNOUNCEMENT.
Look Lots of companies release internal and external betas, but if you are the face of a very major corporation, you damn well best be sure you release a beta that is at least somewhat secure, at lease using current methodologies.
Score: 0
Problem is, a BETA has gone through SOME testing...it needs alot more testing, but it has undergone some. Now...this was found within TWO HOURS...I guess apple doesn't do any testing of it's own at all???
Score: 0
This is common practice in the open-source community to release what they have, when they have it, in order to work out the kinks on the public forum. It's mentioned quite a bit that safari is based on an open source project, and that's what Apple is trying to show, that they're a part of the community where this practice is normal.
I know myself from experience, that windows users are just simply not used to this. That's because all it is with windows is either closed beta, or the few 3rd party developers that release beta apps that crash all the time and aren't very popular anyway.
version .9 doesn't mean they're jumping the gun on release, it means they're exposing it to the masses to make 1.0 that much better. It's part of a process, not a price-tagged product on a shelf that's finished.
The "announcement" plays no relevance really, it's blatantly "beta", why would anyone expect anything more just because they're Apple? Apple beta is not *significantly* better or worse than any other professional beta, for it to merit any extra criticism.
One thing I don't quite understand is why people complain SO much, when the stability of Safari on the Windows platform hasn't lost them money or destroyed their data from some issues with it. It's a not quite ready for serious implementation production systems, that's been thrown into the gauntlet to work out the weakness. Old news if you ask any developer, meh, google:beta.
Score: 0
Beta doesn't mean Beta without an announcement?
Some people just need something to b*tch about, I guess.
Score: 0
Good God, dude. This is the first browser they've ever written for the windows platform.
OF COURSE there will be problems. The two OSes handle damn near *everything* differently.
Statements like yours are incredibly easy to make. Perhaps you should actually try coding a cross-platform network application prior to telling Apple Devs how to do their jobs though, eh?
Score: 0
OF COURSE there will be problems...but the problems this app has is an outright joke.
I love these rediculous comments people make like "well...I bet YOU couldn't do a better job!".
No kidding Tool...I'm not a developer, I didn't spend 4 years in college studying it, and I haven't spent any amount of time in my career doing any development work...so why would I try to code a cross-platform network app??
I do however...expect PROFESSIONAL developers to do their jobs, just like people expect me to do my job well. If we switched from PIX to CheckPoint, and I leave some nice big holes open, I don't think my managers will like it if I said "oh hey, they're two different platforms, how was I supposed to know".
Apple should seriously consider learning the environment they develop for before releasing code to the public.
Score: 0
Well, fortunately, they told us all it was a beta and that we shouldn't expect it to function like production software.
Apparently ya'll missed that.
Beta software will have a varying degree of problems, from few to massive amounts. If that's not something you can handle, you probably shouldn't be using beta software.
Criticizing anyone on beta software is pointless. You were told before you downloaded it that it was not production ready.
You guys are taking this release *way* too seriously. This is not production, is not meant to be run on production systems, security on non-production systems is not an issue.
I don't care if it allows people to remotely control your PC. If you're running it on a PC that has information or data on it you don't want anyone to have access to, you're an idiot.
Beta software provides zero guarantee of operability, security, functionality, etc. It has always been this way.
you spoil a few folks with some decent beta releases and they get all uppity when one doesn't work like an RC. Get over it, it's a freaking beta.
Score: 0
i must say though, on the safari download page for windows:
"
Blazing performance.
2x Faster
The fastest web browser on any platform, Safari loads pages up to 2 times faster than Internet Explorer 7 and up to 1.6 times faster than Firefox 2.
"
Is far fetched at best. OMFGWTFBBQ it loads in 57.137474 ms compared to IE and Firefox's 57.92837 ms ! BLAZING FIRES OF LIGHTNING SPEED!
come on, seriously, until you start measuring the amount of caffeine in coke vs pepsi, nobody even notices the difference unless somebody's tainted your soft drink w/ something s***ty (malware *cough* IE)
The only thing that really counts is that it is a comparable product to the leading ones, and it renders web code correctly, any further than that is just add-on features that don't differentiate the product at all, because anybody can make a firefox extension to match a safari add-on at that point.
