Apple Safari On Windows Broken On First Day

An anonymous reader writes "David Maynor, infamous for the Apple Wi-Fi hack, has discovered bugs in the Windows version of Safari mere hours after it was released. He notes in the blog that his company does not report vulnerabilities to Apple. His claimed catch for 'an afternoon of idle futzing': 4 DoS bugs and 2 remote execution vulnerabilities." Separately, within 2 hours Thor Larholm found a URL protocol handler command injection vulnerability that allows remote command execution.

Comments

He notes in the blog that his company does not

[gsfprez]

report vulnerabilities to Apple because he is a total fsckwad loser attention hound.

Thanks for the news about the vunerabilities, Paris Maynor.

Re:He notes in the blog that his company does not

[Whiney Mac Fanboy]

because he is a total fsckwad loser attention hound.

I wondered who'd be the first to launch an ad hominem attack - and look, right in the first comment.

Thanks for reaffirming my faith in Apple Fanboi nature.

Re:He notes in the blog that his company does not

[Kadin2048]

Yeah -- what the hell.

I can understand not sitting on a vulnerability -- there are some valid points both for and against full disclosure -- but not notifying the company at all? WTF.

This is the sort of stuff that just makes the whole IT security industry, and everyone involved in it, look dangerous and irresponsible.

Re:He notes in the blog that his company does not

[krswan]

I'm sure that Apple appreciates the volunteer work he has done on their beta software.

Re:He notes in the blog that his company does not

[aichpvee]

Maybe they should start paying for the world. Releasing buggy software and expecting people to QA it for you FOR FREE is insane. Maybe apple, microsoft, and the rest of these asshole companies should start hiring some decent testers. You fanbois can stop whining too, or are you offering to compensate these guys for bug testing your favorite lame software?

Re:He notes in the blog that his company does not

[AchiIIe]

Agreed, and I would also like to remind fellow slashdotters that Maynor did indeed fake the wifi hack,
Here is a video I made debunking their proof: http://video.google.com/videoplay?docid=1468187717 11399295
My guess is that they got a buffer overflow but had not yet found the correct location in memory to write their shellcode. They still have not...

Re:He notes in the blog that his company does not

[DA_MAN_DA_MYTH]

Maybe they should start paying for the world. Releasing buggy software and expecting people to QA it for you FOR FREE is insane. Maybe apple, microsoft, and the rest of these asshole companies should start hiring some decent testers. You fanbois can stop whining too, or are you offering to compensate these guys for bug testing your favorite lame software?

Ah yes, giving away FREE software and expecting people to use it for FREE. In turn for that FREE use, if someone finds a bug it's absolutely ludicrous to expect them to report it.

Now mind you I understand why they may be giving it out for FREE, probably so people can FREEly develop for the iPhone, widgets and browser.

Maybe they should have created an IDE that wasn't FREE so you can pay for the tools to develop on their FREE platform, and use that money to pay for the QA department, so I can be FREE of you haters and your whining.

Re:He notes in the blog that his company does not

[Anonymous Coward]

report vulnerabilities to Apple because he is a total fsckwad loser attention hound.

But he's soooo LEET! I want to suck his cock!

Re:He notes in the blog that his company does not

[jeffasselin]

Yeah! Really! You talk to them dude! They should like totally do like my best friends and CHARGE them for the PRIVILEGE of beta testing their applications!

They released a beta version of a program with the usual disclaimers about how it's not finished, and should not be used in a production environment, and are not forcing anyone to use it. What's your problem?

Re:He notes in the blog that his company does not

[ubernostrum]

I wondered who'd be the first to launch an ad hominem attack - and look, right in the first comment.

How about we try it this way:

Maynor claims to be a professional security researcher. One of the cornerstones of professionalism in that field is responsible disclosure of discovered vulnerabilities. Another is full disclosure of vulnerability details after a vendor has had a reasonable amount of time to correct the vulnerability. Yet another is working to advance the overall state of computer security. But Maynor has a track record of irresponsible, partial-at-best disclosure: he claims discovery of vulnerabilities while proclaiming that he will not report them to the vendor, and strives to hide the details of his discoveries from open review by his peers in the security community (for example, witness the endless controversy over the alleged MacBook wifi hack, all of which could have been settled quickly and objectively by simple peer review of the exploit he claimed to have used). And none of this can, so far as I can see, be construed as advancing the state of computer security in any fashion.

In other words, there is no sense of the word "professionalism" for his field which seems to be reasonably applicable to Maynor. Before you go screaming "ad hominem" or "Apple Fanboi", take note of two things:

1. All I've criticized here are the man's methods, not the man himself. I don't even speculate to his motives for operating the way he does.
2. I'm typing this on a MacBook Pro, and I do like both it and the operating system it runs, but neither are particularly essential to me -- at this point I can move between (Unix-y) operating systems with relative ease, and occasionally do as needed (prior to this MacBook, I used various forms of Linux exclusively for about six years, and still use them on a regular basis. The only OS I have a prejudice against is Windows, and I've even got that available, virtualized, when I need to test things in it).

I await your reply.

Re:He notes in the blog that his company does not

[Anonymous Coward]

This is the sort of stuff that just makes the whole IT security industry, and everyone involved in it, look dangerous and irresponsible.

What bullshit. You know what makes the IT industry look bad? Companies that constantly release programs RIDDLED WITH SECURITY HOLES.

Seriously, step back and think about it. What responsibility does this guy have to Apple, to you, to me, to anyone? ZERO. Now think.. is it more than the responsibility that *APPLE* has to its customers?

It's shameful that software quality gets *worse* and *worse* with every year that goes buy.

Now it's your turn to go "WAH WAH WAH PROGRAMMING IS HARD!!!" and tell me I should just suck it up and deal with the fact that "all software had security holes". Then I'll tell you, if that's the case, that YOU should suck it up and EXPECT THEM TO BE REPORTED.

Re:He notes in the blog that his company does not

[kernelpanicked]

Well no shock that you were modded flamebait. I mean you made a rational comment on an Apple article, WTF. Looks like I'll have to read comments at -1 yet again to get anything insightful out of this discussion, as is the case with just about every Apple related article. Truth is, if the guy had reported the bugs/vulnerabilities to Apple, they more than likely would have done what they always do, wait months to push a fix out or just deny their existence altogether.

Re:He notes in the blog that his company does not

[KillerBob]

the whole point of a beta is the "we think we got it working right, seems to work in the lab, but we know we missed something so we're going to let the enthusiasts try it out because we know they'll find it" phase.

Re:He notes in the blog that his company does not

[lena_10326]

They released a beta version of a program with the usual disclaimers about how it's not finished, and should not be used in a production environment, and are not forcing anyone to use it. What's your problem?

Nobody forces anyone to use Firefox... but the bugs are taken pretty seriously and get fixed pretty quickly with that one. Huh.

Even if your software is free, you really oughta do your best to make sure it's not crippled with fatal security holes--discovered within hours I might add.

Re:He notes in the blog that his company does not

[speaker of the truth]

As someone who has never used a Mac or Apple software, its pretty dicky of him not to report it.

Re:He notes in the blog that his company does not

[speaker of the truth]

Ah yes, giving away FREE software and expecting people to use it for FREE. In turn for that FREE use, if someone finds a bug it's absolutely ludicrous to expect them to report it. Of course it is. There is no way I'd expect my mother to report a bug. However what isn't ridiculous is expecting someone who deliberately seeks out a bug, has the ability to reproduce it, and has blogged about it and also calls themselves a security analyst, to actually report the bug. Heck, only a link to his blog post would probably be helpful to Apple. That takes very little effort on his part, so its not unreasonable to expect it.

Re:He notes in the blog that his company does not

[timmarhy]

i wouldn't either, apple are ligitgation happy

Re:He notes in the blog that his company does not

[Anonymous Coward]

gsfprez, you are a karma whore. looking at some of your previous posts it's pretty damn clear if this was a MS product you would have been cheering him on. Grow up you hypocrite.

Re:He notes in the blog that his company does not

[Jeff DeMaagd]

Why should he even bother to discover the hole? He's not getting money for it. He's doing it for the attention, I guess. Does that attention net him any more customers? I don't know, but given that most white-hat security researchers have an ethos to report security flaws, I guess that puts this guy as likely being in the gray-hat category, and I wouldn't want to support him.

I know that companies should put out better software, but this is a beta. Very buggy for beta, but still. I don't know why Apple released it, I think they too just needed PR or to prove that it's not a vaporware product. I'm pretty sure that they are aware that it's still a seriously flawed, premature product.

Re:He notes in the blog that his company does not

[timmarhy]

he already outlined why he did it - apple threatened to sue if he disassembled the airport, so he used a clone no name model which used the exact same drivers (where the problem lays).

Re:He notes in the blog that his company does not

[argent]

Truth is, if the guy had reported the bugs/vulnerabilities to Apple, they more than likely would have done what they always do, wait months to push a fix out or just deny their existence altogether.

Did you read the disclosure policy?

Keeping with our disclosure policy, we do not report bugs to Apple.

It doesn't say

Keeping with our disclosure policy, we do not wait for a response to the bugs we report.

If it said that, your comment would make sense. That would be something like ... "We don't think Apple will fix it, so we won't wait before announcing it". I could see that (though not agree with it). But "We don't think Apple will fix it, so we won't even TELL them about it" is totally irresponsible. The only "rational" interpretation of that is he actively wants to make it harder to improve the security of Safari.

Do you have a better explanation, or a justification for that approach?

Re:He notes in the blog that his company does not

[dwater]

Nothing apple does is for free. Everything they do is designed to make you want to give them more of your money. That might be now, it might be later, but none of it is free. It's a US public company, so what else would you expect?

Re:He notes in the blog that his company does not

[Anonymous Coward]

There is no way I'd expect my mother to report a bug.

Why on earth would you be letting your mother run beta software?

Re:He notes in the blog that his company does not

[ceoyoyo]

Have you ever used a beta of Firefox? The bugs might get taken seriously but they are definitely there. Remember, Safari for Windows is a Beta. Not only that it's a pre-1.0 version (it may not be numbered that way, but it has never been released before).

Re:He notes in the blog that his company does not

[Tickletaint]

Nothing you do is for free. Everything you do is designed to make others want to give you more of what you want. You're only human; what else would you expect?

IOW, a copout argument.

Re:He notes in the blog that his company does not

[aichpvee]

My problem is whining apple fanbois like yourself thinking everyone owes it to the Great Blue Apple(tm) to do apple's bug fixing for them.

Re:He notes in the blog that his company does not

[Jeff DeMaagd]

It doesn't look like much of a company either. It looks like they didn't even bother to put up a web page until January 1, that's the oldest entry. The site does not turn up on Archive.org's Wayback Machine. Their oldest blog entry is Dec 2006. That leads me to believe that they are looking for free advertising to drive interest in their services, on the coat tails of the day's most (in)famous company.

Re:He notes in the blog that his company does not

[toejam316]

Your a bit free with your anger. Maybe you should seek medical help? I'm pretty sure you can get help for that, probably free too. All well, maybe next time you'll consider what your letting free into this world.

Re:He notes in the blog that his company does not

[WwWonka]

This is the sort of stuff that just makes the whole IT security industry, and everyone involved in it, look dangerous and irresponsible.

agreed, but it TRULY makes programmers, and everyone involved it, look more dangerous and even more irresponsible.

Re:He notes in the blog that his company does not

[lordsid]

No better day to blow the whistle then the same day it's released. Much smaller chance of a user base being affected by it.

Re:He notes in the blog that his company does not

[shaitand]

'Ah yes, giving away FREE software and expecting people to use it for FREE.'

Apple is a commercial entity. As long as Apple is still making a profit nothing you get from Apple is free, it may not be the guy browsing but someone is footing the bill. You can certainly bet that Apple didn't just drop their bottom line by the cost of developing and distributing the software.

It reminds me of the last time I called Comcast. I ordered Showtime for the Showtime on demand movies and while the channels came in the video on demand gave an error code (very annoying since I never waste my time watching whatever they are force feeding at the moment and watch what I want when I want with the video on demand). It took them 3 months to fix it and they had the nerve to charge me for Showtime during that time. Naturally I demanded a credit and the girl tried to claim that I was paying for the channels only and the video on demand was a free service they gave me out of the kindness of their hearts so there was nothing to credit. I told her that was wonderful, take away all that expensive programming I pay all that money for and just leave me the free stuff. She told me that it only comes free with the paid programming. I told her to make up her mind, either they are giving me the video on demand for free or they require me to pay them money in order to receive it.

Re:He notes in the blog that his company does not

[Anonymous Coward]

"apple threatened to sue if he disassembled the airport,"

Thats fucking bullshit.

I personally know two folks that have discovered vunerabilities and worked with the developers to get this reported / fixed. When the one wanted to do a write up for some academic bs, they asked if he could wait until it was fixed -- but no threats. They even said if he would wait, they'd give a little more information because the cause might be a problem elsewhere.

Apple is only litigious when you steal their code and P2P it (and even then, they never bankrupted anyone like the RIAA), entice folks to give away trade secrets (which is against the law, regardless of hiding behind freedom of press) or leak information that you have contractually agreed not to (usually to the folks enticing folks to do this knowing that it is an interference with contractual agreements).

Maynor and 'Cache' are press hungry idiots. They lie to further their oppression. When unedited transcripts and emails are sent out, its said that it is done out of context, and when the PR agent for Apple openly challenges them to proof (and indemnifies them if they release EVERYTHING and truthfully), they claim that their company (that they no longer work for) won't allow it because its the companies intellectual property now. Fuck those assholes. I've worked with enough people like this in technology...talented individuals that could figure things out that no one else every could / would but have so many antisocial and divaesque personalities that I just can't have them around. I had one actually tell me a couple weeks ago that I was firing him because I was 'jealous' (of what? blowing a dozen deadlines because they don't know how to follow the project specs, but expect to consider them gods when they write the entire code by themselves at the last minute, meaning that the rest of the development team sat with their thumbs up their asses and their contributions have to be tossed if we want something that actually works, even though it isn't what we asked for).

So fuck Maynor.

Re:He notes in the blog that his company does not

[Anonymous Coward]

Hey WMF, who do you think you're fooling? We native Mac users can spot a PC-minded poseur a mile away. GTFO.

Re:He notes in the blog that his company does not

[heinousjay]

Yeah, here's the justification: there is no reasonable expectation of Applefan approved behavior from the public at large. How's that one fit?

Re:He notes in the blog that his company does not

[Anonymous Coward]

Are you just saying you are predjudiced against Windows so you can fit in with the community, and not get branded an Apple fanboi? Simple fact is, the majority of the world is using Windows, and it won't be changing any time soon. I am surpirsed Apple is still alive. It should have been long dead by now. Macs are for faggots.

Re:He notes in the blog that his company does not

[dwater]

I would agree with you, if you weren't talking bollocks.

Plenty of people (and companies, for that matter), do things without expecting (or getting) anything in return.

Re:He notes in the blog that his company does not

[Anonymous Coward]

As much as I hate to use the "T" word, this guy is basically the computer equivalent of a terrorist---no better than a black hat hacker in motivation, but doing it not out of greed or the desire to break things, but for the sole purpose of causing terror in the computer industry.

People like this should do hard time.

Re:He notes in the blog that his company does not

[Fjornir]

Nah. Beta hasn't meant that for years.

Re:He notes in the blog that his company does not

[general_re]

Naturally I demanded a credit and the girl tried to claim that I was paying for the channels only and the video on demand was a free service they gave me out of the kindness of their hearts so there was nothing to credit. I told her that was wonderful, take away all that expensive programming I pay all that money for and just leave me the free stuff. She told me that it only comes free with the paid programming. I told her to make up her mind, either they are giving me the video on demand for free or they require me to pay them money in order to receive it.

Next time there's a store near you having a buy-one-get-one-free sale, go on in and tell them you'd rather not have two of whatever it is, and could they please just give you the free one by itself. See how well that works for you ;)

Re:He notes in the blog that his company does not

[peterjhill]

It is a fracking beta. If it did not have any bugs, It would be: 1) a miracle, all software has bugs, 2) released final version.

more /. acting like Weekly World News and less like a valid news source.

Re:He notes in the blog that his company does not

[NMerriam]

apple threatened to sue if he disassembled the airport,

Yeah, the only problem is that he is the only security researcher on Earth who has ever even claimed to be told this by Apple, and he has provided no evidence whatsoever of this supposed threat. Somehow everyone else who notifies apple of vulnerabilities and even demonstrates them later has managed to not get sued or taken out by thugs in a back alley.

Basically he has posited a grand conspiracy with nothing but his own word that it exists. Nobody else who deals with the same people at the same company in the same manner has any idea WTF this guy is talking about.

Re:He notes in the blog that his company does not

[aesiamun]

I would like to see a list of companies willing to do something for free or without expecting anything in return. And from that list, I would like to see a list of companies not writing that stuff off as "volunteer", "pro-bono" or whatever on their corporate taxes.

Re:He notes in the blog that his company does not

[dfiguero]

What is it with the "Apple fanboi" phrase appearing on every Apple article. I don't use Macs at all and I'll probably won't use Safari as I'm pretty happy with FF and I don't see a reason to switch ATM.

However, I'll agree that the attitude this researcher has is terrible. For starters how do we know he actually discovered all these vulnerabilities? I could claim I discovered some too and I won't disclose them. Secondly, why wouldn't he share the information with Apple, why bother discovering all these vulnerabilities in the first place? It's not like he's a black hat (AFAIK) so the only other reason I see is the attention you get from such comments.

Besides I'm sure some people will gladly help Apple test their _beta_ browser. I'm all for more competition on the browser space, put some pressure on all players so they produce better stuff.

Re:He notes in the blog that his company does not

[MrNormS]

Oh, what works for open source doesn't apply to the business world. Gotcha.

Re:He notes in the blog that his company does not

[Anonymous Coward]

Maybe he doesn't like doing other peoples' jobs.

If I catch a mistake at work, I don't always report it now because I got sick of fixing others mistakes. I'd rather have them catch it later and then trace it back to the jerk responsible. (Relax- I don't do medical work or anything safety-related...)

Re:He notes in the blog that his company does not

[dwater]

> I would like to see a list of companies...

That's nice. It's not going to be me that spends the time compiling such a list. It wouldn't be an empty list, for sure.

In any case, it's 100% clear that Apple wouldn't be on it, which is the point.

Re:He notes in the blog that his company does not

[jombeewoof]

What commercial software that is released these days doesn't qualify as "beta".
My mother ran a "beta" version of XP right up until MS finally released a "moderately" stable version. (SP2 if you were wondering).
And not just MS, although they are probably the worst.
My all time favorite video game series, Elder Scrolls. You can not tell me that DaggerFall, and Morrowind were actually ready for release until months after their initial release. Same goes for Oblivion, that still has more bugs than the majority of other games I play combined.
Do they put out an excellent product, YES. Do they charge you $50 to beta test it if you purchase it within the first 12 months. YES.

Nothing new here, I didn't even think new software had the RC stage anymore. Get it out of alpha, and onto the shelves, we can fix it after it starts to make a profit...

Re:He notes in the blog that his company does not

[shaitand]

'Next time there's a store near you having a buy-one-get-one-free sale, go on in and tell them you'd rather not have two of whatever it is, and could they please just give you the free one by itself. See how well that works for you ;)'

That's my point. You aren't getting anything free with a buy-one-get-one-free sale. The 'free' ones cost the store money, they are an expense, the store bases its prices on its expenses plus a markup. That 'free' one increased the price of other items in the store. In other words, it wasn't free at all.

Re:He notes in the blog that his company does not

[Anonymous Coward]

Firefox 3 can be frozen with just 12 characters: <object data
(although <object data> and <object data=""> work too)

And Firefox has always been susceptible to something like this:
<script>for(;;)alert("")</script>

Re:He notes in the blog that his company does not

[Anonymous Coward]

Yeah dude.... what are you expecting for free BETA software?

Re:He notes in the blog that his company does not

[Anonymous Coward]

Thanks for reaffirming my faith in Apple Fanboi nature.

"Fanboi"? Who are you, Avril Lavigne?

Re:He notes in the blog that his company does not

[Anonymous Coward]

That's nice. It's not going to be me that spends the time compiling such a list. It wouldn't be an empty list, for sure. In any case, it's 100% clear that Apple wouldn't be on it, which is the point.

*raises hand* I'll start off the list!

1)??

2)??

3)Apple Inc.

Hrm, according to this list, looks like you're wrong... oh wait, do I have to back this up or something?

Re:He notes in the blog that his company does not

[Hal_Porter]

Secondly, why wouldn't he share the information with Apple, why bother discovering all these vulnerabilities in the first place? It's not like he's a black hat (AFAIK) so the only other reason I see is the attention you get from such comments.

1) Put up Google Adwords on blog.
2) Flame Apple, the more bogus the better. Let the blogosphere advertise your site.
3) Profit.

Re:He notes in the blog that his company does not

[theTrueMikeBrown]

He probably did discover those vulnerabilities - the reason why I say this is because I also discovered similar mysterious vulnerabilities, ones that will disappear if I ever tell anyone about them. Oh, and I discovered 598 of them, and they would allow me to elevate my privileges AND mind control the owner of the computer running the software EVEN THROUGH TINFOIL HATS!

Yeah, so you all can shower me with undeserved praise now and slashdot my website and argue over weather I hate macs, or weather I am a communist, or the anti-Christ (or both).

Re:He notes in the blog that his company does not

[Pc_Madness]

What does it matter..the total amount of Safari for Windows users is what? A few thousand? He was definitely irresponsible putting all of those people who decided to try out beta software in harms way. [/endsarcasm]

What did he achieve? He managed to make Apple look stupid with their crap about how secure they are. He wasn't even trying and find holes in their software.

Oh and I own two Macs before anyone calls me a fan boy of something else.

Re:He notes in the blog that his company does not

[Anonymous Coward]

This literalness must make you a blast at parties ...

How's it going?

I'm not actually going, I'm just standing.

