Slashdot Mirror

← Back to Stories (view on slashdot.org)

Unsanity Developer Comes to APE's Defense

Posted by pudge on from the kill-teletubby-smash dept.

beelsebob writes "Rosyna, the famously tellytubby-like Unsanity Developer has spoken out in the defense of their Application Enhancer (APE) framework. The framework has taken a beating since it came out, being accused of being spyware, or of crashing computers. In fact Unsanity have only received one bug report about APE itself, which was promptly fixed. The article is a very good defence of the product, and a very good read."

2 of 138 comments (clear)

  1. Re:tel{e,ly}tubby-like whaaaa? by Meowing · · Score: 5, Informative

    I don't know what that's about, Rosyna looks pretty ordinary to me....

  2. Flack about the URL handler exploits by SailfishMac · · Score: 5, Informative

    A lot of this came about because of the rash of URL handler exploits in Mac OS X recently.

    In the mad rush to secure Mac OS X, two groups emerged. The Paranoid Android (based upon APE) and the RCDefault/More Internet side.

    Unsanity (makers of PA) had a incomplete product at first that could not keep up with the rapid new discoveries. It was designed to check the URL handlers for you for suspicious behavior, problem was it didn't cover all the URL handlers.

    v 1.1 was no good and finally unsanity came out with v 1.2 which covered them better.

    Now on the other side of the camp is the RCDefaultApp and More internet crowd, which schooled people to turn off/reassign the URL handlers themselves with a very easy to use program.

    Their argument was that one didn't need to install a "haxie" (in their own words) "injects code in all your programs" &

    "they do their thing by violating the boundaries of protected memory."

    http://daringfireball.net/2004/05/help_viewer_secu rity_update

    Either way, I'm glad the Mac community turned out in force to solve these problems in a jiffy, Apple should be ashamed of themselves, being warned over 4 months ago about them.

    If using Paranoid Android was the only option to prevent these exploits, I'm sure everyone would be happy using it. But it seems to me just disabling the URL handlers manually until needed or reassigning would have been a better option.

    I'm glad we had a choice, so kudos to both and thanks.