Score: 0
The most important thing about this ENTIRE issue is that whatever stage of development this software is at, Apple has failed to do one of the most BASIC forms of vulnerability testing before releasing this software, FUZZING. Fuzzing is not that new, and is used constantly by company's and yet Apple who claims to be so in tune with security doesn't even bother to run a basic fuzzer against there browser before releasing it. It shows that Apple isn't acctually in the security mindset that they market they are.
With all that said I'm not trying to hate on Apple, I use OS X at home, but Apple needs to learn how to handle security properly as they have a pretty bad track record up to this point. As the platform becomes more and more mainstream it is only going to come back and bite them if they don't sort out there handling of security properly.
Score: 0
I have had nothing but problems. Constant crashing and unable to get much of any desired response. Safari is now completely off my computer and doubt of it will ever make a return.
Score: 0
I love safari on the mac, I love how fast it is at translating the html code, and I love its neat, clean interface. Having this on windows is nothing short of amazing. I don't think that it will be an overnight takeover though. It took apple a long time to get iTunes to the point it is, and I suspect it will take them just as long to produce a browser of the same quality.
Jay Wollmann
http://www.airdistributors.com/
Score: 0
Oh yeah...another web browser on windows...woo. WJ why don't you polish steve job's knob while you're down there.
Score: 0
*laughing* that is just too funny... rude as hell, but still funny.
Score: 0
you mean iTune a good software?
Score: 0
It is the resonsibility of the OS designer to prevent flaws in third-party software from accessing vital components of the system. The fact that a beta version of a browser can gain such high-level access with relative ease without Windows balking is what is news here. Yes, it is important to point out the necessary problems with this new software, but based on past history, Apple will no doubt fix these known problems in a timely manner even though this shouldn't have caused more than a security message from Windows or an untimely closure of the program. It is truely frightening to think that the world's dominant OS has so little security that one can create such gaping holes just by installing a program like this yet we see that almost daily from all the vulnerabilities that are exploited by the plethora of viruses, worms, etc. being traded around the internet.
Score: 0
its ridiculous, so all the crashes of osx's apps are flaws of the OSX? shameless fanboy style
Score: 0
A typical Apple fans. Just blame everyone else for their own problems.
Score: 0
I've been using OS X daily for over 5 years. Never had an app crash yet. Don't write about what you don't know. Who is the shameless, mindless fanboy?
Score: 0
u stupid, i have two macs, the apps have since been crashed on me including:
adium
crossover office
virtualdesktops
diablo 2
phoenix slides
ffview
etc
not like u, probably know nothing about windows,
Score: 0
Two can play at the anecdotal evidence game: I've used OS X intermittently on one of my computers for four years now, and have had multiple app crashes--by third-party software companies most of the time.
Apple's a third-party to the Windows environment.
Try again, Will.
Score: 0
You've never had an app crash on OS X? Wow, I have have Safari itself crashing at least a few times a month, where the app simply disappears (taking all tabs with it, of course), and I'm greeted with "Safari crashed" (or, something to that effect) message box.
Other times, I've had to forcibly quit apps (Safari and others) because the spinning beachball wouldn't go away whenever I moused over the apps.
You can't seriously believe that OSX itself makes it impossible for an app to crash or hang, can you?
Score: 0
I've had an app crash almost every other time i use my mac. co-worker who didn't upgrade her ram on her macbook frequently has things crash multiple times within one session, almost relentlessly.
Not even my primary OS linux is immune to app crashes, but at least crashes are easier to recover from when running a unix oriented OS when compared to windows.
Score: 0
I give credit where credit is due and lay blame where blame is due. The thought was good, to gain marketshare, but since MS really isnt into REAL security, this effort was doomed from day 1. Instead of saying this sucks or that sucks, look at WHY it failed.... namely, windows inherent lack of built in security :)
Score: 0
Buggy beta broswers being released to the dumb public. It's not Microsoft's fault a third party can't code. So stop blaming them.
Score: 0
Hopefully you are using the bug report tool built into the Safari browser for Windows. The more the Apple/Safari team can learn from first-hand reports ... the better the browser will be....
Score: 0
Can you say BETA? This is a BETA release, IS IT NOT ?!??!? Isn't this precisely why BETA's are released, to get people with way too much time on their hands, to figure out the problems? Get a life, and let the Developers do their jobs.