Well, I just wanted to see how you are doing.

To see, you just had to look at me instead of talking.

Are you always like this?

Yesterday I wore a blue shirt instead of this white one, so I wasn't like this then ...

Re:He notes in the blog that his company does not

[Derosian]

The key to this is to note that you, ubernostrum, are not gsfprez. Your post is very well put though.

Re:He notes in the blog that his company does not

[PitaBred]

Pretty much, yeah. Open Source, you contribute back to the community by submitting bugs, etc. If you submit bugs to Apple, you're contributing back to... Apple. If it's worth it to you, go for it. But there's a little more altruism when contributing to a free, community product as compared to a corporation.

Re:He notes in the blog that his company does not

[Sparks23]

Offtopic here, but that's generally a really severe pressure that game developers get from their publishers, unfortunately. It's particularly severe there; it is not as if you have 'Electronic Wordprocessor Monthly' grading the latest import productivity apps, and raising the hype on them all.

("Capcom ExpenseBlaster 3 Turbo gets an 8/10 for the blazing next-generation way it lets me balance my checkbook!" "I'm sorry, but this one felt lacking to me. It was anemic in terms of features, especially compared to other contenders like Rockstar's 'Grand Theft Accounting,' and the money-laundering options. Only a 4/10.")

That doesn't stop people from proclaiming doom and gloom and trying to point out alternative software if non-game products slip, of course. Which means more than game developers get the market pressure to just 'get a 1.0 app out there, and patch it later,' albeit a bit less than game developers do. Which sucks, but... the cause of this one unfortunately lies with both the developers and consumers, I think.

Re:He notes in the blog that his company does not

[catmistake]

mere hours after it was released.

Not to mention there was no release. Its a friggin' beta. Only God knows if it will ever be released.

Re:He notes in the blog that his company does not

[bm_luethke]

"If it said that, your comment would make sense. That would be something like ... "We don't think Apple will fix it, so we won't wait before announcing it". I could see that (though not agree with it). But "We don't think Apple will fix it, so we won't even TELL them about it" is totally irresponsible. The only "rational" interpretation of that is he actively wants to make it harder to improve the security of Safari."

There is no concrete reason to think that the company in question has not contacted Apple many times and (due to being ignored) feels such a thing is worthless until/unless it is totally public - much the same as many here feel is the case with Microsoft. There is not reason to assume actively wanting Safari to be harder.

There is a large difference between actively trying to sabotage (IE, make it harder for) Safari and having had the corporate office ignore them. If I had reported such bugs in the past and been ignored until they are public then I would also ignore the official channels. I would assume that the corporate office wouldn't pay attention until the exploit was out in the wild.

Kinda how the great pioneers that do this to Microsoft are treated, though at least Apple does better in the long run - it is like saying I would rather get three limbs cut off instead of four. Well, yea sure, if those were my only choices..

Re:He notes in the blog that his company does not

[jibjibjib]

Of course firefox 3 doesn't work, because it's NOT FINISHED YET.

It's not even in beta yet.

Re:He notes in the blog that his company does not

[dangitman]

Seeing as Safari is based on the Open Source webkit, then by reporting to Apple, you might also be contributing to the Open Source community, and having Apple developers do the work.

Re:He notes in the blog that his company does not

[Anonymous Coward]

This is the kind of sympathy you get from "free thinking" mac users.

Re:He notes in the blog that his company does not

[bentcd]

I wondered who'd be the first to launch an ad hominem attack - and look, right in the first comment. That is hardly an ad hominem attack - it's simply an insult. An ad hominem attack is one that is used in an attempt to weaken the other side's arguments by attacking the person that is making them. There is nothing to suggest that the OP is trying to convince us that the weakness which is described does not exist. In fact, his message implies that he acknowledges that the weakness does exist (because if it didn't, then not reporting it would hardly be worthy of criticism), but that he thinks the guy who found it is an asshole all the same.

Re:He notes in the blog that his company does not

[Anonymous Coward]

What the fuck are you talking about. Have you even read this ?
http://erratasec.blogspot.com/2007/01/disclosure-e thics-apply-to-both-parties.html

Re:He notes in the blog that his company does not

[Anonymous Coward]

Like fuck he does, dickhead. You're just a Steve Jobs love pole sucker. He got dicked over by Lynn Fox and that made him pissed but he's been a really respected researcher up to then. You're talking to the wrong people - or more likely to yourself as all fanboys.

Re:He notes in the blog that his company does not

[eldepeche]

1. This is beta software. It has bugs in it.

2. Officially released software has bugs in it, unless you just run the base NetBSD system with only port 22 open, which is reasonably useless.

3. What is the difference between publicizing a bug and telling the developers what it is, and publicizing a bug and not telling the developers anything? There's a higher likelihood of the bug getting fixed if the devs are notified, and you still get traffic to your stupid blog. If you give a shit about software security and not just ad revenue, maybe you ought to report the bug.

4. THIS IS A BETA TEST VERSION OF A WEB BROWSER.

Re:He notes in the blog that his company does not

[fhmiv]

Actually, he WAS trying to find holes in their software. His professed profession is Security Researcher.

Re:He notes in the blog that his company does not

[squiggleslash]

The guy was subject to a character assassination campaign orchestrated by Apple's PR department after the original Wifi bug revelation. I don't think, personally, he owes Apple anything.

Re:He notes in the blog that his company does not

[Anonymous Coward]

It's "you're," douchebag.

Re:He notes in the blog that his company does not

[hattig]

He's correct though. This isn't related to Apple in any way, it's related to mature, professional disclosure of computer software bugs, holes and issues to the maintaining company so that they can fix it, and thus keep computers secure.

Re:He notes in the blog that his company does not

[squiggleslash]

You went to the effort to prove something that's explained by Maynor in the very video you're claiming to debunk? Wow, what a complete waste of time.

In order to "fake" something, you have to pretend that it's something it isn't. Maynor was, in fact, perfectly open from the beginning about the use of a third party Wifi device. There was no attempt to mislead - from him. There were, on the other hand, hoards of people who lied or repeated lies about what he did, claiming that he lied when he clearly didn't. Only a few, apparently not including yourself, have had the decency to withdraw the lie.

Re:He notes in the blog that his company does not

[john83]

If it said that, your comment would make sense. That would be something like ... "We don't think Apple will fix it, so we won't wait before announcing it". I could see that (though not agree with it). But "We don't think Apple will fix it, so we won't even TELL them about it" is totally irresponsible. The only "rational" interpretation of that is he actively wants to make it harder to improve the security of Safari.

Do you have a better explanation, or a justification for that approach? [note: I'm not the 'you' referred to in the parent]
Why would someone announce that he's found a vulnerability but refuse to disclose it to the vendor? Some ideas:
a) He wants to hurt the reputation of the product/vendor. (This doesn't even require the existence of a real vulnerability.)
b) He wants to sell the specifics vulnerability, either to the vendor or to the highest bidder (in which case, this is advertising).
c) He doesn't care about the security side of things, he's just earning himself some free PR on sites like this which will publish his unsupported claims uncritically.
d) This is his idea of fun.

Anything I've missed?

Re:He notes in the blog that his company does not

[Anonymous Coward]

Your mother certainly does.

Re:He notes in the blog that his company does not

[medlefsen]

Actually the only "rational" interpretation is that it's because the last time he reported a vuln to apple they covered it up and then had pr character assassinate him to spread doubt about his findings, or at least thats what he claims. I don't know how much of that is actually true but that's how he seems to feel and I can understand that. Now he says that he'll release all apple vulns to the public so that apple can't do that to him again. Perhaps it's a bit juvenile but he does have a career to worry about and if Apple really did set out to discredit him to avoid bad pr then maybe he is doing the right thing.

Anyways my point is that it's not so cut and dry as all that.

Re:He notes in the blog that his company does not

[gchat]

In other words, there is no sense of the word "professionalism" for his field which seems to be reasonably applicable to Maynor.

Well, then Apple apps get hacked within hours from an "unprofessional" security researcher. You Mac users must be realy proud of your security!

Re:He notes in the blog that his company does not

[SharpFang]

Citing the blog:


UPDATE 5: I've been asked what our disclosure policy is. Its pretty simple, in most cases we will give vendors as long as they need to fix problems. If the vendor is unresponsive or make threats, we will give them 30 days then release details. If a vendor answers a vulnerability disclosure with marketing and spin attempts, we no longer report vulnerabilities to that vendor but the information goes into our Hacker Eye View program for customers and will be used in pentesting. We do not sell the vulnerabilities to any 3rd party.

Seems the very likely scenario that they reported a critical vulnerablity and Apple tried to troubleshoot them "Is the network cable plugged in?" or "Our software is absolutely secure, your don't need to worry about it, our software has been throughoutly tested." or such. A security expert who gets flushed down the toilet by a marketoid is quite likely to hold a grudge against given company and report the following bugs elsewhere than said company.

Re:He notes in the blog that his company does not

[shadow349]

they covered it up and then had pr character assassinate him to spread doubt about his findings I didn't realize Apple was in the business of hacking into security researchers' computers and planting faked demonstration videos.

In other words, you don't need to assassinate something that committed suicide.

Re:He notes in the blog that his company does not

[Anonymous Coward]

Insightful, my ass..
a) Yes.. exactly the way to hurt apple. Write a blog post? LOL.. lets move on..
b) He wouldn't have even told you about it, if he did want to sell them.
c) "care about security side of things" ?? nice pseudo-intellectual babble. Typical apple fanboi typing up crap that sounds deep but doesn't mean anything at all. Care? about what? apple? why the fuck should he care about anything except his bottom line. Are you in fucking 1st grade?
d) What is? What the fuck are you talking about..
e)You're a dick.

The only reason he is not disclosing is because Apple screwed him the last time he did disclose information.He hasn't taken some fucking oath to abide by whatever dumb ideas you come up with your single digit IQ.

Re:He notes in the blog that his company does not

[rtechie]

I'll bite. Maynor described vulnerabilites. Maynor immeadately goes public with Mac vulnerabilites because he (in the past anyway) has claimed that Apple has ignored private disclosures. I've has exactly the same experience (many years ago) so I can support him on this point.

The primary question is: Are the vulnerabilites real? If so, then Maynor has provided a valuable service to the community out of the kindness of his heart. Period. Whining about him not telling Apple first is just whining. When YOU do the work then YOU can choose how to release the info.

I also seriously take umbrage at the notion that immeadiately disclosing vulnerabilites is somehow "unprofessional". Is is MORE professional to leave production environments vulnerable while you're waiting for the vendor to get his act together and send you a patch?

How the hell do you think this works in the Linux world, the world you supposedly come from? Most vulnerabilites are immeadately disclosed on Linux, because open source allows anyone to produce patches quickly, but according to you that is somhow "unprofessional".

Re:He notes in the blog that his company does not

[Anonymous Coward]

a) Yes.. exactly the way to hurt apple. Write a blog post? LOL.. lets move on.. So getting a lot of negative publicity for their latest product doesn't hurt them? Please.

b) He wouldn't have even told you about it, if he did want to sell them. He's gotten a nice slashvertisment for his wares.

c) "care about security side of things" ?? nice pseudo-intellectual babble. Typical apple fanboi typing up crap that sounds deep but doesn't mean anything at all. Care? about what? apple? why the fuck should he care about anything except his bottom line. Are you in fucking 1st grade? Jesus, you must be thick. His meaning was pretty clear - the guy gets free publicity out of this, and doesn't give a shit about Safari, Apple, Apple fanbois, or slashdot trolls.

The only reason he is not disclosing is because Apple screwed him the last time he did disclose information. And so he went public why?

Re:He notes in the blog that his company does not

[EdMack]

Wow, way to reply with something useful. No, wait you just used slashdot as a boost to your ego. And prompted this flame.

Re:He notes in the blog that his company does not

[paanta]

I call bullshit. This is like someone sneaking up to a house (or downloading a public beta of it), trying all the doors and finding one unlocked. Then this person goes on their blog and posts a public notice saying that 1 Infinite Loop has a door unlocked, so you should go look for it. Do with it what you will. I am only looking for unlocked doors as a public service. Bullshit. You're looking for unlocked doors because you dislike the residents of 1 Infinite Loop. You're not helping _anyone_ make their homes more secure.

Re:He notes in the blog that his company does not

[Anonymous Coward]

Maybe if the residents of One Infinite Loop didn't run an incessant and annoying series of ads mocking the residents of One PeeCee Way, people wouldn't be so strongly inclined to look for ways to make them just shut the fuck up.

Re:He notes in the blog that his company does not

[LKM]

I'll bite. Maynor described vulnerabilites. Maynor immeadately goes public with Mac vulnerabilites because he (in the past anyway) has claimed that Apple has ignored private disclosures. I've has exactly the same experience (many years ago) so I can support him on this point

Looking at changelists for bugfix releases of Mac OS X, Apple regularly fixes non-public vulnerabilities and credits the people who found them. They do downplay these issues, and some managers from Apple have publicly lied about vulnerabilities in the past, but they do fix them pretty quickly and give proper credit.

For all we know, Maynors own account of his issues with Apple bear little resemblance to what really happened.

Re:He notes in the blog that his company does not

[Lars T.]

because he is a total fsckwad loser attention hound.

I wondered who'd be the first to launch an ad hominem attack - and look, right in the first comment.

Thanks for reaffirming my faith in Apple Fanboi nature. It figures that one asshole would defend another asshole when the issue talked about is being an asshole.

Re:He notes in the blog that his company does not

[Anonymous Coward]

Exploits have absolutely NOTHING to do with functionality (which is generally not taken for granted in any Beta version). Depending on how the development work is scheduled, little to none modifications are made to the "core" of the program after the beta stage. So this would have typically (depending on the severity and probability/practicality of actually encountering the exploit) been missed by the beta-testers who don't test for remote exploits as far as I know.

Re:He notes in the blog that his company does not

[The Spoonman]

because he is a total fsckwad loser attention hound

All I've criticized here are the man's methods, not the man himself.

I'm typing this on a MacBook Pro, and I do like both it and the operating system it runs, but neither are particularly essential to me

The first statement is an ad hominem attack from a fanboy (I refuse to spell it the other way), the second is part of a reasoned response from a reasonable person as demonstrated by the third statement. The grandparent's opinion still stands as valid. :)

Re:He notes in the blog that his company does not

[Anonymous Coward]

Wait... you mean you actually still believe what Maynor tells you?

Re:He notes in the blog that his company does not

[mollymoo]

I wondered who'd be the first to launch an ad hominem attack - and look, right in the first comment.

Thanks for reaffirming my faith in Apple Fanboi nature.

I wondered who'd be the first to call anyone who didn't scream 'Apple are teh sux0r' a fanboi - and look, right there in the second comment.

BTW, incorrectly using a latin phrase in an effort to look clever just makes you look like a pretentious twat.

Re:He notes in the blog that his company does not

[Altus]

Ah, I see. So this is a religious thing. I wont bother arguing then.

Re:He notes in the blog that his company does not

[dougmc]

because he is a total fsckwad loser attention hound.

I wondered who'd be the first to launch an ad hominem attack - and look, right in the first comment.
Actually, that's not an ad hominem. Here is a description of an ad hominem., and here's the gist of it --

An Ad Hominem is a general category of fallacies in which a claim or argument is rejected on the basis of some irrelevant fact about the author of or the person presenting the claim or argument.

... the problem is that there's no claim or argument being rejected. It's merely an opinion, based on the presented fact that David Maynor's company doesn't report vulnerabilities to the vendor.

Merely calling somebody names does not make an ad hominem attack, you insensitive clod!

See? Rude, wrong, perhaps, but not an ad hominem attack! Now, had I instead responded to your claim of `that was an ad hominem' with `Oh yeah? Well, we can't trust anything you say, because you're a first poster!', then THAT would have been closer to an ad hominem.

Re:He notes in the blog that his company does not

[Lars T.]

Congratulations. You first claim that "Nothing apple does is for free", then you claim "Plenty of people (and companies, for that matter), do things without expecting (or getting) anything in return", and when someone wants to see a list of those companies, you claim victory because "Apple wouldn't be on it". And all that without any proof. Do you do this for free, or do you get paid?

Re:He notes in the blog that his company does not

[Lars T.]

Pretty much, yeah. Open Source, you contribute back to the community by submitting bugs, etc. If you submit bugs to Apple, you're contributing back to... Apple. If it's worth it to you, go for it. Yeah, because nobody actually uses Apple products, so any improvements only benefit Apple. Or something like that.

Re:He notes in the blog that his company does not

[_Hiro_]

Next time there's a store near you having a buy-one-get-one-free sale, go on in and tell them you'd rather not have two of whatever it is, and could they please just give you the free one by itself. See how well that works for you ;)

The local grocery stores around here will give you half of a buy-one-get-one.... but you only get it for half-free.

Re:He notes in the blog that his company does not

[dwater]

Are you seriously claiming there are companies that don't do things for free? There are millions of them.

Apple is a public company - they only do things for profit, whether that be now or in the future.

Perhaps this is something to do with the definition of 'company'. How about using the term 'non-profit' instead? I believe that's the term that is used in the US; I'm assuming people in this threadette are from there.

Re:He notes in the blog that his company does not

[Anonymous Coward]

Heck, only a link to his blog post would probably be helpful to Apple. That takes very little effort on his part, so its not unreasonable to expect it.

I'm quite certain that the bright people over at Apple can figure out how to use Google. You might say that since it was posted on the internet that, in effect, he has reported it to Apple (and everyone else in the world).

So get over it.

Re:He notes in the blog that his company does not

[Qwerpafw]

Before people start jumping on you (oh, too late) they should look at any of Apple's security updates. Apple routinely credits the people who report vulnerabilities. The majority of "bugs" in security updates are patches to third party stuff from the OSS community, and Apple finds stuff internally, but if you report a vulnerability and Apple patches it they credit you.

for example, in Security Update 2007-5

mDNSResponder

CVE-ID: CVE-2007-2386

Available for: Mac OS X v10.4.9, Mac OS X Server v10.4.9

A remote attacker may be able to cause a denial of service or arbitrary code execution

Description: A buffer overflow vulnerability exists in the UPnP IGD (Internet Gateway Device Standardized Device Control Protocol) code used to create Port Mappings on home NAT gateways in the OS X mDNSResponder implementation. By sending a maliciously crafted packet, a remote attacker can trigger the overflow which may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation when processing UPnP protocol packets. This issue does not affect systems prior to Mac OS X v10.4. Credit to Michael Lynn of Juniper Networks for reporting this issue.

and

VPN

CVE-ID: CVE-2007-0753

Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9,Mac OS X v10.4.9, Mac OS X Server v10.4.9

Impact: A local user may obtain system privileges

Description: A format string vulnerability exists in vpnd. By running the vpnd command with maliciously crafted arguments, a local user can trigger the vulnerability which may lead to arbitrary code execution with system privileges. This update addresses the issue by performing additional validation of the arguments passed to vpnd. Credit to Chris Anley of NGSSoftware for reporting this issue.

So shut up and read up before making up claims about how Apple hates security researchers.

Re:He notes in the blog that his company does not

[EastCoastSurfer]

No company does anything for free. If they did, they would quickly be out of business. Non-profits definitely don't do work for free. They may strive not to turn a profit every year, but they have revenue in order to continue to run. And if they run on donations, they are doing work they think will net them the most donations. And really what's the big deal? Who cares what the motives are of a company if they are doing things that most would consider charity or good?

Apple is giving away Safari to try and raise more brand awareness on MS platforms (and probably for other reasons I don't know about). It ends up being a win-win for both sides.

IBM paying devs to work on FOSS, again a win-win-win for IBM-devs-community.

Re:He notes in the blog that his company does not

[rtechie]

Maynor might be a liar or confused about the vulnerabilites. This dos not seem to be the case based on my reading, and nobody seems to be saying that the vulnerabilites he found did not exist.

The issue seems be the notion that it is somhow "wrong" for Maynor to disclose the vulnerabilites without informing Apple and giving them time to fix it. Maynor claims that IN THE PAST Apple has been uncooperative WITH HIM. So based on his OWN PAST EXPERIENCE he chose to release the vulnerabities publically. He did nothing wrong.

Frankly, I'd be a little pissed off. Maynor is doing valuable free work for Apple and he's getting pissed on by the Apple community for it.

Re:He notes in the blog that his company does not

[dwater]

> And if they run on donations, they are doing work they think will net them the most donations

Not so. Some non-profits are there for a purpose, not just to self-perpetuate. If the purpose is no longer there, then they stop doing what they were doing...

In any case, this is far off-topic and wrt what is on-topic we are actually agreeing with each other. Apple isn't doing this out of the goodness of it's heart, which explains people's expectation that it should be something of some quality and not complete crap, to suggest two extremes (not to say it is either).

If it isn't of the quality people have come to expect from Apple, then people will (probably) be put off Apple products overall and Apple will be doing themselves (and, more importantly, their stock holders) a disservice. Some people (rightly IMO) don't consider this to be freeware, since there are several obvious possible reasons why they would release this software.

Re:He notes in the blog that his company does not

[Mattintosh]

I'm pretty sure the "bug" button is prominent in the Safari Beta UI for a reason, and being an attention hound isn't it. If this guy found bugs, he should push the damned bug button and report it back to Apple. After he's done that, he can blog about it to gloat, inform, or whatever else he feels he should do. But to blog/gloat/inform before sending the report to Apple (remember, it's one fricking button) is just asshattery.

Re:He notes in the blog that his company does not

[LKM]

The issue seems be the notion that it is somhow "wrong" for Maynor to disclose the vulnerabilites without informing Apple and giving them time to fix it. Maynor claims that IN THE PAST Apple has been uncooperative WITH HIM. So based on his OWN PAST EXPERIENCE he chose to release the vulnerabities publically. He did nothing wrong.

Okay, let's assume that what he says is true (it clearly isn't, but let's assume it anyways). So he claims Apple has been uncooperative. Does that give him the right to publicly announce that he has found vulnerabilities, and then not give them to anyone? This is the kind of shit that got him in the AirPort mess in the first place, and even if Apple screwed him over, it's still wrong to take revenge on them - and by proxy, on all users of the software - by doing that.