Score: 0
What isn't a Beta these days. The word Beta loses its meaning when a company touts the software in a widely anticipated conference and keynote, then releases the "Beta" to the public at large.
A Beta should be given to a small closed community of testers to find bugs i.e., "Guys with too much time on their hands." When you give software like this to the masses, mostly whom do not knot what a Beta is (my parents surely wouldn't know what that means), you are putting the average computer user at risk.
Furthermore, it didn't take these "guys with too much time on their hands" much time to exploit Safari. They did nothing new or ingenious, they just used common exploits that compromised older browsers in years past. Surely the Apple engineers should have done this themselves before Apple released such a browser to the public.
Score: 0
Yes, BETA. Do you KNOW what BETA means? BETA means the version before they're ready to ship out the ready product. NOT this beta. THIS beta is TERRIBLE. In FACT, you could SAY THAT IT'S ALPHA because of all the security holes, glitches, bugs, and errors that have occured. An ALPHA is the buggy version that SECURES you with the IDEA that HALF the crap in the PROGRAM won't WORK RIGHT.
BETA, on the OTHER HAND, secures you with the IDEA that most of the program works FINE, it's just ironing out the kinks.
Stop being an a** with everyone else that blindly defends this as a beta. The fact remains that, yes it is a beta, but it's one of the worst betas out there to the point that it shouldn't be declared "beta."
How about you think a bit more before you go heave-hoing your half-wit opinions in the open like this again so some random visitor can school you in why everyone doesn't really like this particular BETA BUILD.
And, you know what, get rid of your shift key. You have no reason to yell.
Score: 0
Your argument would never hold up in court. Beta is Beta is Beta.
Score: 0
I see a lot of that shift key used in your post as well as a couple of asterisks. What are YOU yelling about? Like I replied to the reply before you, "Your argument would never hold up in court. A Beta is a Beta is a Beta."
Score: 0
Things have changed. Beta once did indeed mean beta, but we're seeing more and more alpha being released as so-called beta. (Microsoft may well be the worst offender.)
I do not mind having true beta software on my system, but it really irks me when I realize someone has conned me into installing their alpha release(s) so I can do the work their programmers should have done in the first place.
That said, this version of Safari does seem to be a true beta.
Score: 0
attack personality rather than discuss material is republican style.
Score: 0
As an Independent, I couldn't agree more; but I didn't realize this was a political argument. To which I'm sure you'll believe 'everything is political.'
Score: 0
THANK YOU!
Score: 0
"beta" for microsoft at one point for say, whistler beta 1, was basically win2000 with a new media player and a few refinements to the network stack, "ready to ship" was a year and a half off and consistently called "RTM" or, release to manufacturer (which was preceded with RC1,RC2, etc. "release candidate" not beta), usually following a third beta that had gotten to a feature and patch freeze in the devel process.
People b****ing about beta firefox were shamed in a swirl of obvious "beta beta beta" claims, and it was justified and considered a directly rational argument for flaws. But Safari on the same exact path, with a few holes that the exploiters themselves considered "nothing really major and easy to fix" is getting commentary such as "THIS beta is TERRIBLE. In FACT, you could SAY THAT IT'S ALPHA..." The number of errors identifies a problem, but by no means does it universally imply that there are numerous problems in all areas, it may take a single patch to fix most of them, until you claim to be a developer, your claims hold no real credibility even if they are responding to a prior claim.
On the same round, once the more direct and obvious flaws are patched up, how is this any different from the "blatently sloppy" coding of IE, whom the MS fanboys claim are not the ones to blame.
do you know what beta means?
Preliminary or testing stage of a software or hardware product; "a beta version"; "beta software"
That in no way implies that it is "ready to ship", that it's "complete," "finished," or any other similar description. It only means that this product:
(1) isn't ready for ship (which one can debate whether the product will ever "ship" in the first place, since it is free),
(2) isn't ready for serious implementation in a production environment, and
(3) is typical practice of the open source community to release to the public before official release, which in the opensource world has prevented software from going the way of their closed-source counterparts; hence, comparably insecure, and with vulnerabilities that go unpatched for years.
If you are a part of the open source community, and you see "beta," it's like seeing a road construction sign saying "keep left", whereas if you don't, you'd better be driving a tank to cross over the obvious trench...the road is ready for prime time, they're just running some last minute wiring. Those people driving right into the trench shouldn't be surprised when they find one, it's a part of the development process that occurs with all streets.
I hope that's clear in case there is any misconception, fanboy bias and finger pointing has no place in this situation, until the product has matured beyond officia l beta. They don't spend the time making "this product is beta" graphics for nothing....
http://images.apple.com/...ro_safari3_20070611.gif
http://www.apple.com/safari/
Score: 0
Touche! Thank you for your thoughtful and explanatory retort. It IS appreciated, and should help to squelch the people who think they know what they're talking about.
Score: 0
Can you say BETA?
Fet..
Meta..
Butter..
Nope, I guess not.
Score: 0
That's good. I like that one.
Score: 0
BETA means the version before they're ready to ship out the ready product.
I think you're thinking RC, not beta. Thanks for playing.
Score: 0
You're only secure as the number of hackers and security research labs bother to test your product.
Moving Safari out of it's comfort zone and onto Windows is a red rag to a bull. Given the appalling track record of Apple software engines to write decent Windows software this should be VERY amusing. Popcorn please!
Score: 0
BINGO!!
Score: 0
Welcome to the real world Apple!!
Now your engineers know how it is to write code that requires a high level of adaptability depending on different hardware and other conditions. It is not the same to only code for one architecture that you built than to have to worry about so many different parameters.
Hahaha, you guys should make a TV Commercial out of this!
Score: 0
I am not really sure how to take this. I mean if your browser has a small percentage of marketshare, were talking 1 or 2 percent how many people would realistically be affected by this? I mean do you really think a hacker or whoever will actually take the time to implement this for a real world attack just to have the ability to attack a few people?
Also in regards to apple, they definetely are opening up themselves, thanks to their small market share they haven't been targeted like windows and ie have. If that changes though im sure they will become swiss cheese.
Score: 0
Your favorite OS and browser sucks. Your favorite PR personality for your favorite OS company is ugly and stupid. Your apps are worthless on my OS because your apps are coded by monkeys.
nobody cares but you, fanboys
Score: 0
this guy's worth listening too .... lol
Score: 0
hehehe that's funny :)
Score: 0
No, because Apple claims to be most secure. Their aps are most securem their system ismost secure.
Apple does not want u to know it is not secure. It is their faliure.
More: When Apple is evaluating Microsoft apps in writing, public or whatever, they are biased, and evaluate apps in beta stage, but when apple releases beta software, they don't want u to evaluate it, they don't want anyone saying anything bad aobut it.
So taka your pity for Apple and bury it alongise your kewl-apple ego.
Score: 0
I don't understand the big deal, a security/(major bug) in first release software on Windows based on a Mac program.
I mean did anyone really think fresh released software, wouldn't have bugs like this, when nobody can try those "strange" things only real users might attempt to do.
Score: 0
You don't get it don't you? Apple claims it to be the most secure, and yet, within 2 hours, bugs were found.
Score: 0
Apple claims OS X doesn't have the bad stuff (malware, virusses etc.) windows has. Also they claim they have the most advanced operating system.
To prove that they ported their favorite browser to that other OS. Guess by the result they got within 2 hours you can see that plan worked, don't you?
Score: 0
Sweet!
So, if I don't like a product, all I have to do is create a add-on or something for it that doesn't work and it'll be that product's fault?
Excellent!
Score: 0
So by that you mean theat WIndows is secure except if you add otehr software?
Interesting...
Latz, SB
Score: 0
This only reinforces my opinion that anything Macintosh can be exploited if it was popular enough ... the Safari is a reflection of the so called "superior" macintosh infrastructure and they only proved that if your a big enough target .. you will get exploited.
Score: 0
2nd that
Score: 0
Try RTFA. :P
Score: 0
The myth of a small market share protecting Apple simply isn't true, especially in regards to viruses.
1. For those who have forgotten history, look back at the late 1990s, when Apple's marketshare was lower than it is today. MacOS 7, 8, and 9 versions *did* have viruses. Once the switch was made to Unix-based MacOS 10.x, things changed. No viruses "in the wild," and Apple has done a decent job of providing patches for security vulnerabilities as they are discovered.