How in the world is this "nothing wrong"? Even if Apple was uncooperative, he's an asshat to behave like this. How old is he, 3 years? "HAHA, I've found serious security issues in your code, but I'm not going to tell you where they are because you were mean to me!"

Pray tell me, what "valuable free work" is Maynor doing?

Re:He notes in the blog that his company does not

[Lars T.]

Funny how you didn't address my point at all.

Re:He notes in the blog that his company does not

[Anonymous Coward]

It wouldn't be an empty list, for sure.

It is until you put something on it.

Re:He notes in the blog that his company does not

[unixdeveloper]

Read the disclosure policy first. Apple is the one has the track record of irresponsibility from ipod batteries to wifi security. "I've been asked what our disclosure policy is. Its pretty simple, in most cases we will give vendors as long as they need to fix problems. If the vendor is unresponsive or make threats, we will give them 30 days then release details. If a vendor answers a vulnerability disclosure with marketing and spin attempts, we no longer report vulnerabilities to that vendor but the information goes into our Hacker Eye View program for customers and will be used in pentesting. We do not sell the vulnerabilities to any 3rd party."

Re:He notes in the blog that his company does not

[Lockejaw]

A better analogy: the free one is DOA, and you try to claim warranty on it. It's an interesting point to discuss. Suppose I buy two pairs of headphones because the 2-for-1 price is so good, and one turns out to be a lemon (a deal-breaker, even on the 2-for-1). What recourse do I have?

Or perhaps I buy something because of a promo they offer alongside it (i.e. buy this widget, get this free gadget). The widget alone isn't (IMO) enough for the price, but the widget+gadget combo is. If I make the purchase, and the gadget dies, I would be making a warranty claim.

I would label the above case "misrepresentation" or worse. Comcast said he'd get something if he ordered the extra channels, but they didn't give it to him.

Re:He notes in the blog that his company does not

[Anonymous Coward]

goddamn grammar nazi, get off our lawn!

Re:He notes in the blog that his company does not

[argent]

There is no concrete reason to think that the company in question has not contacted Apple many times and (due to being ignored) feels such a thing is worthless until/unless it is totally public - much the same as many here feel is the case with Microsoft.

I've contacted Apple many times and recieved no feedback. It would still be totally irresponsible for me to release a security vulnerability before notifying them. Same with Microsoft, Bank of America, Valve, or even the MPAA. It doesn't matter who the responsible organization is, if you don't notify them before announcing the vulnerability you've abandoned any pretense at being a responsible security researcher. There is no excuse whatsoever. None.

Re:He notes in the blog that his company does not

[makomk]

No, this is like someone trying out a new type of front door lock, finding out that it is totally insecure, and publicising the fact that it is so that people can avoid using it. What you're suggesting is that it's better to keep quiet about it and let people get their stuff stolen.

Re:He notes in the blog that his company does not

[BlueStraggler]

Everything they do is designed to make you want to give them more of your money.

Believe it or not, some things they do are designed to get their customers to give their money to YOU. Well, not you specifically, since it all seems to be going over your head. But if you were an application developer, then you get lots of free stuff from Apple (in this case, without even buying Apple hardware), and you can use that to build apps that make YOU (not Apple) money. Apple benefits by fostering a healthy ecosystem for their hardware, so they don't even really care that you aren't giving them your money. What you are giving them is an environment that allows them to prosper, and the fact that you also prosper is their payment to you in return. Software is not a zero-sum game.

Re:He notes in the blog that his company does not

[pudge]

because he is a total fsckwad loser attention hound.

I wondered who'd be the first to launch an ad hominem attack - and look, right in the first comment.

Thanks for reaffirming my faith in Apple Fanboi nature. Oh, grow up. Maynor is, by definition, someone no one should care about. If he reported his vulnerabilities, he would be worth listening to. Since he does not, he is not.

Re:He notes in the blog that his company does not

[argent]

Assassinating your own character so Apple can't do it for you is hardly "the right thing".

Re:He notes in the blog that his company does not

[phantomfive]

This might be believable, except this is the guy who came up with the bogus apple wireless exploit a while back. They reported it to Apple, but it wasn't really a problem because it was with a third-party wireless device, in a setup that would probably never happen in real life (and likely was never actually a vulnerability in the first place). Furthermore, if you are willing to pay for their Hacker Eye View program penetration testing, they WILL give you a full report of the vulnerability. After a careful analysis of the situation, it seems that the 'security expert' is actually a marketoid looking to drum up some free publicity for his company.

Re:He notes in the blog that his company does not

[Anonymous Coward]

On the other hand, screwing up the link doesn't make you look like a genius either.

Re:He notes in the blog that his company does not

[Anonymous Coward]

A security expert

Maynor? ? ? A security expert?

Re:He notes in the blog that his company does not

[scruffyMark]

This is Dave Maynor, of the infamous wireless driver bugs that may or may not have existed. He reported the bugs, and basically saw his credibility trashed in the press.

Granted his own behaviour could have been better, but as more information came out over the following year or so, it looks rather more like Apple did attack him quite unnecessarily in the press.

Re:He notes in the blog that his company does not

[gigahawk]

This totally misses the point, as most of slashdot does. His company relies on their credibility to get them by. A security company without credibility is the most worthless thing ever.

Last time he found an exploit he reported it publicly and to apple and what did apple do? They claimed the exploit never existed and threatened to sue him over it. Now 50% of slashdotters think he was lying about the exploit just to get some PR. That's not the kind of PR he wants and he knew that would be the kind he'd get if he was in fact lying, so his incentive to lie doesn't exist, his incentive to be credible and correct is very high. But the result of that episode was that every no-talent asshat who knows nothing about whether or not the exploit actually existed or what it entailed just believed apple's PR department, seriously tarnishing his reputation in the process. Certainly every person who might be buying his software will believe apple's PR.

This isn't a "he was mean to me, I'll be mean to him" decision, he doesn't want to go through that shit again and hurt his business and reputation even worse. Whether or not apple *actually* works to fix the bugs is irrelevant, all that matters is how they act publicly because that is what affects his business and his day to day life.

Apple basically punished him for doing the right thing. I can't blame him for not doing it again.

Re:He notes in the blog that his company does not

[Anonymous Coward]

Oo Nawty Nawty wee rent boy!

Re:He notes in the blog that his company does not

[kencurry]

No, this is like someone trying out a new type of front door lock, finding out that it is totally insecure, and publicising the fact that it is so that people can avoid using it. What you're suggesting is that it's better to keep quiet about it and let people get their stuff stolen. Your analogy is wrong.

Safari beta 3 windows, is not for sale, it is clearly labeled a beta. The responsible thing to do here, if a vulnerability is found, is to report it in such a manner such that the vulnerability can be fixed.

To do what this guy did was chickensh*t grandstanding.

Re:He notes in the blog that his company does not

[Anonymous Coward]

Granted his own behaviour could have been better, but as more information came out over the following year or so, it looks rather more like Apple did attack him quite unnecessarily in the press.

Amazing how I came to precisely the opposite conclusion.

Maynor never proved that his claimed exploit even existed; to this day he has still never released any evidence besides the original video. And there are strong reasons to suspect the video demo was rigged. Yet Maynor kept making all kinds of self-righteous noises, even as he gave one excuse after another for not actually proving what he said he did was possible.

Apple's so-called 'attack' consisted mainly of saying that Maynor had contacted them but had not supplied them with adequate information about the supposed exploit to reproduce it. They'd have been well justified to really go after him, but they actually did not say very much at all.

Apple's interactions with other people who report security bugs indicate that they just might be telling the truth, you know. They even credited the Month of Apple Bugs jackasses when they fixed things first reported by MOAB, and those guys were much more actively obnoxious than Maynor.

Re:He notes in the blog that his company does not

[GuldKalle]

[/endsarcasm] Heh, I think this is the first double negative i've ever seen in BBCode.
[/grammarnazi]

Re:He notes in the blog that his company does not

[Anonymous Coward]

Such a charmer. How'd that work out for you in the end?

Re:He notes in the blog that his company does not

[argent]

Last time he found an exploit he reported it publicly and to apple and what did apple do? They claimed the exploit never existed and threatened to sue him over it.

And refusing to follow ethical research practices now provides him no protection from that kind of response. None. Zero. Zip. he is not doing anything useful by behaving this way. All he is doing is further damaging his reputation.

His company relies on their credibility to get them by. A security company without credibility is the most worthless thing ever.

Indeed. Which is why his response is just plain stupid. It doesn't help his reputation, and it hurts his credibility.

All damage, zero benefit.

Whether or not apple *actually* works to fix the bugs is irrelevant

To the people who are affected by his actions, whether Apple fixes the bugs or not is the only thing that is relevant.

Apple basically punished him for doing the right thing. I can't blame him for not doing it again.

How you respond to negative reinforcement is what is called a test of character. Whether you blame him or not, it's important to consider his response to this test when evaluating his vulnerability reports.

Re:He notes in the blog that his company does not

[argent]

"why the fuck should he care about anything except his bottom line."

If he doesn't care about anything but his bottom line, why should I treat him as anything but an ambulance-chaser?

Re:He notes in the blog that his company does not

[Anonymous Coward]

e) He figures it's likely that somebody who works for the vendor also, occasionally, reads technical news. So by announcing it publicly, he *is* telling the vendor.

Just a thought.

Re:He notes in the blog that his company does not

[dwater]

true, but the end goal is their own profit.

Re:He notes in the blog that his company does not

[dwater]

I guess I couldn't see your point then, or I had too many other 'points' to think about from the other replies. ...or was it this :

"Do you do this for free, or do you get paid?"

In which case, I do it for free.

Re:He notes in the blog that his company does not

[Anonymous Coward]

the information goes into our Hacker Eye View program for customers and will be used in pentesting. We do not sell the vulnerabilities to any 3rd party.

Third parties ... like customers?

The real issue is that Apple fix many reported bugs and the people who report them never have an issue - even the Month Of Apple Bugs guys. So why is this single person having issues with Apple?

Sadly to say, the obvious reason is most likely the correct reason: Apple are fine to get security vulnerabilities reported to them, research them when they get them, fix them, and all is good. All this guy has been is a securiblogegotrip, nothing he has claimed has been backed up or independently confirmed as far as I am aware, and really the entire security community should be wary of such people.

Re:He notes in the blog that his company does not

[mollymoo]

Even if your software is free, you really oughta do your best to make sure it's not crippled with fatal security holes--discovered within hours I might add.

What makes you think Apple aren't doing their best? I suspect they actually are pretty much doing their best, but in common with the rest of the industry (and FOSS) Apple simply don't know how to make bug-free software in commercially realistic timescales.

Re:He notes in the blog that his company does not

[mollymoo]

Bugger. They should have some kind of a preview facility on this site...

Re:He notes in the blog that his company does not

[phantomfive]

How is this flamebait? If something is wrong with it, tell me, because as far as I know everything I said is 100% true.

Re:He notes in the blog that his company does not

[Whiney Mac Fanboy]

It figures that one asshole would defend another asshole when the issue talked about is being an asshole.

Aaaah, a Whoney Apple fanboi who does't understand the difference between defending someone & commenting that the attack dogs are out.

Thanks for again reaffirming my faith in Apple Fanboi nature. I'm sure you have something fanboiish to add?

Re:He notes in the blog that his company does not

[Anonymous Coward]

He had no point, Lars T works for Apple, going into forums and trying to confuse people who post comments percieved as anti-Apple by posting the most nonsensical replies he can.

Re:He notes in the blog that his company does not

[shaitand]

I got everything working and my entire cable bill credited for the period I had issues.

Re:He notes in the blog that his company does not

[gchat]

No, but I believe this http://en.wikipedia.org/wiki/Web_browser_compariso n#Vulnerabilities. It is clear that Safari is even less secure than Mozilla Firefox, which has a greater user community ( and is free of course ).

Re:He notes in the blog that his company does not

[Lars T.]

Thanks for again reaffirming my faith in Apple Fanboi nature. I'm sure you have something fanboiish to add? No, just like you don't have to anything intelligent to add.

Re:He notes in the blog that his company does not

[Anonymous Coward]

Nahhhh - haven't you been reading the news? Security people are *scared* to report vulnerabilities.
Shooting the messenger is better than having your products dissed in public dontchaknow.

Re:He notes in the blog that his company does not

[rtechie]

Pray tell me, what "valuable free work" is Maynor doing? Free QA. QA typically pays between $25-$35 per hour minimum. This is the whole point of a public Beta, free QA. So not only is he doing something nice for free, but Apple implicitly (maybe explicitly) asked him to do it.

He is not "taking revenge" on Apple or the users. He's WORKING FOR YOU. His argument, which is an argument widely shared by those in the "open disclosure" camp, is that Apple ignored previous PRIVATE disclosures he made to them about vulnerabilities. So in this case to chose to announce the EXISTENCE of the vulnerabilities publicly AND disclose the details privately to Apple IF THEY ASK for them in the next 30 days. At the end of 30 days he'll post the details of the vulnerability.

Basically he's giving Apple 30 days to fix it before disclosure and he's not willing to "work with" Apple to delay the disclosure till they have a patch ready. He's clearly doing this as a way to pressure Apple to patch the vulnerabilities faster.

Re:He notes in the blog that his company does not

[Whiney Mac Fanboy]

Thank you again, for reaffirming my faith in Apple Fanboi nature. I'm sure you have something fanboiish to add?

Re:He notes in the blog that his company does not

[LKM]

Free QA.

"I found a bug and I'm not going to tell you what is its" is not QA.

His argument, which is an argument widely shared by those in the "open disclosure" camp, is that Apple ignored previous PRIVATE disclosures he made to them about vulnerabilities.

If that was his argument, he could just do what everyone else does in those cases: Release the details to Apple and publish them a fixed amount of time - such as a week - later. That's not what he's doing. For the record, the argument is only "widely shared" by the people who read zdnet.

Finally, he did not say that he would report the information to Apple if asked. He said plainly "we no longer report vulnerabilities to that vendor."

Re:He notes in the blog that his company does not

[Lars T.]

Thank you again, for reaffirming my faith in Apple Fanboi nature. I'm sure you have something fanboiish to add? Thank you again, for reaffirming my faith in your stupidity. I'm sure you have something even more stupid to add.

Re:He notes in the blog that his company does not

[Whiney Mac Fanboy]

Aaaaah, imitation, the sincerest form of flattery. Thank you.

I'll let you have the last word (hopefully, you won't just copy me again).

Re:He notes in the blog that his company does not

[Lars T.]

Thanks for doing the unthinkable, posting something even more stupid than before. But you will continue braking every record in that regard.

Maybe that's because...

[YowzaTheYuzzum]

... it's a beta version.

Re:Maybe that's because...

[nschubach]

...and it's on Windows.

Re:Maybe that's because...

[gbulmash]

What makes me scratch my head... if these guys can find holes in a few hours, why can't Apple? It's not like these guys spent months to find some really obscure bug. They banged away with known attack vectors and got near-instant results. In a case like that, "it's a beta", particularly when it's been hyped at a big event, rings VERY hollow.

IMO... If you release it quietly, so only the diehards are really pounding it, you can keep the "it's a beta" excuse. If you hype the release, you lose the excuse.

- Greg

Re:Maybe that's because...

[DogDude]

A software beta means that the developers are reasonably sure that it's ready for the public to use. They're relatively sure they've gotten out all of the bugs found in Development and Alpha testing. Beta isn't supposed to find major crashes. It's designed to find the smaller bugs that the testing team overlooked, and tweak the user experience.

Apple does not release decent Windows software. Case in point: iTunes is a terrible mess. I'm not surprised Safari Beta is this bad.

Re:Maybe that's because...

[Anonymous Coward]

...and it's on Windows.

muwahahahahaha...

(okay I saw this joke a few days ago here, I just need to get it off my system.. :) )

Re:Maybe that's because...

[LO0G]

Could you imagine the screams of outrage if Microsoft, Mozilla or Opera would have released a beta browser with those kinds of problems?

Think about it - whileit's unquestionable that both Thor and David are very talented hackers, but they both indicated that they didn't even look very hard to find the problems they found.

Re:Maybe that's because...

[Jeff DeMaagd]

Given the complaints I've seen elsewhere, I think that the quality is closer to alpha stage development. Usually, "public beta" is done on software that's almost ready for use, but has minor bugs. The reports I've seen are that there are a lot of serious bugs in rendering and stability, and now, major security problems.

Re:Maybe that's because...

[Anonymous Coward]

Dude, that's what beta meant twenty years ago. Today, Beta means they've not found any show-stopper bugs during in-house testing.

Fact of the matter is that most of the larger pieces of software running around are in a continual state of development and testing; from the day of release, to the day the product is EOL'd, people are hacking around on it. If you're going to be pedantic, go crawl up Microsoft's ass, you might find someone else like yourself.

Re:Maybe that's because...

[jeffasselin]

Indeed. The issue not being that Windows is less secure, but that it's a different platform, and as such would expose any code to completely different vulnerabilities.

Re:Maybe that's because...

[cgenman]

What makes me scratch my head... if these guys can find holes in a few hours, why can't Apple?

Because 100,000k security researchers and hackers all typing away at keyboards will eventually write Shakespeare?

I don't care how bright your engineers are or how well you've planned your security model, the moment you put it on the 'net it WILL be hacked. That doesn't mean it will stay hacked, so much as the task of securing a system against simulated internal attacks will uncover different problems than putting it in the wild.

Re:Maybe that's because...

[moosesocks]

Eh. iTunes on Windows is alright in my opinion.

It's quicktime that's the absolute mess -- It's gotten better since iTunes came along, but compared to the lightweight framework that it is on the mac, the windows version absolutely sucks. It's just an incredibly sluggish, and somewhat useless media player.

On OS X, Quicktime is essentially a fairly versatile media framework that, given the proper codec, can play just about anything. Virtually all mac applications that require the manipulation of media files utilize it. The file format also allows for some pretty darn cool nondestructive editing -- Final Cut Pro is more or less just a fancy utility for manipulating QuickTime files.

QuickTime player is simply a front-end application that makes use of the framework. Its Windows counterpart is a mere shadow of its former self.

On the other hand, VLC natively plays every format under the sun on every platform under the sun. Come to think of it, it's the only app I know of that works extremely well on all 3 major platforms (Firefox isn't so hot on the mac)

Many people blame the presence of a Windows version for preventing Apple from transitioning iTunes over to a Cocoa app. I can hardly blame them either -- Cocoa apps tend to be a bit more stable and 'snappy' (it's a really nice framework)

I wouldn't completely knock Safari without giving it a chance. Safari itself was based off of KHTML (and the Apple devs still contribute back regularly to the KDE/Konqueror folks). If they ported it once, porting it twice shouldn't be a terribly huge issue once the initial kinks are worked out.

Re:Maybe that's because...

[Nicolas MONNET]

In a case like that, "it's a beta", particularly when it's been hyped at a big event, rings VERY hollow.

I don't care how it "rings," as long as it matches the definition of beta software: feature complete, known to have blocking bugs left.

Re:Maybe that's because...

[moosesocks]

What makes me scratch my head... if these guys can find holes in a few hours, why can't Apple?

Maybe they just got lucky, and found a hole in the first place they looked? It might sound stupid to suggest, but I wouldn't rule it out.

Re:Maybe that's because...

[ceoyoyo]

Hm... I didn't see any TV commercials about Safari on Windows. I did hear about an announcement at an annual conference for developers.

Re:Maybe that's because...

[ceoyoyo]

VLC isn't so hot on the Mac either. I assume it's better on other platforms. It pukes at a lot of media files, which I don't blame it for, but when it pukes it tends to freeze or crash where both MPlayer and Quicktime give you a nice dialog saying they don't know how to play the file.

Re:Maybe that's because...

[the pickle]

"if these guys can find holes in a few hours, why can't Apple?"

David Maynor has a track record as a publicity whore first and legitimate security researcher second, so whether Maynor has actually found as many bugs as he claims to have found here is up for debate until he provides some more substantial proof. He also has a giant ax to grind after Apple embarrassed him in the AirPort bug fiasco. I'd take anything he says with a grain of salt until he gives me ample reason to trust him again.

Nice policy, by the way: find bugs and don't ever report them to Apple. Because last time you claimed to have reported a bug, Apple exposed you as a liar, so now you just don't bother. That's brilliant. We need more people in the world with that kind of attitude. And Maynor wonders why people don't take him seriously as a "security researcher". The Blogspot-based announcement doesn't help either. That's like your company e-mail address being @hotmail.com.

Thor Larholm, on the other hand, may well have found a legitimate bug. What with this being beta software and all, that's not too incredibly surprising. Equally serious bugs have been found in release versions of Firefox and IE, so I'm not sure what the big deal is here. If Safari 3 ships with these vulnerabilities still unfixed, then people should worry.

p

Re:Maybe that's because...

[franksands]

I work for a software company and we have a very thorough QA, but that never mean that we deployed a version of our system without bugs, in rare cases, discovered in the next day of the release. Today, browser are much more than HTML renderers, which opens a million different ways to try to make it break. Of course this does not mean that every bug found is excusable, but it means that is next to impossible to release something 100% bug free, that's why there are betas, because some guy somewhere is gonna think of a completely new way to screw the application, and this is how we can move forward.

Re:Maybe that's because...

[NMerriam]

Could you imagine the screams of outrage if Microsoft, Mozilla or Opera would have released a beta browser with those kinds of problems?

I'm quite certain the beta version of Firefox 1.0 and IE 1.0 both had lots and lots of security holes and bugs. I don't think anyone is shocked at all when there are major bugs in the Firefox betas (I certainly don't think anyone is recommending you use the current Firefox 3.0 for production use).

This is the first web browser Apple has ever written for Windows. I would be flabbergasted if it didn't have all sorts of problems well into the 2.0 version. I certainly wouldn't expect anyone to use it as their daily browser, and I don't think Apple expects them to right now either -- it's an IDE for the iPhone.

Re:Maybe that's because...

[uolamer]

I visited apple.com using my firefox browser.. I followed the links and firefox blocked some lame popup they used to start the download, went to IE, downloaded it, installed it, used it for about 2 minutes.. started the un-install, it asked me to close my utorrent on the uninstall for some reason.. no idea why.

The top text field where you put things like http://www.google.com/ i liked how it used it also as a status bar filling up with color as the page loaded.. after turning on the status bar it was giving me more info than im used to with firefox.. I personally didnt like the skin it came with and it seemed slow dragging the browser window around for some reason.. whatever, i will try it again in 6 months maybe. I really wouldnt mind them taking part of the browser market, from what i saw so far, it still needs some work.. (hence the word beta) and this is the first windows release so, its all good, few months from now maybe it will be worth trying again.

Re:Maybe that's because...

[LO0G]

Really? Back when Firefox 1.0 and IE 1.0 were written, the web wasn't a hostile environment. The problems reported here are fairly basic issues (canonicalization problems while handling protocol handlers are VERY old news).

These are the kinds of problems that I'd expect novice developers building their very first stumbling attempts at a web browser client, NOT the result of code that a seasoned team of developers who have a long history of experience with the web. And certainly not in a browser that's considered "Beta" quality.

After all, Apple says "Apple engineers designed Safari to be secure from day one."

Why would building a web browser for Windows be any harder than building a web browser for OSX or Linux? Before you answer "because windoze sux", consider the fact that the Firefox and Opera people don't seem to have had a problem building a rock solid secure browser for Windows. And as far as I know, Firefox and Opera have both been pretty darned secure since day 1.

Re:Maybe that's because...

[Grail]

If the "known attack vector" is actually a bug in the Microsoft Windows JPEG handling API, will you still be crowing about Safari 3 for MS Windows being broken? Go have a look at the number of problems that exist for previous versions of Microsoft Windows XP, in particular relating to graphic formats of some kind or another.

Besides, from the screenshot of the crash reporter, it's a null pointer dereference (not a heap overflow) - so sure, it's a remotely exploitable denial of service attack, but the browser crashes because the software has detected a problem and decides that the safest way out is to dump core. Let's all go tell the world how broken Safari 3 for MS Windows is!

For example: http://www.trendmicro.com/vinfo/secadvisories/defa ult6.asp?VName=(MS06-078)+Vulnerability+in+Windows +Media+Format+Could+Allow+Remote+Code+Execution+(9 23689)

Have fun.

Re:Maybe that's because...

[John Harrison]

I take it that you do not write code. If you do you should be fired.

Re:Maybe that's because...

[Anonymous Coward]

Actually, it means whatever the hell the company releasing it wants it to mean.

But the general idea of a beta is that it's at the point at which it runs, and most features should be implemented. It is NOT ready for the public to use, but it is available to more than just the development team.
In the case of free Internet applications, that usually means making it publicly available for those people who are willing to take the risk of testing beta software.
If you are not willing to risk that an application may break, lose data, or have a security flaw then you should not use beta software.

Re:Maybe that's because...

[NMerriam]

Why would building a web browser for Windows be any harder than building a web browser for OSX or Linux?

Because it is different? It may shock you to find out that file handling is different on different OSes. If you're not aware of the security pitfalls on each one, then every time you go to a new OS you'll have to learn the hard way.

It certainly does not help that the MS specifications for file handling are in fact the insecure way to do things, which is no big deal when developing a local application. But obviously developing a web browser requires an additional knowledge of the security issues relevant to the platform beyond what the docs provide.

I don't know when YOU started using different web browsers, but Opera, Firefox, IE, Mosaic, and Navigator all had significant security problems early in their development.

I don't think anyone has ever claimed Apple was particularly skilled at delivering speedy or well-integrated Windows apps (I'm certainly not impressed by them), but to criticize them for following the specs for file handling and then being bitten by problems on a beta product is a little hyper-critical.

I think we could at least wait until the product is actually 1.0 before we start lighting torches and storming the castle.

Re:Maybe that's because...

[gbulmash]

"Thor Larholm, on the other hand, may well have found a legitimate bug."

And from his statements, the protocol handler command injection is a known attack vector.

Nothing is foolproof. But it just seems to me that they need a "devious little shit" department, where they have guys who do nothing but try to break stuff... not unit testers, not QA analysts, but devious little shits. And nothing goes to a widely publicized public beta until the devious little shits have had their turn with it. Because when it gets out into the wild, the unaffiliated devious little shits are going to have a field day, as demonstrated.

As for the people who say it wasn't hyped because it was at a "developer's conference". There are also developer mailing lists and developer web sites. Jobs put it in his WWDC keynote because he knew that would guarantee it international press. Whether or not the event was technically for developers, the keynote is as much for the press and millions of "Apple Watchers" as it is for the devs. And if that comes as news to you, you're probably going to be shocked to find out that Santa Claus isn't real.

- Greg

Re:Maybe that's because...

[Hal_Porter]

Maybe Apple don't care? I can imagine if I were them I'd probably make the browser portable for strategic reasons. But using it IE style to try to control the browser marketspace is probably a waste of time. And they presumably can't sell it, since all the other browsers are free.

I wonder how it compares to Opera 9.0x speedwise?

Google cache of www.howtocreate.co.uk/browserSpeed.html because he doesn't want people posting it to /.

Hmm, Opera 9.01 seems to be a bit faster most of the time.

Re:Maybe that's because...

[LO0G]

The problems that were found were found by fuzzing HTML output. That's not platform specific.

And similarly, the canonicalization failure handling iframes is not platform specific. Apple knew about the potential for exploitation of that particular vulnerability, they mitigated it for basic links, but didn't when the link was in an iframe. So again it's not platform specific.

nuf said.

Re:Maybe that's because...

[Hal_Porter]

Because 100,000k security researchers and hackers all typing away at keyboards will eventually write Shakespeare?

No, but we can work out a way for Iago to win.

Re:Maybe that's because...

[whitmer]

What makes me scratch my head... if these guys can find holes in a few hours, why can't Apple? It's not like these guys spent months to find some really obscure bug. They banged away with known attack vectors and got near-instant results.

Given enough eyeballs, all bugs are shallow. I would assume that Safari for Windows development and testing teams aren't really that large and there's always only so many man-months to allocate for testing, QA and all the rest of it. Not to mention security and vulnerability testing, "ordinary" developers may not have the skills and tools of most security experts, black hats, etc.

That's why 10k people find "obvious" bugs very fast on software that twenty strong development team spent last twelve months working on.

Re:Maybe that's because...

[Anonymous Coward]

...you're probably going to be shocked to find out that Santa Claus isn't real.

Damn you...

Re:Maybe that's because...

[DurendalMac]

No shit. Why is the reporting of bugs/vulnerabilities in a fucking BETA a story? It happens all the goddamned time!

Re:Maybe that's because...

[ookabooka]

What makes me scratch my head... if these guys can find holes in a few hours, why can't Apple? It's not like these guys spent months to find some really obscure bug. They banged away with known attack vectors and got near-instant results. In a case like that, "it's a beta", particularly when it's been hyped at a big event, rings VERY hollow.

I definitely disagree with you there, no offense. For all the programmers that can relate, please tell me if the following fictitious story reminds you of something that happened to you. Picture yourself as either Bob or John, it doesn't really matter since I'm sure you've been in both positions at some point. Bob: "Sweet, finally whipped up that quicksort routine, must be the millionth time I've done it. I think I eliminated a few clock cycles off of every recursive call."
John: "Cool, submit it to the cvs and I'll work on integrating it into the core."
Bob: "Sure, hey how about lunch." (Bob now begins to commit his code) John: "Sounds great, let me just sync up real quick here." (as thousands of lines of code update on Johns computer and fly across the screen, he notices a few lines that jump out at him)
John: "Hey uh Bob, you remember to delete that temp variable off the heap if the recursive function returns early?"
Bob: "Uh. . .crap. . .I've been doing too much Java lately, I'll fix it and recommit :-/ "


Yes I know, why would you put a temp variable on the heap, how the hell do you express an emoticon in dialog, my example is flawed but you get the point, sometimes the best thing source code needs is more eyes. When's the last time you poured over source code for hours screaming "IT JUST DOESN'T MAKE SENSE, I DON'T SEE HOW THE CODE COULD POSSIBLY DO THAT!!" and then someone casually glances at your code and says "Dude, why isn't there a break after that case statement?" Even the best and brightest can miss something stupid.

P.S. I've released some beta's with major security/stability issues, that's what the TODO keyword in comments is for :-D

Re:Maybe that's because...

[VGPowerlord]

QuickTime player is simply a front-end application that makes use of the framework. Its Windows counterpart is a mere shadow of its former self.

Based on the wording you used, when you said "Its Windows counterpart," I thought you were referring to Windows Media Player, which, as I understand it, is just a(n ugly) GUI over top of DirectX Media. Fortunately, there are alternate players, such as Media Player Classic (an open source player that resembles Windows Media Player 6.4 with some extra features) and additional codecs, including one to play Quicktime files.

I wouldn't completely knock Safari without giving it a chance. Safari itself was based off of KHTML (and the Apple devs still contribute back regularly to the KDE/Konqueror folks). If they ported it once, porting it twice shouldn't be a terribly huge issue once the initial kinks are worked out.

I'd consider using it if it didn't completely ignore some of Windows' GUI conventions. I hate skinned apps, with a passion. I tolerate Opera and Firefox simply because they have skins that resemble my OS... thanks to a "feature" of Windows dealing with Window Handles, even Internet Explorer has to recreate all the Windows controls that it wants to use (except <select> up through IE6) rather than using OS native widgets.

Other than the obvious non-standard widgets, you have

1. Missing application menu in the upper-left corner. This menu contains menu items for Minimize, Maximize, Restore, Move, and Size. This menu is still accessible via its keyboard shortcut (Alt-Space). Present since: At least Windows 3.0, 1991
   
2. Missing minimize animation. Present since: At least Windows XP, 2001
   
3. Maximize/Restore animation is odd, it resizes one dimension at a time. Windows itself resizes both dimensions at a time. Present since: At least Windows XP, 2001
   
4. Resizing can only be done from the lower-right corner. Windows allows resizing from all four sides and corners. Also, the cursor does not change when moved over the resize area. Present since: At least Windows 3.0, 1991
   
5. Clicking on the Safari icon in the taskbar when it is minimized performs the restore operation, even if the Window was maximized before... in other words, it shows the window maximized for a split second, then resizes it.
   
6. You can resize a maximized window. Windows programs normally don't let you do this.
   
7. Clicking on a taskbar icon for a window that is currently in front should minimize that window. Present since: Most likely Windows 95, 1995.
   
8. Some dialogs are missing close buttons. History, Show All History and Help, About Safari off the top of my head. In fact, the only way I found to close the History window was counterintuitively through Bookmarks, Hide All Bookmarks.

Re:Maybe that's because...

[SharpFang]

Its Windows counterpart is a mere shadow of its former self.

Former = from when?
I remember some old QT. 3.something I think. It hijacked program association for .jpg files every time you ran it, and then failed to display the jpegs. And a dozen of movie formats it claimed to support and hijacked their associations too.

Quicktime is a huge, ugly useless thing that steps in its muddy boots in the middle of my home (my PC) and starts rearranging things, dropping half of them on the floor in the process. I want a player, not a friggin juggernaut trying to turn my PC into a media center.

Re:Maybe that's because...

[htalvitie]

Don't know about Shakespare.

Typing simply "test" on Apple's new home took Safari down crashing:
http://assemblix.net/2007/06/12/apple-safari-for-w indows-crash-dump

But as already stated: nothing special, no hacking, no Major Security Incidence here.

It's a beta.
Let's just call them bugs.

Re:Maybe that's because...

[andydread]

Sorry, your "100000k security researchers" argument does not come in to play here. These were KNOWN attack vectors. KNOWN attack vectors means that any script kiddie could have tried a KNOWN attack against it. I suppose the Apple guys failed to try KNOWN attacks against their own code. relying on as you say "simulated internal attacks"

Re:Maybe that's because...

[random0xff]

Eh. iTunes on Windows is alright in my opinion. Just must really like having services running in the background then. Or inconsistent GUIs.

Re:Maybe that's because...

[Anonymous Coward]

If a CEO of a company stands on a stage with cameras ponting at him , presents a piece of Software , puts up nifty logos , then it isn't beta any more. Sure they name it beta so that they have an excuse , but they could have easily just released it next week without all the showing off.

Re:Maybe that's because...

[Tony Hoyle]

The story has been running on the news all morning. That's a few million people in the UK who know about it for a start. Oh and they forgot to mention it was beta...

Re:Maybe that's because...

[Tony Hoyle]

But it just seems to me that they need a "devious little shit" department

Apple have plenty of lawyers already.

Re:Maybe that's because...

[Tony Hoyle]

I remember the first release (not beta) of Opera for linux.

It actually required you to put a symlink called 'C:\' in your home directory otherwise it wouldn't start up.

So give Apple a break... it's a first release/beta/whatever.

Re:Maybe that's because...

[saintlupus]

But it just seems to me that they need a "devious little shit" department

They should put Neidermeyer on it?

--saint

Re:Maybe that's because...

[Blakey Rat]

Maybe because they're still working on getting the features working right and they haven't focused on security yet? They have better things to do at the moment. It's a beta. BETA! It's like nobody remembers what that means. Beta means the program isn't done yet; it has the basic features the release version will have and a whole lot of bugs.

If you don't like that, and here's a total shocker: don't use beta software. Nobody's holding a gun to your head and forcing you to run Safari betas.

The nice thing about Apple is, unlike most open source projects, you can be assured they eventually will release a final version. Open source software tends to stay at version 0.8 forever and ever.

Re:Maybe that's because...

[acidosmosis]

>>Because 100,000k security researchers and hackers all typing away at keyboards will eventually write Shakespeare?

Wow I am impressed. Someone actually has a brain here.

Re:Maybe that's because...

[RebelWebmaster]

But, but...the Safari site says it was designed for security from the start?
http://www.apple.com/safari/ (#12 on their list)

Re:Maybe that's because...

[MobyDisk]

Funny you post this - I find iTunes on Windows to be awful since it doesn't respect any of the operating-system preferences or standards. It's like when you run a badly ported X11 app on Windows. Keyboard shortcuts don't work, font and image sizes don't scale properly, font rendering is strange, and it is sluggish. I run it on my media PC but it is almost useless because it doesn't respect the DPI settings so some things in the app are huge while others are too small to read. It's very odd to use. It got worse with iTunes 7.

Re:Maybe that's because...

[mi]

... it's a beta version.

RTFA:

I can't speak for anybody else but the bugs found in the beta copy of Safari on Windows work on the production copy on OSX [emphasys mine -mi] as well (same code base for alot [sic] of stuff).

Safari is the browser on OSX. It is also based on Konqueror — and KDE is at version 3.5.6 at the moment — hardly a beta. The guy did not test Konqueror for the same bugs, but I would not be at all surprised, if they were there too...

Re:Maybe that's because...

[99BottlesOfBeerInMyF]

Given the complaints I've seen elsewhere, I think that the quality is closer to alpha stage development. Usually, "public beta" is done on software that's almost ready for use, but has minor bugs.

The standard everywhere I've worked has been:

• milestone - a development snapshot at some point for some feature set. Not feature complete or debugged.
• alpha - not feature complete, not debugged. Significant milestone - let a partner company or two take a look and give feedback.
• beta - feature complete - but not fully debugged, let selected users pound on it and find some more bugs.
• release candidate - we think we have all the important bugs out, barring appearance a new, big one, we ship this.
• gold master - the release candidate we did not find enough bugs in and are shipping out.
• recommended version - the gold master we shipped plus whatever important patches have been developed since that time.

The reports I've seen are that there are a lot of serious bugs in rendering and stability, and now, major security problems.

That sounds right for a beta to me. All of the things you list are in the category of bugs, not missing features that are supposed to be in. Beta code is not yet fully tested and has not been pounded on by users. It will almost always have these type of bugs.

Re:Maybe that's because...

[Altus]

Wow, and me without my mod points.

Are you and I the only cross platform developers on this site? I cant believe this is so hard for people to understand.

Re:Maybe that's because...

[Angelwrath]

compared to the lightweight framework that it is on the mac, the windows version absolutely sucks. It's just an incredibly sluggish, and somewhat useless media player. This is because of how libraries are packaged in an OS, versus on another OS. OS X is Apple's baby, so it can load whatever libraries and include them under the "OS X" RAM side and make use of native APIs.

On Windows, Apple's APIs that make Quicktime so good are not native, they have to be installed along with everything else, so load times are longer because there is more to load, and there can be additional overhead as well.

But Quicktime is by far the best player, IMO. It's the best player to handle streaming, hands down. And I've never seen a Quicktime video with the audio and video out of sync, even very slightly, but I see it all the time on WMP, Real, and those Flash players. This is hugely annoying.

Re:Maybe that's because...

[Altus]

little known fact but in order to get quicktime on windows working apple ported a large chunk of the classic mac toolbox to windows. Many of the major components were ported. At the time I'm sure it seemed like the thing to do but its long due for a complete overhaul.

Re:Maybe that's because...

[repetty]

Quote:

What makes me scratch my head... if these guys can find holes in a few hours, why can't Apple?

What makes you think that Apple didn't know about any of these? Since it's beta, I'm sure that Apple's developers KNOW it has problems.

You assumptions will be on surer ground once Safari's released.

--Richard

Re:Maybe that's because...

[metamatic]

QuickTime Player was always ugly on the Mac too. There was much howling around when QT 6 came out, because it completely ignored the Mac UI conventions. It has actually gotten better with OS X.

Re:Maybe that's because...

[Lars T.]

Really? Back when Firefox 1.0 and IE 1.0 were written, the web wasn't a hostile environment. The problems reported here are fairly basic issues (canonicalization problems while handling protocol handlers are VERY old news). So what is your excuse for all the bugs in Firefox 2.0 Final?

Release: 2006/10/25
First DoS: 10/23
Breach of privacy: 10/25
Another DoS: 10/31

Re:Maybe that's because...

[LO0G]

Actually, the reason I was surprised at the HTML fuzzing DoS issues is exactly because of the first DoS you mentioned.

In that example, Michel Zalewski fuzzed FF and blew it out of the water - it made news because IE was slightly more resiliant (FF died after minutes of fuzzing, IE took a couple of hours).

I would hope that Apple's security people are monitoring FD and Bugtraq to keep up with the latest incidents and that before they thought to release a web browser that they'd fuzz test their browser.

The breach of privacy issue seems to have been intentional, I can't speak to the 3rd issue.

And none of these issues were shown to be remotely exploitable.

Re:Maybe that's because...

[ce25254]

In fact, the only way I found to close the History window was counterintuitively through Bookmarks, Hide All Bookmarks.

The Show All History/Bookmark View is a strange transformation of the main window, not a dialog. If you are showing the Bookmarks toolbar then you'll see that the little book button is pressed in. Unpress it to go back to the previous web page. Otherwise to leave the History view you just have to go to another URL.

Re:Maybe that's because...

[Blakey Rat]

Missing application menu in the upper-left corner. This menu contains menu items for Minimize, Maximize, Restore, Move, and Size. This menu is still accessible via its keyboard shortcut (Alt-Space). Present since: At least Windows 3.0, 1991

Just FYI, I think that's deprecated now. You used to be able to double-click this icon to close a window, a habit I got into, but in a lot of recent Microsoft apps that doesn't work. For instance, if you double-click the icon in Windows Live Messenger, it maximizes the application... for some reason.

Re:Maybe that's because...

[Lars T.]

Actually, the reason I was surprised at the HTML fuzzing DoS issues is exactly because of the first DoS you mentioned.
...
And none of these issues were shown to be remotely exploitable.
Well, the surprising thing about that was actually that they knew it was in 1.5.0.5, were told it was in 2.0 RC, and still didn't fix it. What they did was say it wasn't so bad, even though they said about the same issue in 1.5.0.5 "We have seen no demonstration that these crashes could be reliably exploited, but they do show evidence of memory corruption so we presume they could be."

Anyway, less than 2 months later 2.0.1 came out and fixed 8 bugs, 5 of them critical. In a final version, not a beta. Do you want me to dig through the fixes for the beta?

Re:Maybe that's because...

[Anonymous Coward]

wait, what? there's a version of quicktime that isn't a total and utter PITA to use? oh, mac. hm, maybe, if you have no idea how to make stuff work out right for another platform, you should just forget about it. maybe apple already did that.

Re:Maybe that's because...

[ksheff]

I used it for a few hours last night w/o any problems at all.

Re:Maybe that's because...

[ksheff]

Do you have a list of URLs that cause these rendering & stability problems? I can't fix them, but it would be interesting to see what others are running into. I used it for a few hours last night and didn't encounter any sort of problem. It didn't automatically import my Firefox bookmarks like their web page said it would, but it worked ok manually.

Re:Maybe that's because...

[ksheff]

I'd love to use VLC for windows instead of Microsoft's program, but the audio output stutters horribly on my XP machine at home. :(

Re:Maybe that's because...

[VGPowerlord]

Just FYI, I think that's deprecated now. You used to be able to double-click this icon to close a window, a habit I got into, but in a lot of recent Microsoft apps that doesn't work. For instance, if you double-click the icon in Windows Live Messenger, it maximizes the application... for some reason.

It's probably considering it as a double-click on the application's title bar, which will maximize the app. Double-clicking the icon to close a window has been somewhat redundant since the X button was added in Windown 95, so that being deprecated doesn't surprise me.

The icon menu also doubles as the taskbar's right-click menu for an application. I noticed this when I starting using an application that added other things to its window menu... those things also appear when I right-click it in the Taskbar.

Re:Maybe that's because...

[VGPowerlord]

It's still a bad UI design choice. It even goes out of its way to break the back button when opening the Bookmarks page via the Show All History link. Back works fine if I open it via Bookmarks, Show All Bookmarks.