2. If the virus authors only consider marketshare, consider this: If the Windows platform has 114,000 known viruses and 95% marketshare, the Mac platform, with 5% marketshare, should have about 5,700. It doesn't.
3. Anybody can write a moderately successful Windows virus these days. The real challenge (and glory) would be hitting those smug Mac users where it hurts. Why hasn't this happened?
The Mac platform isn't invincible, and it isn't perfect. But jealous Windows Fanboys have a hard time accepting that Windows is the security "swiss cheese" of operating systems. They always scramble to play the "market share" card whenever someone points this out. Security never has been a very high priority in Windows design. Vista is the best so far, but they still haven't gotten rid of the registry. Maybe in another 5 years when they release the successor to Vista they'll finally get it right.
Score: 0
Defending Apple's Safari by attacking Windows is lame, not even because one is a browser and the other one an OS, but because that has nothing to do with this conversation. That is just what people without good arguments do.
Also, you forget the fact that Apple builds their own computers so they don't need to worry about that when writing code. That is a big advantage and that is why it is amusing to see that when those who brag about being so good in terms of security in their own environment get practically humilliated within two hours of getting their product into the real world.
I know you guys will immediately compare everything with Windows, IE, etc. but that is not the point, we are talking about Apple, and their claims that are only realistic when in a controlled environment.
Score: 0
"Defending Apple's Safari by attacking Windows is lame, not even because one is a browser and the other one an OS, but because that has nothing to do with this conversation. That is just what people without good arguments do."
You must not have been following the thread. I was comparing Windows and Mac platforms to illustrate my point about market share being an overestimated factor in the apparent security of the Mac vs. Windows. The poster I was responding to was talking about the Mac, not Safari specifically.
"Also, you forget the fact that Apple builds their own computers so they don't need to worry about that when writing code."
What does that have to do with Windows being designed with little emphasis placed on security? How much of that relates to the hardware?
"That is a big advantage and that is why it is amuding to see that when those who brag about being so good in terms of security in their own environment get practically humilliated within two hours of getting their product into the real world."
Safari is in the real world. It has been for years. Exactly how is finding problems in a beta release of anything humiliating? Was it humiliating when later Vista betas had security holes in the new IP stack that had been fixed in other operating systems (including XP) years before?
"I know you guys will immediately compare everything with Windows, IE, etc. but that is not the point, we are talking about Apple, and their claims that are only realistic when in a controlled environment."
The reality is that all systems have bugs, and always will. That's just the way it is. With a beta release of anything, there will be problems. That's why it's call a beta. It's great that bugs have been found. Now they'll get fixed before the general release.
Score: 0
Since when is any software totally bug free? May be they are new to programming browsers in Windows, i.e., can't rely on the OS to be as secure as MacOS :)
Anyway, I think I'll stick to just running Windows IE7 for now. Heehee
Score: 0
Score: 0
please, for the love of god, don't run your IE7. use IE6 or preferably firefox. ask any "it" guy and he will tell you how many IE7's he has uninstalled because it has way too many bugs.
Score: 0
I have yet to find one.
Sorry, but regardless of the issues with it, it is *by far* more secure than IE6.
Score: 0
oh wow this sh!t is fuked up lmao!!!
Score: -1
Well, it IS a beta. From my own observation, Apple seems to have a faster turn-around time for fixing problems and delivering great products. IE6 had an amazing number of security flaws and it took years for IE7 to arrive with proper CSS standards and proper website rendering.
Score: 0
Actually, IE7 doesn't have proper CSS standards either.
Score: 0
Please do your research before you post.
"**PLEASE DO NOT POST A COMMENT IF ITS ABOUT SAFARI IN BETA**
These bugs have been verified in the current PRODUCTION copy on OSX."
http://erratasec.blogspot.com/2007/06/niiiice.html
It is NOT about being beta.
Score: 0
"Please do your research before you post."
You should follow your own advice. That data is spoofed to make you think it is.
Its amazing what noobs will fall for nowadays. LOL
Score: 0
Prove it, show me a link
Score: 0
There is no evidence that any of these bugs provide a security exploit in OS X. The link here is to David Maynor, who previously claimed for a long time (without showing evidence) to have found a wireless exploit in OS X which turned out to be not true. I've been told that people have been able to crash Safari in OS X, but that's not the same thing as an exploit.