If you are showing the Bookmarks toolbar then you'll see that the little book button is pressed in.

I don't because I never use bookmarks toolbars, thus to me they are a waste of screen real-estate. I have them disabled in Firefox and Opera as well. On the flip side, I always turn the Status Bar on because I like to know where links lead before I follow them.

Plus, why would I expect the History display to open the Bookmarks screen? They serve entirely different purposes.

Re:Maybe that's because...

[Sithgunner]

Sorry to make you less excited but VLC is far from being stable and sexy.
For one, under Mac OS X, VLC keeps crashing trying to watch DVD and trying to fast forward and what not, and DVD Player that comes with OS X is far more stable, only it does near to none buffering making network movie play almost impossible.

For two, the Windows version has stone age interface that somehow looks far less sexier than OS X version and don't blame just because it's Windows interface. It can still look as good considering iTunes and Safari can make them look similar to OS X's. And somehow Windows version has no overlay controller on full screen like OS X's does...

For three, when fast forwarding some videos, screen all becomes blured and colors all mixed for some seconds until it catches up to pick enough frames to render everything properly. This looks rather bad for a user's point of view when QuickTime and DVD player or WMP never makes such dirty rendering upon fast forwaring.

And all of these, has been there for literally ages... I've been trying to see the progress of VLC for years, everytime new version comes out, I get excited to see that it finally may become the life saver of media playing in multiple platforms, but I always see something more or less critical making me turn around back to OS specific media player, just because they basically have no QA team.

Maybe it works, maybe it's the last life saver, but it just can't be the primary video player for many reasons.

Beta

[Anonymous Coward]

They call it beta for a reason...

It has not been released

[Utopia]

Its still in beta.

Uhhh...its beta?

[protohiro1]

I mean, you kind of expect there are going to be some bugs...this is a Good Thing and the reason you release a public beta, (in addition to getting buzz) you can shake out the bugs.

Well...

[ch0ke]

Um, beta.

Wow

[mabinogi]

Bugs in the first public beta release!
Who would've thought it!

Incidentally, it doesn't seem to like authenticating proxies at all, so my first experience with it was a bug too :/

However, making a big deal of, but not reporting bugs found in a beta release of something seems more than a little silly.

Re:Wow

[Anonymous Coward]

"However, making a big deal of, but not reporting bugs found in a beta release of something seems more than a little silly."

Yeah, I agree. He sounds like a 5th grader who just discovered that his gym teacher is a child molestor but decides to tell everyone but the police.

Bugs in a beta?!

[Anonymous Coward]

I am SHOCKED!

Say it isn't so!

[QuijiboIsAWord]

Bugs in a beta version of a program thats being incredibly heavily scrutinized by everyone looking for something to crow about!?
That's unpossible!

I've said it before and I'll say it again

[pboyd2004]

I'm not surprised. Apple really doesn't write more secure code, they just have a lower market share and thus aren't as much of a target.

And alot of their success at security on Mac OS is just them inheriting some of their security from the BSD kernel which I'm positive beats the hell out of the Windows kernel in terms of security.

Re:I've said it before and I'll say it again

[Grail]

I'm not surprised. Apple really doesn't write more secure code, they just have a lower market share and thus aren't as much of a target.

... and these vulnerabilities aren't in the Mac OS X version of Safari because ... ?

Re:I've said it before and I'll say it again

[Anonymous Coward]

Who says they aren't? Why wouldn't they?

If they aren't, maybe it's because Apple is trying to drum up ill will against Windows for being insecure? I wouldn't put it past them.

Re:I've said it before and I'll say it again

[clang_jangle]

Yes, I'm sure you did and certain you will, but it's too bad really. You are just showing off your lack of understanding of OS design principles.

Re:I've said it before and I'll say it again

[Anonymous Coward]

Why is this a troll? It's as valid as some of these "5 - Insightful" posts.

I agree with the author. Apple has had it relatively easy. Being a security professional, I expect that REGARDLESS of the OS of choice, give it enough market share and there will be bugs found and malware released to the wild.

Do you think the script kiddies are after the Mac boy's digital art, or after the general masses' (i.e. grandma's) financial records, email, passwords, serial numbers, and anything else that the general masses might have?

Do thieves normally target fancy foo-foo loft apartments or suburban houses with kids, discretionary incomes, and SUVs?

Re:I've said it before and I'll say it again

[megaditto]

They might not be. Safari in windows probably uses win-specific APIs and resources, e.g. common dialog items such as open/save dialog, progress bar, scroll bars, input fields. you know, things like these here: http://msdn2.microsoft.com/en-us/library/ms646829. aspx
All these by default have open holes in them unless the programmers explicitly sanitize user input, keep track of memory, etc. instead of assuming the OS will handle all these.

Over 90% of script kiddes/coders have no idea that the example code they copy/paste gives up security for the sake of simplicity and is not meant to be used as production code. (And no, these are not windows-specific; you used to be able to get root shell from MacOS X.2 login window by typing a 4097-character-long username [place your mug on your keyboard and come back in a few mins at high keyboard repeat rate])

Re:I've said it before and I'll say it again

[Tatsh]

You'd be surprised then that a lot of the code uses their Mac-like UIs. There is hardly anything in the browser that looks like Windows. The idea here I guess is that the user (who to Apple will hopefully buy a Mac now), will forget they are on Windows. Maybe their Mac UIs ported to Windows in some fashion do not have so many holes? That is something to find out later.

Re:I've said it before and I'll say it again

[toQDuj]

They are not, for otherwise Rayner would have claimed to have found $OMG bugs. I assume it would be the first thing he checked.

B.

Re:I've said it before and I'll say it again

[mallardtheduck]

Because they haven't released Safari 3 (beta) for Mac (yet).
This is a Windows port of a currently in development product, expect bugs.

Re:I've said it before and I'll say it again

[midknight32]

Actually, they have.

Re:I've said it before and I'll say it again

[k_187]

Nope, you can get the beta for tiger from the same page as the one for windows.

Re:I've said it before and I'll say it again

[gnasher719]

'' Because they haven't released Safari 3 (beta) for Mac (yet).''

Actually, they have. Guess what I'm typing this in.

Re:I've said it before and I'll say it again

[Just Some Guy]

they just have a lower market share and thus aren't as much of a target.

It has such a tiny market share that not one person in the entire world has been interested enough to step up and write the first virus or worm? Really? That tiny?

Market share might account for part of the equation, but since about 1 in 20 people are running Macs, I find it impossible to believe that there's no interest whatsoever in cracking them.

Re:I've said it before and I'll say it again

[scottgfx]

I'm pretty sure that Apple is still using the Mach Kernel.

Installing Safari 3 public beta on G4?

[nebbian]

OK the system requirements say that you need OS X 10.4.9, 256MB RAM, and 50 meg of disk space.

I'm running 10.4.9, 1.25 GB RAM on a Powerbook G4, have 18 GB spare on my HD, yet the installer says:
"You cannot install Safari Beta 3 on this volume. This volume doesn't meet the requirements for this update."

Anyone else getting this error? Anyone know of a workaround? How can you tell why the installer is stopping?

Re:Installing Safari 3 public beta on G4?

[Anonymous Coward]

Make sure your current copy of Safari is still in /Applications/. The beta won't install otherwise.

Re:Installing Safari 3 public beta on G4?

[appleguru]

You can always go grab the latest webkit over at http://webkit.org/

It's the same as Safari, but without the installer... Nightly builds are made from the current source code repositary.

Today's build (r22084) is the same as the 3.0 public beta (Version 3.0 (522.11))

Re:Installing Safari 3 public beta on G4?

[gorrepati]

May be it is not a Universal binary.

Re:Installing Safari 3 public beta on G4?

[Anonymous Coward]

Your Mac has detected the lack of Kool-aid consumption to complete the install. ...Actually I just think I just invalidated my mac with this comment.

Re:Installing Safari 3 public beta on G4?

[appleguru]

It is: http://otbmods.com/safari_beta_info.png

Re:Installing Safari 3 public beta on G4?

[Anonymous Coward]

Put Safari.app back in the Applications folder, then try again.

Re:Installing Safari 3 public beta on G4?

[nebbian]

Perfect, I moved it back and now everything's installing fine.

Thanks for that!

Re:Installing Safari 3 public beta on G4?

[voidptr]

Not quite.. They may be shipping the same WebKit foundation (I can't actually tell), but the WebKit nightlies aren't running the Safari 3.0 shell around it yet. It's still reporting (and acting like) Safari 2.0.4 with r22084.

Re:Installing Safari 3 public beta on G4?

[Altus]

out of curiosity, why did you move it in the first place?

Safari...? Windows...is the issue - backend!

[djupedal]

And...when Safari reaches, oh, say, 10% ~ 20% of the level of breach-possibles that any of the current IE clients are facing, let us know, eh?

Until then, the mud on the carpet came in on your shoes, not mine.

Beta

[Anonymous Coward]

Wait - someone found bugs in a public beta?

And yet,

[WindBourne]

it is still more secure than MSIE.

it's beta

[pbjones]

it's beta, report the bugs

Re:it's beta

[josepha48]

I have noticed posts like this on /. in the past year or so. Someone releases a beta and then people say it has bugs and it is broken. They said the same thing when IE7 beta's were released. What is it about the word beta that people on /. don't get?

From wikipedia -> http://en.wikipedia.org/wiki/Software_release_cycl e#Beta , this is a prototype / preview / early access.

Report the bugs and they will probably get fixed.

I'm amazed that things like this get to the story line on /. .

Re:it's beta

[delinear]

Maybe because the term "beta" has now been devalued and it's accepted practice that companies will release "beta" software, knowing that the uptake and usage will be almost as great as for the RCs or finished product.

From Wikipedia -> http://en.wikipedia.org/wiki/Perpetual_beta

More and more, the term beta is being applied as an excuse for releasing buggy software for mass market consumption. When we reach a position where a substantial section of the software market is in perpetual beta then the meaning of beta itself will change to accommodate this.

By the way, I'm not necessarily saying I agree with the changing usage of the term beta, nor am I claiming Apple would use the term in this manner - I have no reason to suspect that this is anything but a genuine beta release - just offering an explanation as to why people may now have higher expectations from beta software.

NO BECAUSE APPLE USERS ARE FUCKING FAGS

[Anonymous Coward]

YOU GAY ASS APPLE FANBOYS BEND OVER AND FUCK EACH OTHER IN THE ASS WITH STEVE JOBS ANUS LUBE, WHO THE FUCK WOULD USE THIS CRAP ON WINDOWS?

Important Stuff
Please try to keep posts on topic.
Try to reply to other people's comments instead of starting new threads.
Read other people's messages before posting your own to avoid simply duplicating what has already been said.
Use a clear subject that describes what your message is about.
Offtopic, Inflammatory, Inappropriate, Illegal, or Offensive comments might be moderated. (You can read everything, even moderated posts, by adjusting your threshold on the User Preferences Page)
If you want replies to your comments sent to you, consider logging in or creating an account.
Problems regarding accounts or comment posting should be sent to CowboyNeal.

looks like apple's learning from google

[everphilski]

keep stuff in beta :P

You think the apple developers will be up late

[lena_10326]

....tonight? :)

*stretch* *yawn*

Time for bed. I know I'll be sleepin while they be codin.

Re:You think the apple developers will be up late

[deftcoder]

More like 'Vicodin'

Fuzzing, not futzing. Proofread much?

[lennier]

The quote is "an afternoon of idle _fuzzing_". As in fuzz testing.

Re:Fuzzing, not futzing. Proofread much?

[modecx]

Dammit all to hell, I was looking forward to a thoughtfully written analysis on belly-button lint... And this is what you come up with? Pfeh...

yes, safari is faster!

[alta]

Remote code execution 2.5 times faster than FF on windows!

Re:yes, safari is faster!

[chmod a x mojo]

call me when it hits 2.5X faster than an unpatched IE on vanilla win XP.... without firewalling. damn, that would be fast....

Re:yes, safari is faster!

[alta]

I joke, but I admit.. I really like it, and if I can get a few development things working on it, I'll switch. Yes, it does seem faster.

Where is the bookmark sidebar?

[NateE]

I've never tried Safari before. Haven't had any major problems with it on XP so far.

However, I'm desperate to have a bookmark sidebar. I can see all my bookmarks in the Bookmarks menu. Also the Bookmarks Bar works fine. I can Show All Bookmarks to display them all in a page. How can I have a bookmark sidebar like Firefox or IE? Thats the only way I normally surf!

I actually use the nice Menu Editor add-on in Firefox to hide the Bookmarks menu. Since I never used it.

Re:Where is the bookmark sidebar?

[Myen]

New Safari user here too. Yay win32.

The little book icon on the left end of the bookmarks toolbar, or Bookmarks -> Show All Bookmarks.

Re:Where is the bookmark sidebar?

[NateE]

When I click on that button it does a Show All Bookmarks. I want an always open sidebar where I can navigate around within my bookmark folders.

Not to do a Show All Bookmarks. Find my bookmark. Click. Taken to the web page. Want to open a 2nd bookmark in a new tab. Have to re-open Show All Bookmarks.

Re:Where is the bookmark sidebar?

[mhlo]

Organize your bookmarks in folders in the Bookmark Bar. Think outside the box.

Re:Where is the bookmark sidebar?

[Nataku564]

Use Opera - problem solved.

All kidding aside, Opera does have awesome bookmark handling. Its sidebar is quite handy for organizing things.

Re:Where is the bookmark sidebar?

[NateE]

So Safari does not have a persistent bookmark sidebar?!?

Re:Where is the bookmark sidebar?

[Lord Flipper]

I actually use the nice Menu Editor add-on in Firefox to hide the Bookmarks menu. Since I never used it.

Thanks for the tip on the Menu Editor. I don't use the menu for Bookmarks either, because it doesn't work, anyway, unless a window is open already. (on the Mac, it probably works fine elsewhere). The Editor will be great to have, yeah :)

the point?

[thesupermikey]

isnt this the point of betas....to find bugs?
why is this news?

Re:the point?

[Paradigm_Complex]

It's news that this kind of fined was done so quickly. They holes found were most likely known ways to attack a web browser, in which case Apple should have caught it before release. Betas typically have more obscure, harder to find issues - the more obvious things should already be taken care of. Sounds like it should have been in Alpha.

Alpha or Beta?

[eebra82]

I was actually looking forward to try this browser out, but to my surprise, I could not even make it work.

The installation was smooth without any unexpected bumps on the road. First when I loaded the program, I noticed that no menu fonts nor any fonts whatsoever on the web pages existed. To make it worse, the browser would crash every time I clicked on anything with interactivity, such as the stop button. I have read quite a few solutions to this problem but so far no success. I run Win XP SP2, btw.

Anyway, there are more problems around the corner. According to the Apple forum, people can't play Windows Media files, dual monitor support is very buggy, some buttons screw up the GUI when pressed down and dragged, loads of spontaneous lockups, random letters appearing everywhere, installation problems, parental control issues and more.

Also, I am not a big fan of customized GUI:s for crucial applications like a web browser. We should be able to use Windows ClearType instead of the ported OSX version (which sucks), and most importantly, we should be able to use the standard Windows themes. I don't get why Apple thinks the average Windows user would want a significantly altered browser that looks nothing like the rest of the operating system he or she is using. How would Mac users react if Internet Explorer was ported with the Windows theme?

I think it looks like a promising project, but I am worried because it's not in Apple's nature to release beta software with so many bugs and so little heart put into it.

Re:Alpha or Beta?

[falcon5768]

How would Mac users react if Internet Explorer was ported with the Windows theme?

Ask them, IE 5 WAS ported with the windows theme. It wasnt until Office X that the MBU started designing things more along the lines of the Mac ascetic but even then, you can tell its a windows program.

Re:Alpha or Beta?

[SpeedyDX]

How would Mac users react if Internet Explorer was ported with the Windows theme? If it's Internet Explorer, the theme would be the last thing I'd be worrying about.

Re:Alpha or Beta?

[cowscows]

I have no inside knowledge of any of Apple's plans, but I wonder if they didn't sort of rush the Safari for Windows beta release to quell a bit of the noise that some people have been making about the lack of 3rd party development for the iPhone. Along with this new version of safari, Apple announced today that the way to get your app onto the iPhone is through web applications, and safari is what the iPhone is going to be running. And I guess they decided to release Safari for windows now, just to show that they're serious about letting devs work on iPhone Apps.

Apple most likely wants as much free press about the iPhone as is possible as it gets closer to its release date, so why not get the dev community a little more excited. It sucks that this safari beta isn't quite ready, but safari is pretty well respected on the mac, so I have faith that it'll quickly improve on Windows.

Re:Alpha or Beta?

[bahstid]

No, no, no! Lynx has browser ascetic. You are thinking of aesthetic

Re:Alpha or Beta?

[thenerdgod]

The problem is you have either a) too many fonts or b) a corrupt font.

You'll have to install it on a fresh install of XP so it doesn't have more than the default fonts.

Then copy c:\documents and settings\[user]\local settings\application data\apple computer\safari\fonts.plist

to your main computer.

[shameless mac dig] Looks like those mac guys still think you should only have 256 fonts! losers!

Re:Alpha or Beta?

[MidKnight]

I don't get why Apple thinks the average Windows user would want a significantly altered browser that looks nothing like the rest of the operating system he or she is using.

Because IE6 and IE7 (and to a lesser extend Firefox) have more clutter than is necessary in the application header and toolbar. Safari on Windows certainly isn't the unusual in the sense that they have a custom widgets or layout; but at least they're doing it for a reason. In the Apple UI world less is more; especially when you're creating a browser for non-power users who just want to read the news and browse Amazon.com.

Seriously: one of the points Jobs made while introducing the browser is that Safari makes a significant effort to stay out of the way of the web pages it is displaying. That's why the icons are so simplistic, and the URL, tabs & bookmarks bar are (vertically) quite small compared to other browsers. To roughly quote the keynote, the browser shouldn't be the star of the show, the web pages should.

BTW, one of my favorite features already after fiddling around with it for an afternoon is the ability to drag a tab off of the tab bar to create a new window, and drag pages onto an existing tab bar to create a new tab. One of those intuitive UI features that other browsers haven't figured out yet. Also, I'm developing a JavaScript-intensive application at this point and can report that it is fast -- surprisingly fast -- compared to other browsers. I never really trust benchmarks of anything, but real application performance bears out the same results.

Re:Alpha or Beta?

[Phroggy]

Ask them, IE 5 WAS ported with the windows theme. It wasnt until Office X that the MBU started designing things more along the lines of the Mac ascetic but even then, you can tell its a windows program. As a long time Mac user, I can tell you that this is complete nonsense. Early versions of IE/Mac looked absolutely nothing like IE/Windows, which has always looked like complete crap by comparison. Later versions of IE/Mac added pretty translucent buttons in multiple iMac colors.

IE/Mac never looked or felt like a Windows app. It always felt like a Microsoft Mac app. (Remember that there have been Microsoft Mac apps since before there was Windows.)

Re:Alpha or Beta?

[KugelKurt]

> We should be able to use Windows ClearType instead of the ported OSX version (which sucks)

You mean that black letters on white backgroung actually appear as black letters on white backgroud sucks? You really prefer Windows' black-letters-appear-in-rainbow-colors technology? (http://upload.wikimedia.org/wikipedia/de/d/d4/Cle artype.png)
I tried Safari for Windows only for a very short time at a fried's house so I didn't experience any crashes, but at least the font rendering was way better than the ClearType stuff in IE.

Re:Alpha or Beta?

[Clockwurk]

of course if you actually look at the screenshot, the cleartype ß looks better than the top one.

Re:Alpha or Beta?

[DrXym]

Ask them, IE 5 WAS ported with the windows theme.

Well not entirely - IE 5 had a fruit flavoured theme to go with iMacs of the day, and the UI was distinctly Mac like. But Mac users have certainly gone batshit crazy over past versions of Office.

Windows users tend to be more levelheaded and / or apathetic. Instead of protesting, they'll simply ignore Safari altogether. The Safari 3.0 UI in Vista is awful - totally nonstandard in every respect. It's bad enough to have an Aqua-esque theme foisted into iTunes (at least most secondary dialogs paid some lipservice to the system theme) but it's even worse in Safari where everything picks up Aqua. The perverse part is that OS X apps call a theme engine to render widgets. So Apple must have ported the theme engine to Windows and hardcoded it into Safari rather than using the one in the operating system.

I really don't see any reason that Safari will take off on the Mac until it tries to integrate. Ironically the reason Safari succeeded at all on the Mac was because of Apple's dissatisfaction with Firefox & Camino (an OS X app using Gecko) for not being native looking enough. Now they're foisting a totally alien Safari onto another OS and expecting it to take off - it's not gonna happen.

Re:Alpha or Beta?

[dangitman]

Also, I am not a big fan of customized GUI:s for crucial applications like a web browser. We should be able to use Windows ClearType instead of the por

Well, firstly, there appears to be some bug with the Safari beta, possibly interacting with your Windows installation.

But Cleartype? Man, that sucks. The worst thing about web browsing on Windows is that text looks like shit. It would be nice to have a Windows browser that does decent text display. This is a huge problem where I work - where web pages are often viewed on a data projector screen for a large audience. Some projectors are hooked up to a Mac, some hooked up to a Windows machine. The output from Windows machines is uniformly terrible - which makes me wonder why they even bother using Windows on machines that drive projectors. In contrast, the Mac web browsers look great. So, if Safari on Windows (if it works) hopefully will provide a way to have a decent way of rendering web pages on large screens, and help us escape the misery of Cleartype and Internet Explorer.

Re:Alpha or Beta?

[Anonymous Coward]

Cleartype on Windows doesn't work on CJK fonts, while it works on Mac. Maybe that's a good reason enough to port the Mac version to Windows.

Re:Alpha or Beta?

[drew]

I don't get why Apple thinks the average Windows user would want a significantly altered browser that looks nothing like the rest of the operating system he or she is using.