Score: 0
how about your momma's link "cool guy"
Score: 0
ROFLcopter
That's some funny stuff. Just reading comments alone on this site is entertainment.
Score: 0
Oh wow, personal attacks! You people can't face the reality that Mac OS X is not perfect. Hey at least I present you with links, where is yours hey? Your comments are voided without any proofs.
Score: 0
no it was just a joke dude, i know that every software is not secure, for me windows is better, im not a mac fanatic but i personally dont use it lol
Score: 0
I think they realised that they're gonna have to start using MS technology, or they're going to lose their battle..
Score: 0
No surprise. This quote says it all:
"On the OS X platform," he continued, "Apple has enjoyed the same luxury and the same curse as Internet Explorer has had on the Windows platform, namely intimate operating system knowledge."
Score: 0
And yet MS has had some serious trouble securing IE on Windows, yet Apple hasn't had any issue with Safari on OSX?
Score: 0
Really? No vulnerabilities at all?
Funny...
Betanews.com seems to disagree.
Score: 0
Eh, its in beta. Not worried.
Score: 0
Except when you get a line like this:
"Apple's Web site touts, "Apple engineers designed Safari to be secure from day one." "
Huh, really from day one?? Looks like security moved from "day one" design to a last minute afterthought.
Score: 0
Are people blind, or what? RTFA.
"Its engineers obviously designed Safari to take advantage of security protocols in the OS X operating system...which aren't present on Windows."
From day one would be when Safari was released on OSX. Stupidly, perhaps, the guys managing the Safari port to Windows didn't consider how inadequate the security within the operating system would be.
Score: 0
"Stupidly, perhaps, the guys managing the Safari port to Windows didn't consider how inadequate the security within the operating system would be. "
That's a good one right there...Apple creates an application for Windows...forgets that people will actually use it, and people blame Windows for apples lack of understanding of how to implement security on the OS. That is fanboism at it's best...
You know what it almost sounds like...it sounds like exactly the opposite of the linux argument..."no no, linux is secure guys! It's the applications that are insecure! The thousands of patches you need to download for linux every month are patches for the application which are not secure!".
No wait...that sounds EXACTLY the same!
Score: 0
Even with this new entrant in the so-called browser wars, it's still a matter of picking one's poison.
Score: 0
Doh!!!
Score: 0
God almighty. DO WE NEED ANOTHER FRIGGIN BROWSER???
Score: 0
What's the alternative? a "one browser fits all" solution? There are actually tons of browsers out there, and IMHO there damn well should be. What should change, however, is adhering to standards (not that any of the major ones do that even slightly well).
Score: 0
Sure, why not? I'm sure that this one will end up working with iTunes and that iTunes will possibly end out being web-based and utilize proprietary code in Safari. Who knows. It's nice as a web developer to have Safari running on my Windows machine.
Score: 0
I concur.
Score: 0
i guess "we do"
Score: 0
THIS IS A BETA PEOPLE! Still thats fukin' hilarious.
Score: 0
Safari works great, it is lightning fast, and renders all web pages perfectly, pity its not for Ubuntu as it could have been my default browser.
Score: 0
Wow, really? You tested every website in the webiverse already to be able to make that statement? There are many people having massive rendering issues, fuzziness and so on.
Score: 0
*laughing* well said... kudos
Score: 0
"Webiverse"??? Now that was creative XD!!!
Score: 0
I hear this a lot about Safari, but even when I try Apple's site on OSX, Firefox finishes rendering it several seconds before Safari does.
Score: 0
Maynor.
Stopped reading right there.
As so eloquently put on /. hours ago...
"Maynor claims to be a professional security researcher. One of the cornerstones of professionalism in that field is responsible disclosure of discovered vulnerabilities. Another is full disclosure of vulnerability details after a vendor has had a reasonable amount of time to correct the vulnerability. Yet another is working to advance the overall state of computer security. But Maynor has a track record of irresponsible, partial-at-best disclosure: he claims discovery of vulnerabilities while proclaiming that he will not report them to the vendor, and strives to hide the details of his discoveries from open review by his peers in the security community (for example, witness the endless controversy over the alleged MacBook wifi hack, all of which could have been settled quickly and objectively by simple peer review of the exploit he claimed to have used). And none of this can, so far as I can see, be construed as advancing the state of computer security in any fashion."