I take it you haven't actually seen IE7 yet? Besides, somehow or other, they've convinced people to actually use iTunes on Windows, so maybe there is hope...

So many keep saying "but it's a BETA"

[lena_10326]

..."that you should expect bugs in a BETA"

Come on. You have to admit remote execution of any cmd is pretty bad even for a beta. This ain't your run of the mill bug, like a UI glitch or rendering type of bug. It makes the beta unusable and thus not a very useful beta. (Unless you're testing how your own trusted website looks under Safari.)

Re:So many keep saying "but it's a BETA"

[mabinogi]

Well the point of a Beta release is to increase the userbase so as to increase the amount of testing.

If they could guarantee they could get the security bugs out before releasing a Beta version, then they'd be able to guarantee they could get all the other bugs out too, so then it wouldn't be a Beta release, but a final release.

You just have to accept that if a company has said "this is a beta release, it will have bugs", that it will have bugs - all types of bugs, not just "safe" bugs. Also, the severity of the effect of a bug has no correlation with how easy it is to locate.

People have become way too complacent about trying beta quality software these days. Don't try it if you don't want to take the risk.

Re:So many keep saying "but it's a BETA"

[lena_10326]

Well the point of a Beta release is to increase the userbase so as to increase the amount of testing.

Yea. Increase the userbase. Of course, they just did the opposite and scared them away. Lesson here: never show your unfinished work. A first impression only comes once.

You just have to accept that if a company has said "this is a beta release, it will have bugs", that it will have bugs - all types of bugs, not just "safe" bugs.

A bug that lets any old script kiddie put up a page that can execute del /S c:\* on my PC is beyond the level of anyone's expectation of a bug. Why would I bother with Safari now? Sure. They'll release another, new, improved beta... bug free, but will I trust them?

No.

Even with a free beta I have a reasonable level of expectation. That the program not destroy my machine with basic usage. That the program not allow remote execution. That the program provide some core functionality as advertised. This version of Safari is well below those expectations.

Re:So many keep saying "but it's a BETA"

[mabinogi]

If your faith is so easily shaken, then don't install beta software.
Wait until the bugs have been found, and install the final release.

A bug is a bug, and there's nothing special about security related bugs that makes them easier or harder to find than non security related ones, so as I said before, a company cannot guarantee that a product will have no security bugs unless they can guarantee that it will have no other unknown bugs. Obviously they can choose to fix the security bugs over the non security ones, but as long as there are bugs they have not discovered, then those undiscovered bugs can be security related. That's just how it is, and no amount of whining will change that.

Re:So many keep saying "but it's a BETA"

[dhavleak]

Dude!

a company cannot guarantee that a product will have no security bugs This is true and applies to the beta, and even to the final release. But that's the only thing you got right.

• In general security bugs _are_ harder to find than other bugs - they're right up there with multithreading related bugs as being the bloody hardest to find (threading/timing related bugs are actually worse because once you find the symptom, you could still be hours/days away from knowing the cause (the bug itself)
• This still doesn't change the fact that there are standard attack vectors that must be tried, code audits, best practices that must be followed to avoid coming up with a product that is, basically, insecure
• The number of remote execution bugs (4) found within 24 hours (within 8 to be precise) of the announcement indicate strongly that these practices have not been followed. Does this remind you of a certain other company? It should!

Re:So many keep saying "but it's a BETA"

[lena_10326]

If your faith is so easily shaken, then don't install beta software. Wait until the bugs have been found, and install the final release.

First. I refuse to have faith when the fatal flaw involves an extremely simple usage of protocol handlers, which would be the first thing to test when testing for security.

Second. When Apple posts a direct link to one of its flagship applications on the main page of its website (http://www.apple.com), do you really expect people to understand what a beta is? It's called a beta, but it's not being treated as a beta. With normal betas, a small subset of the userbase will install, test, and use the app. Betas aren't supposed to be marketed with such fanfare. The entire point is to quietly release the beta to permit the beta testing to occur; it's not to push the app to the masses. Apple is advertising this "beta" to everyone and anyone: power user, casual user, grandma user, idiot user, manager user, etc (in order of decreasing acuity). You may know what "beta" means, but your uncle Vince who just completed a course at the public library titled "Learn the Internet 101" does not.

a company cannot guarantee that a product will have no security bugs unless they can guarantee that it will have no other unknown bugs.

Code quality is measured by bug density: bugs per thousand lines of code. Finding several severe bugs right off the bat is indicative of a fairly high bug density. Lowering bug density involves testing: black box, and white box. Apparently, Apple's idea of testing appears to be letting Dan the marketing guy give it a spin for a couple hours because he's the only one with a non-development Windows desktop. I can hear it now: "Hey, it checks out with Dan, let's PUSH the code!"

This whole thing smacks of a lack of respect for the target platform: Safari on Windows. A lack of respect for the product converts to a lack of respect from me for Apple.

That's just how it is, and no amount of whining will change that.

The only ones whining here are the Apple supporters who have long enjoyed bashing Windows users/supporters over the head with security related taunts. I think the only reason the Apple zealots are getting so upset is because this is another chink in Apple's armor. Meanwhile, the rest of us are criticizing Apple for very good reason--that this is the result of sloppiness and carelessness for the consumer.

Apple users: get used to this. Increased popularity means increased scrutiny.

Btw, criticism != whining.

Re:So many keep saying "but it's a BETA"

[glesga_kiss]

Btw, criticism != whining.

In truth, criticism != negative criticism. You can give something positive criticism, the word isn't biased either way even though it is commonly misused as such.

Re:So many keep saying "but it's a BETA"

[mok000]

I have been a loyal Safari user ever since the application came out. I have enjoyed it's speed and the many cool features that have since become commonplace in most browsers.

However, recently I finally gave up and moved to Camino. I got tired of the frequent Safari crashes, the many websites where you have to use Camino anyway because Safari doesn't work with them, and --in this case the most important point-- the nagging feeling that Apple was not doing a thing to improve Safari.

Now we know why. They have pulled their forces to make a version of Safari for Windows. Dumb move, when work is so desperately needed on the Mac version, and everybody knows that Windows users hate programs with a Mac interface.

As a Mac user, I am disappointed with Apple. I expect them to do work for me and not for the Windows crowd. And I'll stick with Camino.

Re:So many keep saying "but it's a BETA"

[Anonymous Coward]

the nagging feeling that Apple was not doing a thing to improve Safari.

What a retarded statement. The effin nightly builds have been freely downloadable for months, so any "nagging" feeling could have been easily dissuaded.

Re:So many keep saying "but it's a BETA"

[Makali]

A bug that lets any old script kiddie put up a page that can execute del/S c:\* on my PC is beyond the level of anyone's expectation of a bug [...] I have a reasonable level of expectation. That the program not destroy my machine with basic usage. That the program not allow remote execution. But Windows and IE does both those things almost monthly, out of beta. These aren't outside of the level of expectation for Windows usage at all. What was that statistic again; leaving a PC alone for 12 minutes average before a freshly-installed copy of Windows gets infected with adware/spyware through the use of remote execution flaws in the OS? That's not even enough time to download critical updates. And that's not even beta.

I'm not making excuses; the Safari beta's flaws are atrociously bad, but you appear to have a double standard here. I think the saddest thing about the whole story is that Safari on Windows is "business as usual" as far as security is concerned; it's certainly no worse.

Re:So many keep saying "but it's a BETA"

[BlueTrin]

Before to make an open beta, they probably had an alpha, they should include the guys who searched for security bugs in their next alpha ...

Security bugs in an open beta has the potential like you said to ternish their Corporate Image and for a company like Apple Corporate Image is one of their best assets. ALthough the effect of this news will be relatively small since Joe and other casual users will never hear of this one, imagine if some huge security bug was found on a product related to the Ipod or one of their best sellers ...

Re:So many keep saying "but it's a BETA"

[VGPowerlord]

Second. When Apple posts a direct link to one of its flagship applications on the main page of its website (http://www.apple.com), do you really expect people to understand what a beta is? It's called a beta, but it's not being treated as a beta. With normal betas, a small subset of the userbase will install, test, and use the app. Betas aren't supposed to be marketed with such fanfare. The entire point is to quietly release the beta to permit the beta testing to occur; it's not to push the app to the masses. Apple is advertising this "beta" to everyone and anyone: power user, casual user, grandma user, idiot user, manager user, etc (in order of decreasing acuity). You may know what "beta" means, but your uncle Vince who just completed a course at the public library titled "Learn the Internet 101" does not.

It doesn't help that the definition of beta has become muddles over the years.

When I learned the stages of software development, it went something like this:

alpha - Code that doesn't compile or runs incorrectly. Alpha testing is literally checking to see if the code compiles and runs as expected, done by the developers themselves.

beta - The code works now, but there may still be major bugs. A small group of internal testers try it and report any bugs they find. This is now called "closed beta" by MMO developers or "alpha" by the Mozilla team.

gamma - The code works and most major bugs are fixed. The code is released to a large group of testers to find any remaining issues. This is now called "open beta" by MMO developers and "beta" by everyone else.

delta - The finished product. Only maintenance releases are done at this point. New features and major bugfixes are done on the next release. This is called "beta" by Google.

So... it sounds like Apple really does have a beta in the old meaning here, but released it to a large group of people.

Re:So many keep saying "but it's a BETA"

[Zelos]

Why would I bother with Safari now?
This is modded 5, Insightful? If you took that attitude you wouldn't use any software, certainly not IE, Firefox and not Windows.

Re:So many keep saying "but it's a BETA"

[Anonymous Coward]

Hey fucktard.

they have 2 WEEKS to get his bug tested by all the people out there running their thousands and thousands of totally awesome windows applications, plugins, anti-spyware apps, virus scanners, etc.

They need all the feedback they can get.

Last I checked, this feedback doesn't get to them when you post it to slashdot from your mom's basement.

Re:So many keep saying "but it's a BETA"

[Anonymous Coward]

Furthermore, there exisits a subset of criticism, which is also a subset of whining.

So just because you're criticising, it doesn't follow that you're not also whining.

Re:So many keep saying "but it's a BETA"

[illumin8]

alpha - Code that doesn't compile or runs incorrectly. Alpha testing is literally checking to see if the code compiles and runs as expected, done by the developers themselves.

beta - The code works now, but there may still be major bugs. A small group of internal testers try it and report any bugs they find. This is now called "closed beta" by MMO developers or "alpha" by the Mozilla team.

Your definitions of alpha and beta are pretty flawed. Alpha software is software that is in development that is not yet feature complete. Beta software is software that is finally feature complete, but not yet stable enough for release. There is a big difference, but the main difference between alpha and beta is whether the program is "feature complete" or not. The features don't have to all work, and betas are expected to have problems, but the features should all be there before software moves from alpha to beta.

Re:So many keep saying "but it's a BETA"

[Anonymous Coward]

Second. When Apple posts a direct link to one of its flagship applications on the main page of its website (http://www.apple.com), do you really expect people to understand what a beta is? You mean like Google and GMail?

Re:So many keep saying "but it's a BETA"

[Altus]

Ive got to disagree with you there. Alpha software should be feature complete and buggy as hell. When you get down to only minor bugs you should be calling that beta. Of course the optimum and it shouldn't be surprising to find major bugs in beta at all. But if your still coding up features in alpha your beta product might have more bugs than your alpha one did. Whats the point?

That said. This is my perspective from the inside. When im dealing with someone elses beta I assume it will wipe my hard drive. Don't run pre-release software unless you know what you are doing and are willing to suffer the consequences.

Re:So many keep saying "but it's a BETA"

[lena_10326]

I'm not making excuses; the Safari beta's flaws are atrociously bad, but you appear to have a double standard here.

You haven't heard my criticism of Windows. However, you mentioned "freshly installed", which is an unpatched machine. A patched Windows machine running a firewall is a lot more secure than this particular version of Safari on windows. I don't think it's a fair to compare the latest version of a browser with an unpatched operating system who's last major service pack is 3 years old.

But Windows and IE does both those things almost monthly, out of beta.

And they get a lot of flak for it.. don't they?

Re:So many keep saying "but it's a BETA"

[jsepeta]

>> Well the point of a Beta release is to increase the userbase so as to increase the amount of testing.

> Yea. Increase the userbase. Of course, they just did the opposite and scared them away. Lesson here: never show your unfinished work. A first impression only comes once.

Well if we consider that Windows 1.0, 2.0 and even 3.0 were basically beta-like in their nature (previews of what a mac-like gui would be for owners of intel hardware), enough users were drawn to Windows even though these early versions were pretty ass-tastic. Not until Windows 95 did Microsoft start producing software that was stable, pretty, and functional. [Word 4 & Excel 3 on the Mac were stable and functional, but fairly unattractive.]

Re:So many keep saying "but it's a BETA"

[Sithgunner]

Also, when simple browsing doesn't work, you don't really call this a so called 'BETA'.
I'd say, developer reference version, more than end user alpha version.

Multi lingual capability is totally dropped since if a web page has Japanese font, nothing displays. Total blank.
Too bad Apple had to show the quality of 'BETA' this way... but it was just too early, but I guess WWDC can't wait.

It's nice that they're offering an alternative

[Anonymous Coward]

But I won't be trying it since other Apple products like iTunes and Quicktime still run like crap on Windows.

Thanks but no thanks.

Re:It's nice that they're offering an alternative

[Tatsh]

iTunes and QuickTime both do dumb things on Windows, like run extra services (iPod service, iTunes service) and add Run entries (who the hell needs QuickTime in the tray??????!!!!!!!!!!).

When you install Safari, it asks if you want to install Apple Software Update and Bonjour extras. I deselected both. It seems Safari is extremely stand-alone in comparison to iTunes and QuickTime. At least it doesn't add a Run entry or services.

Another hackable part of Safari/Windows

[Bri3D]

Apple includes CoreFoundation.dll and CoreGraphics.dll, which have the same exports as the OSX frameworks.
Therefore it's possible to use the OSX CoreFoundation and CoreGraphics headers to link to the Windows DLLs natively and create native Windows "psuedo-OSX" apps.
I believe CoreFoundation.dll has been around with WebObjects for Windows NT for a while, but I think CoreGraphics.dll is a new Apple "release" (I remember some anger over Apple not porting CoreGraphics when WebObjects/NT first came out).
I've documented some of what I've poked around today (just a screenshot and simple description for the moment) at http://pages.brianledbetter.com/

Re:Another hackable part of Safari/Windows

[Anonymous Coward]

your "proof" consists of a screenshot of an irc session in which you claim it works. Try again.

Re:Another hackable part of Safari/Windows

[BlueGecko]

Close. OpenStep for Windows NT made available FoundationKit and AppKit, which are the two major Objective-C frameworks of OS X and the core of Cocoa. They continued to be available on Windows through early versions of WebObjects 4, but are no longer available in any way from Apple. These are two of the frameworks that the GNUstep project aims to clone, with varying degrees of success.

CoreFoundation and CoreGraphics are APIs that were new in OS X. CoreFoundation is an object-oriented C-based API designed that parallels FoundationKit class-for-class. Although it's been (partially) available on Windows in the form of CF-Lite (http://developer.apple.com/opensource/cflite.html ), it never shipped with any version of WebObjects. CoreGraphics is the technical name for what Apple marketing calls Quartz, and is Mac OS X's low-level C-based drawing API. This is the first time, as far as I know, that it's been available on Windows, though iTunes 7 probably uses it statically linked.

Re:Another hackable part of Safari/Windows

[Bri3D]

Do you not know how to scroll to the right?
Or you could just, you know, try it yourself, since it's quite easy and I've documented how to do it.
Nice troll.

Re:Another hackable part of Safari/Windows

[Anonymous Coward]

your "documentation" consists of "get the header files, remove some of them, ???? screenshot" Nice try, troll.

Re:Another hackable part of Safari/Windows

[larry bagina]

Core Foundation (lite) is (and has been) Open Source.

Re:Another hackable part of Safari/Windows

[Anonymous Coward]

There's also Cocotron, which is in a different state from GnuStep - the project difference is GnuStep is aiming for OpenStep while the longterm goal for Cocotron is a cross-platform re-implementation of Cocoa. Always surprised there's less interest in these projects from 'the community' given the frequency with which people talk about wanting OS X apps on Windows / Linux.

gives a new meaning to:

[Anonymous Coward]

bugs on a safari trip.

Raping Infants To Death HOWTO by Scott Lockwood

[Anonymous Coward]

ror?

It's crap

[MSBob]

I just installed it and fired it up on XP. Resizing the browser window takes 4 seconds on a 3 GHz P4 with 1 Gig of Ram. I am not joking. In terms of UI sluggishness nothing beats apple software. Not even Java Swing. It's absolutely horrendous. Save your selves the trouble and skip this browser. Truly nothing to see here.

Re:It's crap

[AKAImBatman]

Why don't you try giving it a chance to load? On my computer it's slow for the first 30 seconds, then speeds up. Presumably this is because it's still background loading all the features, menu items, graphics, etc. A final release would presumably have this load time either hidden behind a splash screen or optimized away.

Re:It's crap

[lena_10326]

Hmm. I found it to be rather speedy on XP. On a lowly AMD 1.1 GHz with 1GB RAM. Fully patched.

If not for the super thin 1 pixel wide left and bottom window edges; the resize issue as you and others mentioned; the very poor font smoothing that I could not turn off; and, these security problems, I'd have given it a fair chance over the coming week.

Re:It's crap

[KarmaMB84]

Well, with my slower CPU it just barely lags behind the mouse when I resize the windows. Perhaps it's a graphics driver/card issue on your machine.

Re:It's crap

[Tatsh]

I ran it in XP in a virtual machine (VirtualBox) and it seemed pretty good. I'm glad Apple chose to keep the UI pretty much the same as OS X. And the interface in the options screens are the same as well. I would not be surprised if more people switched solely because Safari is very visually appealing. There are themes for Firefox to look similar to Safari, but nothing beats a true port.

I'll definitely be using this for development purposes.

Re:It's crap

[Anonymous Coward]

hidden behind a splash screen

I really hate that so many programmers think they can "hide" ridiculous loading times behind a splash screen. This is extremely prevalent amongst Java programmers. It's a web browser... it shouldn't have to "hide" loading times.

Re:It's crap

[Anonymous Coward]

'true port'! You're kidding, right?

None of Apple's software on the Windows platform are considered 'good'. I am sure Safari is going to be no different even when the final version is released.

Maybe I need a tinfoil hat...

[AikonMGB]

... but the first thing that I thought of was that here you have an app (Safari) that works perfectly fine on Macs; as soon as it gets ported to Windows, BAM, instantly full of vulnerabilities. Would Apple go so far as to break their own product to deface an opponent in the OS arena?

Aikon-

Re:Maybe I need a tinfoil hat...

[ibentmywookie]

That would just make Apple look bad, not windows. Apple software on windows has to shine, otherwise people will get turned off them and will never bother trying a Mac.

Re:Maybe I need a tinfoil hat...

[theantipop]

Not when they have so much to gain through widespread adoption of their browser. Apple released Safari multiplatform so developers would be more confident developing with Safari support in mind. Undermining MS isn't worth the potential loss of revenue this move could bring in.

Re:Maybe I need a tinfoil hat...

[Anonymous Coward]

This is version 3; it's new for both platforms. It's not a port of the current production release 2.0.4.

Safari or Windows vuls?

[BRSloth]

I wonder how many of those vulnerabilities are actually Safari/KHTML code and how many of those are Windows vulnerabilities.

IIRC, Firefox had that "URL protocol handler command injection" vulnerability (or something around those lines, correct me if I'm wrong) a few years ago and FF developers said it was the way Windows handles protocols. In the end, they had to change the way URLs are handled inside FF to prevent Windows from catching it.

Re:Safari or Windows vuls?

[argent]

OS X has the same problem.

http://www.scarydevil.com/~peter/io/osx-security.h tml

(and several other notes on http://www.scarydevil.com/~peter/io/ )

As I noted in my comment on larholm.com, this is a long running design flaw in both ahem-mainstream-ahem operating systems. It's really not safe for any browser or other application to trust LaunchServices *or* Windows protocol handler database. The handlers that are suitable for a desktop environment are not generally the ones you want to use from untrusted documents.

Re:Safari or Windows vuls?

[Anonymous Coward]

do you even take actual time to think about what you're going to type?
u can never blaim the OS for a malfunction in your application when you have others that do the exact same thing that your application does...and they have NO PROBLEMS.It's always the application developers fault.
And yes all the bugs mentioned above are Safari bugs.Don't put windows in this one.We have quite a few browsers on windows and they have none of these bugs.
Next time take a minute to think...and if you're going to write a fan based message type:
"i can't believe they didn't take 5 freaking minutes to do actual beta testing before making this software public".
And then wonder how many times they did this in mac os x.And then be afraid that these discoveries don't make ppl start poking into mac os x like they do into linux and windows.

Re:Safari or Windows vuls?

[DrXym]

Why would any of them be Windows vulnerabilities? The only way they may possibly be is if Safari used IE's http / https URL handlers, or exposed other Windows protocols via the browser, or used the JScript engine for evaluating content, or used the OS call for decoding Jpegs/PNGs. It strikes me as being extremely unlikely that it would do any of this. It already has code for all these things and turning it off to use the archaic and often poorly documented IE / Windows equivalents doesn't make much sense.

It's possible that Safari uses the NPAPI for hosting native plugins, but the NPAPI tends to be quite secure. I don't know if Safari supports plugin scripting (via Safari's equivalent of XPCOM) but that might also expose it to something.

Re:Safari or Windows vuls?

[Bob of Dole]

Windows has a URL handler system for a reason. The idea being that a browser sees a url like foobar://blah, knows it can't handle foobar:// links, so it asks windows if it can. Windows has a list of scheme to program mappings, and if the browser see another program can handle that URL it'll pass it off to that program.
This is useful for programs like windows media player (with those mms:// links) or aim, or setting up a web-based lobby for a game (the game can register gamename:// and you can use your browser to launch the game)

The problem is that this makes the browser a way to exploit security holes in those other programs. And for some of them it's not even really a hole, it's just a complete lack of security.
(Windows exports the shell:// handler, which open programs)

So you either have to turn off URL handlers ("why doesn't windows media player work in your crappy browser? I'm going back to IE") or try to figure out which handlers are secure and whitelist/blacklist handlers. (which is what IE and firefox do)

Re:Safari or Windows vuls?

[DrXym]

My point is that there are well known urls - http, https, ftp, file, gopher, javascript, about, mailto etc. that all browsers should handle internally. IE / Win32 implements them via protocol handlers which are COM objects. So a browser could if it wanted instantiate one of IE's protocol handlers via COM. It is also possible to open a stream from a random URL via an internet moniker (another COM object primed with a URL) and then start reading data. But there is no reason that they would either of these things. Safari, Opera, Firefox all have their own impls of these protocols and really have no reason to call out to the IE impl - it doesn't make sense unless Safari took a shortcut for some reason.

Then there are protocol handlers that are IE specific, e.g. ms-help that also reside in the registry and are available via COM. But why would Safari be bothered with those either?

Then there are mime types that are registered to launch external apps. All browsers should support these, assuming for Firefox, Opera & Safari that the mime type is not handled internally and there is no NPAPI plugin available to handle the content. For example if I click on an application/vnd.oasis.opendocument.text it might launch OpenOffice (with the appropriate warnings). I don't see why launching these should be harmful to Safari and not Firefox unless Safari is not checking some registry key or blacklist to ensure they are safe to launch.

Irrespective, I don't see any obvious way to blame Windows because of a vuln that shows up in Safari. Perhaps there is one but it isn't obvious to me.

I've found some bugs, too..

[the_rajah]

The http://wunderground.com/ site has multiple functions that cause a MS error message, which I don't allow to send information to MS, and then it closes the browser. I used the bug report feature in the browser when I restarted it.

Non security bugs

[Anonymous Coward]

Seems to disappear when I maximize it on my second monitor. Lets see if reporting bugs via the menu actually works.

It is also pig slow, hopefully because it is a debug build.

GOD HELP US ALL!

[milatchi]

bugs in the Windows version of Safari mere hours after it was released. 4 DoS bugs and 2 remote execution vulnerabilities, a URL protocol handler command injection vulnerability that allows remote command execution.

GOD HELP US ALL!
Then again, it is a beta.

Beta

[hanju]

Ummm. It's beta. or didn't you notice that.

not safari specific

[Anonymous Coward]

the command exploit is actually due to inherent problems with the gopher protocol, not safari's handling of it. IE had the same problem (MS eventually removed gopher support entirely to fix it). Firefox/mozilla/netscape had the same problem (they now run a url sanitizer which breaks some legal urls, but nobody uses gopher anyhow). Despite his claim contrary, the bug is in windows/firefox's handling of command line arguments. Yeah, apple could sanitize it or disable gopher altogether.

Re:not safari specific

[KarmaMB84]

The bug is that you can use Safari to run commands AT ALL not that you can execute Firefox and exploit gopher.

It's a BETA

[Dragon of the Pants]

This is completely outrageous. Betas aren't allowed to have bugs! For the love of God they could ruin us all!

Re:It's a BETA

[Anonymous Coward]

The seriousness and amount of the bugs suggest that this software is Alpha quality, at best.

shooting the messenger is now + 5 insightful?

[siddesu]

Wow, a company releases a product that puts their customers in danger, and boo-hoo, the fanbois go after the whistleblowers. How about the professionalism of Apple developers/testers/managers?

Re:shooting the messenger is now + 5 insightful?

[ceoyoyo]

They release a beta of a free product, the engine of which (and almost certainly where these bugs are located) is open source, and this "security researcher" finds a bug and refuses to report it. Deep throat he's not.

Re:shooting the messenger is now + 5 insightful?

[siddesu]

correctamundo.
so then it is better that people don't know what's in for them when installing it, right?
or you sincerely believe most folks that install stuff know what they are doing?

Re:shooting the messenger is now + 5 insightful?

[iluvcapra]

or you sincerely believe most folks that install stuff know what they are doing?

That is the responsibility they undertake, yes. They may or may not understand all the ins and outs, but it's their responsibility.

so then it is better that people don't know what's in for them when installing it, right?

Based on the blog posting, they STILL don't know what's "in for them," since the vulnerabilities are still undisclosed. They remain in Maynor's to do list, for sale to the highest bidder for all we know.

If you're a linux or MS supporter, don't waste your breath defending this guy. He wasted a year of everybody's time on that Airport vulnerability that didn't exist.

Re:shooting the messenger is now + 5 insightful?

[ResidntGeek]

Actually, that's quite like Deep Throat. He worked on deep background - never volunteering information, only confirming it for Woodward, who wasn't allowed to print any of his information or count him as a confirmation. And much of Deep Throat's information was along the lines of "Man, these guys are dicks. I don't like them. They did lots of stuff, good luck and have fun finding it all, bro!"

Re:shooting the messenger is now + 5 insightful?

[ceoyoyo]

I didn't say he shouldn't report that there's a bug, I said that he should report the bug to Apple. The beta agreement probably requires that he do that, actually.

And if you're installing a beta then yes, you really should be aware that you're in for some bugs. It's very unfortunate that Google has diluted the meaning of "beta" so much.

Also note that he's not really failing to report a bug to Apple, he's failing to report it to the webkit/khtml open source project. I doubt very much the bugs are in Apple's closed source GUI front end to webkit.

Re:shooting the messenger is now + 5 insightful?

[Fordiman]

I doubt URL handling is part of the KHTML/KJS renderer; responsibility for acquiring content in Konqueror is done in KIO, so Apple would have had to implement their own content acquisition scheme.

It is possible that the stack failure is in (KHTML/KJS)/WebKit - but as it's not been shown that these bugs apply to either Konqueror or Mac Safari, it's most unlikely that the stack failures are the result of the open portion of the code.

Anyway, as a news story, this is a null set; it's a public beta. It's there for the public to test it and report bugs. It's not a production browser.

I'd be curious, however, to see if these bugs are Windows-only (for example, Mac OS-X and KDE have a URL handling scheme built into the OS that wouldn't be available in Windows; it would need to be implemented as part of Win Safari), or if they apply equally to Windows and Mac.

Re:shooting the messenger is now + 5 insightful?

[sitharus]

It's not present on Mac Safari, though the demo page does crash the Safari 3 Beta.

The main thing is how the URL handling works, under Windows Safari passes the URL to the Windows URL handler, which just finds the application and then dumps the rest on the command line, which gives many remote execution issues. Under MacOS the MacOS URL handler finds the application, and then dispatches an OpenURL AppleEvent (I think, similar to that anyway) towards the application, which then has the responsibility of parsing and loading the URL.

I'm guessing that the engineers didn't look too hard at how the OS deals with URLs and just assumed it would be safe.

Re:shooting the messenger is now + 5 insightful?

[siddesu]

so now the responsibility for a product distributed by a company is with the "opensource community" as well?

Re:shooting the messenger is now + 5 insightful?

[Fordiman]

Offtopic:

I, like a lot of other web developers out there, wanted Safari for the purpose of adapting web pages to Yet Another Popular Browser's bugs.

So, what did I find when I downloaded Safari? The ridiculously useful debug menu was gone!

Now, all the docs on how to enable it are for Safari on the Mac, understandbly. What to do?

Kill Safari

Open C:\documents and Settings\[You]\Application Data\Apple Computer\Safari\Preferences.plist

Add, in what appears to be the logical place: IncludeDebugMenu1

Load Safari. Now developer-useful things like the Javascript Console are available to you.

Re:shooting the messenger is now + 5 insightful?

[Fordiman]

Slashdot stripped my XML. The line to add is, IncludeDebugMenu1

Re:shooting the messenger is now + 5 insightful?

[Daengbo]

It's very unfortunate that Google has diluted the meaning of "beta" so much.
It's very unfortunate that the rest of the industry (especially MS) has diluted the meaning of "gone gold" so much. Gold is the new beta; beta is the new alpha.

Re:shooting the messenger is now + 5 insightful?

[Anonymous Coward]

Stop sucking Gruber's cock.

Re:shooting the messenger is now + 5 insightful?

[Sparks23]

No. But put it this way...

Let's say there's something built atop an open source library. Hey, there's plenty of them out there... let's pick OpenSSL as an example. It's open source and it's used in other projects, some of which are commercial or proprietary systems. Now assume that some company makes a proprietary, closed product built on that project as the core, but continue to contribute changes -- a heck of a lot of changes -- back to the original project as the develop. And then they release this as a beta.

Finally, let's say that someone finds a vulnerability in the proprietary project, a security issue with implications for the open source project. And instead of reporting the vulnerability to the proprietary folks (who would probably promptly generate a patch for both their tool and the underlying library, the person refuses to report the vulnerability to anyone and just says 'I found vulnerabilities, but I'm not telling you what they are.'

That's basically how WebKit/KHTML and Safari are tied together. Safari's just a UI atop an open source framework, WebKit, which Apple is the primary contributor to but which other people also contribute to, and which other projects (besides Safari and OS X) use. WebKit is used on Symbian OS, on Linux, and various other operating systems. And this guy is claiming to have found vulnerabilities which, given where they occur, seem to have implications for WebKit as well as Safari... and is refusing to give the details to either Apple, or to the WebKit development community.

You don't have to be an Apple 'fanboi' (or fangirl) to see that's not the way to handle security disclosures. If someone found several bugs in Firefox and said 'ZOMG I can crash Firefox or anything which uses the Gecko HTML engine. I can do it 100% of the time. But I'm not going to report the details to the Firefox team, so, nyah!' people would be up in arms about it.

Professional, good security researchers report things to the responsible parties, giving them the details necessary to fix it. Going, "Ha ha, I found a way to break your stuff but I'm not going to tell you how" is not only unprofessional, it's just downright immature.

Sure, lambaste Apple for releasing a beta/preview of something with bugs if you feel you must. But, please, don't bother trying to defend someone who basically makes a mockery of the entire security field.

Re:shooting the messenger is now + 5 insightful?

[Anonymous Coward]

I'm an avid Linux supporter, but I still think he's an arsewipe. He has to be the most unethical moron on the planet. For all we know the bugs are just another hoax to try and make this media whore look like somebody important. The amusing thing is that this is a BETA product. Let's see... beta's... wait, there's something about them... ummm... they are products for... ummm... TESTING. ZOMG! WHAT ARE BUGS DOING IN A PRODUCT THAT'S MEANT TO BE TESTED!!!111 I say - M$ fanboys, go get a clue - Linux fanboys, stop making linux users look as bad as the Mac zealots - Mac users, stop acting smug, pride comes before a fall.

Re:shooting the messenger is now + 5 insightful?

[siddesu]

releasing software with remotely exploitable bugs to the general public to the fanfare of the press (release of safari is in all major news) by a large company is surely a more irresponsible act than a bug report about the said software.

Re:shooting the messenger is now + 5 insightful?

[loganrapp]

So, because the company's more stupid, that means the guy not reporting vulnerabilities is set free?

That's pretty much the equivalent of letting a guy who stole from someone go free because the victim shot someone else.

Re:shooting the messenger is now + 5 insightful?

[lena_10326]

So, what did I find when I downloaded Safari? The ridiculously useful debug menu was gone!

I'm betting it's disabled to avoid frivilous bug reports. Some people will assume javascript error messages are caused by Safari bugs rather than scripting bugs.

Re:shooting the messenger is now + 5 insightful?

[siddesu]

no, really, it is the other way around and we should, of course, let companies that release software with risky bugs off the hook, and tramp onto people who report those bugs.

both sides are at fault here, but the fault of the company that releases vulnerable software to the media fanfare is way bigger than the problem of the nobody who alerts the general public to the fault.

Re:shooting the messenger is now + 5 insightful?

[Jerry Smith]

Is it also disabled on OSX? Didn't check it at home, and at work no Mac present for beta purposes.

Re:shooting the messenger is now + 5 insightful?

[Anonymous Coward]

Did they strip your Preview button too?

Re:shooting the messenger is now + 5 insightful?

[hdparm]

Right, majority of windows users in particular...

Re:shooting the messenger is now + 5 insightful?

[aycaramba]

Of course shooting the messenger is now +5 insightful, everyone here has seen the movie 300.

Re:shooting the messenger is now + 5 insightful?

[Nullav]

Or how about everyone stop treating their choice of operating system as a religion? Hmm?

Re:shooting the messenger is now + 5 insightful?

[Asgerix]

That's a nice way to get karma! If you post a comment that you suspect is going to be modded insightful, remember to include some errrors, so you can post a correction and get some more positive moderation for the second comment! ;-)

(...waiting for this comment to be modded insightful)

Re:shooting the messenger is now + 5 insightful?

[digitig]

You don't have to be an Apple 'fanboi' (or fangirl) "Fangrrl", please!

Re:shooting the messenger is now + 5 insightful?

[lisaparratt]

Sorry, which bit of World Wide Developer Conference are you having problems with?

Re:shooting the messenger is now + 5 insightful?

[Funkcikle]

Of course shooting the messenger is now +5 insightful, everyone here has seen the movie 300.

THIS IS SLASHDOOOOOOOOOOOOOOOOOOOOOT!

Re:shooting the messenger is now + 5 insightful?

[Anonymous Coward]

http://erratasec.blogspot.com/2007/01/disclosure-e thics-apply-to-both-parties.html
up yours, fanboi :/

Re:shooting the messenger is now + 5 insightful?

[FreakyLefty]

remember to include some errrors, so you can post a correction and get some more positive moderation for the second comment

So when are you coming back for your second dose of moderation? Or do I get to steal them because I beat you to it? Informative surely *fingers crossed* :-)

Re:shooting the messenger is now + 5 insightful?

[aztracker1]

Not that I support certain portions of the patriot act... But I wonder if this guy is a U.S. resident, and if so, if this can be considered an act of terrorism. I mean he isn't causing panic in the streets, but he is causing a lot of, most likely unjustified concern without proper disclosure. (This is not meant to be a troll).

Re:shooting the messenger is now + 5 insightful?

[NemosomeN]

I think the company you're looking for is Mirabilus. Mirabilus diluted the meaning of Beta. Thanks for playing.

Re:shooting the messenger is now + 5 insightful?

[peragrin]

not to be mean but
  It's a friggin BETA!!!!!

it's supposed to have bugs in it.

besides it's not like IE where the bugs are in the shipping version and part of it's core design.

Re:shooting the messenger is now + 5 insightful?

[Anonymous Coward]

I'm guessing that the engineers didn't look too hard at how the OS deals with URLs and just assumed it would be safe.

I distinctly recall reading on Slashdot about a pretty similar URL handling flaw in Firefox. And I'm not paid to know about web security. You'd think the developers would at least spend a week to review what has happened in the rest of the browser world.

Re:shooting the messenger is now + 5 insightful?

[Fred_A]

Or how about everyone stop treating their choice of operating system as a religion?

What do you mean it's not a religion ? Why did that bearded guy insist that I attend the "Church of GNU" every sunday then ?

Re:shooting the messenger is now + 5 insightful?

[Name Anonymous]

releasing software with remotely exploitable bugs to the general public to the fanfare of the press (release of safari is in all major news) by a large company is surely a more irresponsible act than a bug report about the said software. Then releasing, Linux, Windows, and a heck of a lot of other software these days is irresponsible. If Aple did not know these bugs existed, thenthey ar enot at fault at all for releasing it.

And to add to that, we have no proof these are real bugs. Right now it's hot air from someone who has made false claims before (WiFi on the Intel Macs) and won't say what is broken. Until he actually tells Apple or the WebKit/khtml folks what the bugs are, there is no proof they are real. For example, how many exploitation bugs have been found in Windows Vista since its release? And remember the Safari on Windows is a beta release so is not expected to neccessarily be totally bug free.

Re:shooting the messenger is now + 5 insightful?

[TheVidiot]

..because if he is not American, it's not terrorism, right? If not a troll, I hope this was a joke.

Re:shooting the messenger is now + 5 insightful?

[aztracker1]

If he's at least in America, he might be prosecutable under the patriot act was all I was getting at. It pretty much is terrorism imho..

Re:shooting the messenger is now + 5 insightful?

[Anonymous Coward]

THANK YOU! I'm reading all this crap and you've brought me back - they're SUPPOSED to be morons!

Re:shooting the messenger is now + 5 insightful?

[Anonymous Coward]

Don't listen to him he is a shill for DRM. Fucken tool!

Re:shooting the messenger is now + 5 insightful?

[Asgerix]

Damn, I hadn't thought about that.
Hmm... maybe if I made the error less obvious? Or more personal?

By the way, did you know that my dog is called Safari?

Re:shooting the messenger is now + 5 insightful?

[LKM]

releasing software with remotely exploitable bugs to the general public to the fanfare of the press (release of safari is in all major news) by a large company is surely a more irresponsible act than a bug report about the said software.

Yes. Every application release ever by a large company was irresponsible. And why limit it to large companies? No software should ever have been released because they all contain bugs which could be exploited by hackers!

What Maynor does is absurd. We all know software has bugs. The developers must be held accountable. But you can't do that unless you tell them what the hell the bug is, because they can't fix the bug until you tell them what it is!

Re:shooting the messenger is now + 5 insightful?

[Anonymous Coward]

This is stupid. Your claim that beta software should be released "without exploitable bugs" is asinine. Certainly we can discuss the number or severity of them - this would be useful, and a vendor could be criticized for a low quality release - but this is made impossible but the obscurity related to the claimed exploit. (And widely publicized history of dishonesty with this bug submitter.)

Short story: this is stupid.

Re:shooting the messenger is now + 5 insightful?

[gEvil (beta)]

"Fangrrl", please!

Don't be such a nrrrd!

Re:shooting the messenger is now + 5 insightful?

[Lars T.]

releasing software with remotely exploitable bugs to the general public to the fanfare of the press (release of safari is in all major news) by a large company is surely a more irresponsible act than a bug report about the said software. Well, I guess you missed the fact that he won't report any bug to Apple. So your little judgment has absolutely zero value.

Re:shooting the messenger is now + 5 insightful?

[Lockejaw]

It's disabled by default on OS X.

Re:shooting the messenger is now + 5 insightful?

[Lars T.]

So Maynor is part of the "opensource community" now? Or are you saying it's Apple's fault to use OS? Are you saying that opesource sucks?

Re:shooting the messenger is now + 5 insightful?

[Altus]

Shit dude, gmail still fucks up and its been out of beta for a while. Sure everyone was using it but it was pretty beta-ish for a while there.

Re:shooting the messenger is now + 5 insightful?

[dougmc]

Why did that bearded guy insist that I attend the "Church of GNU" every sunday then ? You must have misunderstood him. He didn't want you to attend church -- he just wanted to make sure you called the church lignux, er, GNU/Linux, and if you didn't, he wouldn't talk to you.

Re:shooting the messenger is now + 5 insightful?

[MightyYar]

Do you write software? Have you ever released software with bugs?

Re:shooting the messenger is now + 5 insightful?

[Anonymous Coward]

I think the company you're looking for is Mirabilus.

Don't you mean Mirabilis?

I hate grammar Nazi's.

You're welcome.

Also, that should be "Nazis."

Re:shooting the messenger is now + 5 insightful?

[cthellis]

So by your rationale, that make Microsoft the most irresponsible company ever?

Re:shooting the messenger is now + 5 insightful?

[cthellis]

So by your rationale, that makes Microsoft the most irresponsible company ever?

Re:shooting the messenger is now + 5 insightful?

[LaminatorX]

" I'm guessing that the engineers didn't look too hard at how the OS deals with URLs and just assumed it would be safe."

They unfortunately forgot that they were coding for Windows.

Re:shooting the messenger is now + 5 insightful?

[The MAZZTer]

OS independent path (IE Vista-friendly): %APPDATA%\Apple Computer\Safari\Preferences.plist

Re:shooting the messenger is now + 5 insightful?

[Holi]

Terrorism: the unlawful use of -- or threatened use of -- force or violence against individuals or property to coerce or intimidate governments or societies, often to achieve political, religious, or ideological objectives.

I don't see how he could be charged as a terrorist as his actions do not fit our legal definition. Now if being an asshole were illegal...

Re:shooting the messenger is now + 5 insightful?

[644bd346996]

Not really. Bugs are inevitable, and the bugs in question have yet to be confirmed. Yes, Safari has been getting a lot of press, but it is still clearly labeled as a beta product. After the Vista betas, most windows users should understand that "beta" means buggy, despite Google's efforts to the contrary.

This is the first public beta of a freshly-ported piece of software. I'd be surprised if there weren't some pretty major bugs. Apple's programmers probably don't have a ton of experience with making a Windows app secure. Is this reason to not release the software? Of course not. The term "beta release" exists for this purpose!

On the other hand, we have a "security expert" with a dubious reputation announcing the discovery of some pretty serious bugs. Strangely, he refuses to disclose the details to the public (sounds like MS's security practices). Furthermore, he brags about withholding the information from the developers. This destroys the credibility of his claims, and any reasonable person should doubt that he knows of any such bugs.

Apple's actions are clearly not irresponsible, or at least, no worse than standard practices for the software industry. Maynor's actions don't seem all that irresponsible either. Instead, the terms that come to mind are "grandstanding", "snake oil", and "astroturfing". Though perhaps that last term should be saved for you.

Re:shooting the messenger is now + 5 insightful?

[Jerry Smith]

It's disabled by default on OS X. Correct, I enabled it by use of Tinkertool for the olde Safari, the new Safari picked it up. I guess adding an extra line (google 'IncludeDebugMenu') somewhere between HomePage and InputFieldWidthRatio might do the trick.

Re:shooting the messenger is now + 5 insightful?

[Lockejaw]

Yeah, you can also go digging through the .plist for it, and do it that way (probably how I'll do it next time). A few months ago, I enabled it with some CLI incantation I can't remember anymore.

Re:shooting the messenger is now + 5 insightful?