Score: 0
When a guy is not getting paid by said companies for his services, then why be a security check for them. They have tons of money for these security checks but refuse to pay it. So why not smear their names with their own crap?
Maybe Apple needs to pay this guy a salary to work in securing their software??
Score: 0
thats that annoying science guy from fallout 2 right?
Score: 0
/. huh? Now there's an un-biased and credible reporting agency. Those guys close into a circle-jerk whenever someone even mentions mac or linux.
Score: 0
Look @ his blog. He, the slashdot poster, and countless others are dead on. The guy (maynor) is an egomaniac.
"Security" is merely the suit he wears (badly) to achieve his kudos.
Score: 0
Yeah. That's probably exactly what he's hoping they'll do. Didn't happen before, won't happen now. Black-Hats like these don't get it, never will.
Security isn't about money.
Score: 0
Personal attacks on this Maynor guy doesn't change the fact that exploits were found. The article is about Safari and its vulnerabilities, not about one "bad apple" and whether you like him or not. I'm sure other "security experts" can, and probably already have discovered the same exploits.
Score: 0
Fine for you.
As for mthe above poster, myself, and many others, we'll wait until it's been reviewed (right...) or (more likely) discovered by others.
This guy's credibility has been crap for some time now.
Score: 0
That wasn't a personal attack, it was a PROFESSIONAL one... in other words, it points out that the credibility of this report is suspect based on prior experience concerning Maynor. If it does turn out to be a flaw in the underlying OS, then blaming Safari for the exploit is like blaming the band for the sinking of the Titanic -- never mind the ice berg induced gash along the ship's hull. :-P
Score: 0
PCTool doesn't like the guy, then he has instant credibility! Good ol' Toolie — bad software's greatest defender!
Score: 0
Yes, he's UNPROFESSIONAL because he won't disclose the full details of something he found in his spare time to a company that has millions to spend to find the same problems, but refuses to do so. Judging from you post, it's everyone's fault except Apple's. On one hand, it's this random guy's fault because he found the flaw but has no credibility. On the other hand, it's also Windows' fault because it's not built in God's..err, Steve Jobs' image to be a perfect OS like OSX.
If the opposite happened and IE was ported to OSX with security holes, I'll let you guess who they would blame. (Hint: It starts with M and ends with icrosoft.)
Score: 0
What? No ODF rant?
Man, you're slipping.
Score: 0
it's everyone's fault except Apple's
That's BS. No-one's defending Apple. We're merely looking at this guys history, understanding how most honest security professionals work, and comparing the two.
it's pretty simple, really.
Amazing how many folks here can't follow simple logic.
Score: 0
Unlike Digg, who seem to cream any time Apple does something new.
For example, Apple's new website made it to the front page.
Score: 0
as to imply that betanews is anything more credible? the news itself is beta right (flaws everywhere)? ;-p lol
Score: 0
I understand this is a beta version and it is meant for the general public to help a company find security holes and bugs, but why shoot yourself in the foot by saying something like, "Apple engineers designed Safari to be secure from day one"? Not very smart comment by Steve Jobs especially since they are completely out of their element in writing Windows applications. I'm afraid Apple will soon find out the headaches the rest of us have when writing or using Windows OS/Applications. Much bigger target = more hackers = more vulnerabilities.
Score: 0
One of the most widely used programs on Windows is iTunes, written by Apple. As Jobs mentioned in his keynote talk, iTunes has been downloaded over half a billion times. This is not Apple's first foray into the Windows world!
Safari is very secure on OS X. Although someone here posted a comment that the security exploits affected security in Safari on OS X also, that's not true. (They did manage to crash Safari, but that's not a security exploit).
Steve Jobs did not brag about Safari security on Windows. It was Apple marketers (on the Apple website) who shot off their mouths. It's worth pointing out that Safari is actually built on an open source framework, and so it has the usual open source advantage of lots of eyes helping to make it secure.
Score: 0
Just because it is built on an open source framework does not mean that the whole _program_ is--which Safari isn't. Lots of eyes may have made _some_ of the code secure; though KHTML has progressed in different directions from the direction Safari's gone in (even with the code merges).
Nice try, though.
Score: 0
Lets all remember that this is a BETA :P
Score: 0
... so? The point of the beta is to find exploits. And the point of this article is to detail that exploits were found... very quickly.. and that safari "in beta" is far less secure than either IE7 or firefox on a windows based machine.
Score: 0
Ed,
Being in beta, fine, dandy even. But not finding a pretty big exploit like this out of the gate? Makes you really wonder if this should have been labeled more of an alpha build. Simply the fact that they put out a build that has this kind of a security is indicitive of Apple's stance on the world at large. "It runs just fine (and secure) on a Mac, what's the big deal?".
Score: 0
Welcome to the real world, Steve Jobs!!! XOXOXO
Score: 0
Steve forgot to power up his RDF! Rest assured, once he gets it up to full power, he'll be blaming Microsoft, the UN, the Easter Bunny and aliens from outer space...
Score: 0
you forgot the EU!
Score: 0
This is actually another brilliant strategy by Jobs. You're right. He is going to blame Microsoft. He'll say, "look, this isn't a problem in OSX but Windows is so bad that it is a problem there. Everyone should switch to Macs for safety."
Score: 0
And he'd be 100% right.
Score: 0
I think you must be 12.
Score: 0
Just the fanboy reaction would prove him right, lol, not that mac is better, but that there's less of a storm of teeth gnashing when major OS makers keep their apps to theirselves. lol I don't disagree w/ mac software on other platforms or anything, just saying, steve would be right that it's safer solely for that lol....jokingly of course ;-p
Score: 0
And pretty smart then for a 12 year old!
Score: 0
Tee hee hee....
Score: 0
Best laugh I've had in years.
Shoe's on the other foot now, fanboys.
Score: 0
hmmmm they are all here, MAC lovers, MAC haters, the IE haters the Firefox people, part of the Opera community and finally the We hate Microsoft Guild..
I understand People like choice, it will always be that way, lets face it Windows is FAR from Perfect Mac's OS is nice....but still not perfect IE7 has security issues as does Firefox opera and other Browsers.
This isn't about ANY of the above really it's about SAFARI and what you think........Now the IE lovers will say "NO WAY" "Not as good as IE" the Firefox user will say "Stick with FIREFOX" as will the Oopera users.
What we need is UNBIASED opinions of this product.
Personally speaking I quite like it it's fast, easy and nice, Hopefully the bugs will get sorted. Saying that it's crashed on me twice.
but that's all I have to say
Score: 0
What all you guys seem to forget is that the browser was launched on the WW Developers conference. So It was not a general public announcement. It was an announcement towards all developers.
Second:
Safari still can be developed to be secure from day one.
As "day one" will be the release to the general public as a Finished product. Past Beta stage.
I'm not a developer, but knowing Apple I can imagine that it will do all things possible to make it secure, and a lot of things are already most likely available within the source-code.
As far as major security errors concerned.
Any OS should make it impossible to invade the system.
I' live in Belgium, one of the great disasters we had was the sinking of the "Herald of free enterprise". (a roll on - roll off boat) with lots of dead people.
Someone left the front door open when sealing to the open sea. Sea-water got in to the cargo-room and the ship capsized within 15 minutes.
As for responsibility the company was held responsible for the following reasons: the ship design was insecure (no extra security-doors and the lack of security alarms etc....
The open door only made it happened. But was not the main security-issue .
Windows is here the bad design with no security alarms present.
An open door can stay open. nobody will notice.
Not even when all the sea-water comes in.
Apple only left the door open (temporarily).
So, give the guys some credit.
Let them fix the issues, give them feedback.
Lookout for future beta releases.
If Apple is not able to evolve towards their promises, shout out.
Than they are really to blame.
At least they deserve the time to make this the great windows browser all you guys deserve.
Score: 0
You MS fan boys are 10 times more annoying than Mac fan boys.
We blame Microsoft for everything. Deal with it! It's not based on anything except that the US GOVERNMENT DEEMED MICROSOFT A MONOPOLY.
So why don't you visit Bill Gate's Knob ya lamer. We blame you trolls for making the Internet suck!
I win all arguments posted on this thread by default? Why? Because I RTFA and it was a waste of 30 seconds. Any responses to it, not linking to my own, are PURE STUPIDITY! I pWN You
Score: 0