[RoaldFalcon]

And if you're installing a beta then yes, you really should be aware that you're in for some bugs. It's very unfortunate that Google has diluted the meaning of "beta" so much.

Stupid Google and their bug-free code. They're ruining it for everybody.

Re:shooting the messenger is now + 5 insightful?

[alisson]

Cough cough it's in beta. Cough beta. Cough cough cough. Beta.

Too subtle?

Re:shooting the messenger is now + 5 insightful?

[Molochi]

And "no longer supported" is the new gold.

Re:shooting the messenger is now + 5 insightful?

[Fordiman]

My karma was already 'excellent'. I have no need for karma whoring.

Meanwhile, the preview looked correct. I don't know why /. stripped it, but it seems to have.

Re:shooting the messenger is now + 5 insightful?

[Fordiman]

most likely:
% defaults write apple.com.Safari IncludeDebugMenu 1

Re:shooting the messenger is now + 5 insightful?

[Fordiman]

Say wha?

Ok, I know you're an AC, and this is probably trollfeeding but where the hell did you get the DRM shill idea?

My suggestion to the record execs has to do with *removing* DRM by providing a far less restrictive alternative.

Unless you consider culpability for what you buy to be DRM. It's not; your rights are unrestricted, all my suggestion does is allow for a way for a person to be held accountable for their purchases.

Of course, there's the theft argument. But then, such a thing would have to be determined in a civil court. You know, like most things.

If a person reports the theft, he's cool. If he doesn't, he can just claim theft and the plaintiff would have to show that theft didn't happen. More likely is that a real pirate wouldn't even *buy* from an online store - they already don't.

Re:shooting the messenger is now + 5 insightful?

[evought]

The interesting part is that Thor's bug is in the way iframes handle URLs. This suggests that the code to parse and evaluate URLs is not uniform. That itself is a bad mark and is unlikely to be an underlying Windows bug. The problem with the lack of taint checking may be an API bug, but, in a cross platform browser, it may not be prudent to trust the platform API to do this reliably. I am paranoid, but I would normally generate specific test cases for this (to see if the underlying API works and see if it stops working from API release to release) and probably add my own library function to be linked in where needed (basic autoconf hell). It looks like they may have gone with paranoia in some cases but not others.

Additionally, Thor claims the exploit executes on OS X (albeit with a safer exec call). He is right that a general solution to external protocol handling and security needs to be developed or this general class of bug will keep cropping up in one place or another.

As for Maynor's handling of disclosure (or lack thereof) it is unprofessional and not helpful.

Re:shooting the messenger is now + 5 insightful?

[Proteus]

Here, let me fix that for you: releasing beta software with remotely exploitable bugs to users who accept a license that indicates the software is pre-release and should not be used with important data...

Well, the rest of that doesn't make any sense anymore.

I mean, seriously, the second paragraph of the license, which is presented in all-caps, boldface text, says:

IMPORTANT NOTE: THIS IS "BETA", PRE-RELEASE, TIME-LIMITED SOFTWARE MEANT FOR EVALUATION AND DEVELOPMENT PURPOSES ONLY. THIS SOFTWARE SHOULD NOT BE USED IN A COMMERCIAL OPERATING ENVIRONMENT OR WITH IMPORTANT DATA. BEFORE INSTALLING THIS APPLE SOFTWARE, YOU SHOULD BACK UP ALL OF YOUR DATA AND REGULARLY BACK UP DATA WHILE USING THIS APPLE SOFTWARE.

A company can't be blamed for people not bothering to read the contract -- it's not like the above is any kind of vague legalese.

Apple has taken every reasonable measure to ensure people know that this software carries risk - they call it a beta, they describe what that means in the license, etc.

However, this "security researcher" who claims to have found bugs (he probably did -- it is beta software), but refuses to share them with Apple, the WebKit project upon which Safari is based, or anyone else, is actively unprofessional. He's profiting by maligning a company (Apple) without presenting any hard evidence to anyone, and in so doing he's harming me and my fellow security professionals by devaluing the security research process.

Re:shooting the messenger is now + 5 insightful?

[Anonymous Coward]

...over half the population would then be locked up as a terrorist.

Re:shooting the messenger is now + 5 insightful?

[siddesu]

yes, definitely. wouldn't you agree?

Re:shooting the messenger is now + 5 insightful?

[siddesu]

well, i judge the companies as a user, not an employeee, and contracts like that one are the main reason why I think software companies need no slack. tell me which other engineering field lets you distribute a potentially harmful product AND get away with it? in the contract?

sheesh, if people can find several exploits on day one, that means they are pretty obvious exploits. pretty obvious exploits mean lack of quality control, whether it is Apple, Microsoft, your favourite gaming company or your favourite linux distro.

but go on denying the responsibility of software makers.

Re:shooting the messenger is now + 5 insightful?

[aztracker1]

Isn't it akin to yelling *FIRE* in a crowded building, or at the very least, knowing there is a bomb about to blow up a building and not reporting it?

Re:shooting the messenger is now + 5 insightful?

[Anonymous Coward]

Fun Fact: My sig is a trap.

Re:shooting the messenger is now + 5 insightful?

[tigersha]

Have you ever seen Richard Stallman live? With a disk platter for a Halo and wearing a robe? At a Linux Conference? Standing on a table with his arms wide open proclaiming himself to be Saint Richard of the Church of Emacs?? That one?

Re:shooting the messenger is now + 5 insightful?

[Proteus]

I'm not denying that software makers have responsibility for their bugs. My point is that the software industry has a process, and that Apple was following that process. The process goes like this:

1. Write some software
   
2. Test it until the developers are happy
   
3. Give it to a broader internal user-base
   
4. Launch a private beta (larger user-base)
   
5. Launch a public beta (much larger user-base)
   
6. Release software
   

At each stage until release, the goal is to find as many bugs as possible. You simply can't do that without letting a broad user-base test things out.

Contrary to your belief, other engineering pursuits do follow that process, but often a "public beta" type of arrangement is simply too expensive.

if people can find several exploits on day one, that means they are pretty obvious exploits

What's in question here is whether these exploits were actually found -- the supposed discoverer isn't sharing any information with anyone, so we really don't know if those flaws exist or not.

Re:shooting the messenger is now + 5 insightful?

[Holi]

Please, get some perspective, were talking about a web browser not getting a crowd of people killed.

Re:shooting the messenger is now + 5 insightful?

[siddesu]

Contrary to your belief, other engineering pursuits do follow that process, but often a "public beta" type of arrangement is simply too expensive.

Well, sir, I must point it out to you that is compleat bullshit. I have never heard of or seen a beta car available for testing, nor am I aware of one being offered to the general public. On the contrary, beta cars are tested by specially trained test drivers, whose job is to find them bugs. In fact, I haven't heard of any other item offered for beta testing, neither video, nor stereo, nor washing machine. The software companies use users as beta testers, and have the audacity to _advertise_ that on all media.

Also, when a car has a bug that has caused real trouble (which happens rarely enough), the car manufacturer can, and usually is sued, found liable, and pays hefty sums to the affected people.

The software companies, on the other hand, have cut themselves a sweet deal by having monkeys beta-test their junk, and blaming any problems on the users.

And, before you all tell me "there were no bugs", how come they "fixed" them like it says here?

telling Apple would be insane

[r00t]

These things are worth a lot. Spammers, governments, mobsters... all will pay. You even get your choice of payment method:

*euros
*credit card numbers
*yuan
*underage virgins
*dollars
*shekels
*death to your enemies
*rubles
*pounds, British money
*pounds, crack cocaine

Just be sure to not rip off the buyer. Most of the buyers have nasty ways to kill you. Some of them have polonium. Some of them have penis pills.

Re:telling Apple would be insane

[espressojim]

I imagine the penis pill overdose being a far more nasty death than the polonium...

Re:telling Apple would be insane

[Anonymous Coward]

"Some of them have penis pills."

Death by terminal erection. Not a pretty way to go.

Re:telling Apple would be insane

[Anonymous Coward]

*underage virgins

So they kidnap Slashdotters? Or do Slashdotters' parents sell them just to get them out of the house?

Re:telling Apple would be insane

[Anonymous Coward]

Personally, I'll take a few of those underage vir$&%#(%++++ NO CARRIER

Re:telling Apple would be insane

[Elsan]

Please... I'm still having nightmares...

Re:telling Apple would be insane

[LordSnooty]

Don't forget e-gold...

Netscape? IE?

[OrangeTide]

the first versions of those were so stable though?

(so stable that many of us used Mosaics until maybe 10 years ago, when netscape 4.0 came out)

I can see the ads now...

[TheVelvetFlamebait]

Mac: Hello, I'm a Mac...
PC: ...and I'm a PC.
Mac is looking through a small viewfinder, looking very absorbed
PC: Hey Mac.
Mac: Yeah?
PC: What are you doing?
Mac: I'm browsing the internet with Safari.
PC: I do the same thing with IE.
Mac: You should try Safari. It's fast, secure, and easy to use.
Mac hands the viewfinder to PC
PC: Oh, thanks.
PC looks into the viewfinder and keels over, dead
Mac shrugs

Nice prediction

[macslut]

That's an amazing prediction. I guess we'll all have to wait until Apple actually releases Safari (as opposed to this preview) to see if it comes true. Methinks it unlikely as that's kinda the point of releasing a beta, especially at a developer's conference.

Duh!

[nbritton]

It's a beta you fucking idiot!

refunds for bad software

[OrangeTide]

You all deserve a refund, how much was Safari again?

Beta software has bugs...

[slyn]

news at 11.

Still waiting for the page to load...

[thebrieze]

Google.com takes 45 seconds to load. CNN.com, several minutes for just the text to load (haven't seen any images yet), I have yet to see the safari home page fully load. It has now been about 8 minutes since i started the browser and the home page is still loading and has a blank screen. OK CNN just finished loading 12 minutes later. Slashdot, about 2 minutes for just the text, and about 5 minutes for the whole page. (And yes, i've tried restarting/rebooting several times)
This is all on a 7 mbit cable connection, using Firefox, CNN.com, or mostly any other page for that matter, takes about 3 seconds or less to fully load, including all the flash animated ads. So figuring there must be something wrong with my PC, I install safari on my laptop. Nope! Same results. I upgrade ITunes, thinking there might be some strange dependency on the latest version of quicktime, but no difference. I disable my (software) firewall, and antivirus.. and again nothing.. still watching the grass grow faster than the page loads... Anyone else experience this?

Re:Still waiting for the page to load...

[neverland0]

It also took forever to load home page the first time, and if it's gonna be like using iTunes Music Store...thanks but no thanks

Re:Still waiting for the page to load...

[Anonymous Coward]

I would believe that render/page load times are not that important at the moment. Verifying any major crashes, or installation errors are primary for the Beta. Loading times are probably in the in-house Beta, and will be put out after other items are in place.

I'm not sure on all of this, I just remember those steps from various Beta testing newsgroups and message boards I have been on.

Granted, they released this with much hype, so having long load time issues is a big no. Like someone else stated, if they had put this out a bit quieter then it would have been less of an issue. But announcing this at a Developer's Conference does feel like a quiet announcement, and the fact it is Apple transforms that quiet act into a full blown carnival.

Re:Still waiting for the page to load...

[rollthelosindice]

I really don't think it's fair to test out beta software on a 386 like that. Now that's just mean.

Re:Still waiting for the page to load...

[MyLongNickName]

Let me guess... you believed the Best Buy salesman who told you that you need a fast processor to surf the web and get emails, right?

No Problem Whatsoever...

[Chabil Ha']

because I'm using the browser as a development tool, not as my general purpose browser. Sure, FF has its own problems, but why expose yourself with a beta browser out in the wild?

Proxy Feature broken

[nicc777]

For what it's worth - I discovered the proxy feature is broken. Once you enter your user name and password, the browser crashes (Windows XP).

Re:Proxy Feature broken

[witte]

Yup, same here.

Re:Proxy Feature broken

[ig37055]

i can't even configure proxy

Re:Proxy Feature broken

[shanmoon]

I can't even GET to the preferences menu... Safari freezes on startup and I have to kill the process.... oh well, it is still a Beta after all...

can anyone at Apple say alpha?

[chdig]

Steve Jobs speaking at the Safari release:
"We think Windows users are going to be really impressed when they see how fast and intuitive web browsing can be with Safari"

I think Windows users are going to be impressed that the quality of Windows applications is so much higher than those with Mac -- I don't even believe this, but it sure as hell is what Mac is asking for!

And to all those Mac fanbois that have been posting the same idea ad nauseum: "oooh bugs in a beta, no surprise!", you need a serious reality check. Small bugs exist even in most production applications. These are basic security vulnerabilities that make Safari dangerous to use on windows, and the actual bug reports piling in lead one to believe that it's a barely usable application (display/font/screen/memory problems amongst others).

All I see here is something that is most definitely not beta quality

Don't Care

[Fordiman]

It works well enough to test webpages for Macs, yeah?

Then I really don't give a flying fsck about its security. Let Mac fanboys deal with their newfound exposure. I use FFox as my primary browser on my PC, Mac, and Linux box. There's something to be said about 'consistent development environment'.

No, seriously. I'd use my Mac a lot more if there was a reasonably lightweight OSS code editor for it. There's not, so I don't.

Re:Don't Care

[Anonymous Coward]

there is, its called vi

Re:Don't Care

[AgNO3]

How can there not be the same oss code editor for OS X? You don't know how to compile code under GCC for x11?

Re:Don't Care

[Fordiman]

Kate requires KDELibs. SciTE requires Scintilla, which has not been sufficiently ported. You know of another good one? My requirements are, in order of importance: tabbed editing, code highlighting, regex search/replace, code folding, drag-and-drop editing, optional word wrap, monospace font configuration available, eight spaces equals a tab in mono- or variable-space, maximizes to full screen. Please give me a text editor for mac with those features.

Re:Don't Care

[Fordiman]

vi:(scite|kate)::stick:sword

How about saying something useful?

Re:Don't Care

[INeededALogin]

vi or emacs. It doesn't get more standard or lightweight than those.

Re:Don't Care

[Tatey]

You could check out Smultron. It's a nice tabbed based GUI editor with syntax highlighting. It's GPL.

Re:Don't Care

[Onan]

vim running on osx appears to offer everything you require. Enjoy.

Re:Don't Care

[Zelos]

Textmate + Megazoomer?

Re:Don't Care

[lisaparratt]

Nothing says light weight like a LISP virtual machine!

Re:Don't Care

[noamsml]

I think you've got it reversed: vi:(kate|scite)::sword:stick A sword isn't useless just because you don't know how to wield it.

Re:Don't Care

[Anonymous Coward]

What about JEdit? It's open source, java-based, and has lots of cool text-edity goodness. Works on mac, as well as linux, windows, etc.

Re:Don't Care

[Fordiman]

A tool that's unintuitive isn't useful to me.

Really, I don't have time to indulge your masochism fetish; I need something that I can just run and use. It's just a text editor, damnit; I shouldn't need a manual.

Re:Don't Care

[Fordiman]

How is it that eevry time the term 'code editor' is brought up, vi and emacs are mentioned?

They suck, the both of them. I mean, saving a file *alone* in either is ridiculously unintuitive.

Yes, I want a damned menu. Hell, DOS's edit is a more friendly, if less powerful experience. qEdit, back in its heyday waas pretty awesome.

Honestly, what's wrong with sparing a line at the top of the screen to make things simple?

vi and emacs belong to the (now dead) era of OSS developers coding for other developers. Nowadays, even developers require a bit of user friendliness.

Re:Don't Care

[Fordiman]

Java-based != lightweight or fast.

Also, I've used JEdit. It's crap on large files.

Re:Don't Care

[Fordiman]

Hm.

That looks remarkably like Kate.

I think you win.

Re:Don't Care

[noamsml]

Actually, the same can be said of swords. If I want to bash someone's head, I shouldn't need to train!

The fact of the matter is that power will almost always come with the price tag of increased complexity.

There are difference

[aepervius]

For a browser, to have "easily" testable major bug like remote execution, something which should have been caught a bit before. I disagree totally with the way this security "researcher" handled the bugs, but I also totally disagree taking off the slack because this is a beta. Bug found so quickly by testing a few known vulnerability in browser is something bad. With a big B. Smell of lack of security testing pre-beta.

Re:There are difference

[Anonymous Coward]

Firefox had very similar shell URL handling bug in "final" software.
No beta badness for the Mozilla folks.

what's the big deal?

[p51d007]

I downloaded, installed and tried it. Yes, it works just fine, but I can't see anything that would cause me to switch from FF. It looks like a good stable browser, another alternative to IE, which is a good thing.

You're dodging

[Anonymous Coward]

Maynor claims to be a professional security researcher. One of the cornerstones of professionalism...

Nice try, but it can simply mean he's good enough to get paid in the trade he professes to be skilled in.

I'm not even going to tell you to look it up. I don't believe you don't know the definition of the word. You're just ignoring it. How professional.

The secondary definition that you're trying to restrict the term to is simply marketing hype by "professionals". Like professional roofers.

Re:You're dodging

[Anonymous Coward]

From one AC to another:

Webster's 1913 Dictionary

          Definition:
\Pro*fes"sion*al\, a.
1. Of or pertaining to a profession, or calling; conforming
      to the rules or standards of a profession; following a
      profession; as, professional knowledge; professional
      conduct. ``Pride, not personal, but professional.''
      --Macaulay. ``A professional sneerer.'' --De Quincey.

Perhaps you, yourself, should have looked up the definition, ye lazy & bilesome rapscallion!

Re:You're dodging

[edumacator]

Did you just really use the word rapscallion in a real world sentence?

Awesome.

Re:You're dodging

[Anonymous Coward]

Since when is /. the real world?

Re:You're dodging

[Lars T.]

Nice try, but it can simply mean he's good enough to get paid in the trade he professes to be skilled in.
So does Dubya. But wait, is he a professional President or a professional politician?

Re:You're dodging

[Sciros]

March 23, 2004, although the details of how or why elude me.

Re:You're dodging

[xIcemanx]

Once, in a debate round, I actually used the word defenestrate in a completely un-ironic sense. We were discussing inner-city schools, and my partner talked about how at one school lack of discipline was out of control, and how one principal was actually pushed out of his window. So when I got up there, I started with, "Madame Speaker, educational administrator defenestration is a serious concern facing our great nation today."

It was at least three minutes of laughter before the room settled down enough for me to continue.

Bugs found in beta software, news at 11

[Aqua OS X]

This just in, nasty bugs were quickly discovered in the public beta of a newly ported app. Disappointment of outrageous expectations has now led to the death of several men living in their mothers' basements.

It is assumed Apple realized this devastating "beta" because they hate freedom and want the terrorists to win... and they've now won.

We will try to stay on top of this developing critical story.
My god have mercy on us all.

Re:Bugs found in beta software, news at 11

[cno3]

"Disappointment of outrageous expectations has now led to the death of several men living in their mothers' basements."

Terrorist suicide bomber, up in heaven: "These are so not the virgins I was expecting."

Re:Bugs found in beta software, news at 11

[blake3737]

oh come on you just copied that from Fox News. It was right under "Liberals Cause Cancer" on their website.

Re:Bugs found in beta software, news at 11

[Anonymous Coward]

Mod parent funny. This is my best laugh of the day. And I watched "The Party" this morning.

Crashed for me...

[sc0ob5]

I just installed it on a few machines to test and it crashes on every PC when I try to authenticate against my proxy.

Re:Crashed for me...

[Anonymous Coward]

yeah me too - http://psyphen.efx2.com/view/93846/Apple-Safari-Wi ndows/

Shooting the messenger is + 5 insightful if...

[Anonymous Coward]

The messenger says something along the lines of:
"The Trojans are going to attack tonight. There'll be at least five cohorts, but I can't tell you where there coming from, or the time of the attack, because you know, that'll spoil all the exciting fun."

Ummm BETA!!!

[rholtzjr]

Geez folks, this is not an unheard of realization. IT'S BETA!

Re:Ummm BETA!!!

[Anonymous Coward]

There are bugs and then there are BUGS. These type of bugs show that apples design and development process are still incredibly immature with regards to security. These are not some new and fabulous ways to hack a browser, these are old known methods that are well defined and should never even make it into an alpha let alone beta release as developers should have been trained correctly to code securely.

You can excuse broken or incomplete functionality, you can excuse security problems with new interesting features, you can excuse crashes and general buggy rendering, you CAN'T excuse poor security development practises.

Re:Ummm BETA!!!

[Jugalator]

Yeah, IT'S BETA, especially as long as it's an unusually poor beta. ;-)
Longhorn was also IT'S BETA, and when Vista was released, that was no longer an excuse. :-)

But maybe you're right, and the problems come solely from the beta status, and from absolutely nothing else.

From my experiences, Windows Safari was broken like an early alpha -- lots of rendering bugs, and crashes after 15 minutes of use.

From here @ WWDC...

[catdevnull]

From what I can tell, Apple is jumping on the consumer bandwagon (or trying to)--it seems they're trying to increase the Webkit install base to raise the "awareness" factor for iPhone's web engine. From the sessions I went to today, it seems Apple is really pushing for Web 2.0 development. I was surprised by this--for a developer conference specifically for Apple's OS, there was this weird, eerie spell cast by the presenters for pushing web apps.

The vibe amongst the attendees is a weird mix of disbelief and bewilderment. Safari for Windows was not the big deal Steve was hoping it would be. In fact, most of the conversations I've overheard are pretty critical of this direction.

I don't think Apple is serious about competing for market share against FF or IE on Windows. I think they're offering the development platform based on Webkit so that web developers can make sure their code looks OK on the iPhone. Webkit-iness seems to be the only development platform for iPhone Apps.

Or, maybe Steve is starting to drink his own Kool-Aid.

Re:From here @ WWDC...

[glesga_kiss]

Even if the rendering engine is the same, surely Apple don't expect all iPhone compliant websites to be tested on the Safari Browser on Windows? For one the UI is entirely different, there is no mouse and keyboard on many phones. Granted it'll maybe show how it renders but it won't give you a feel for how it is to use.

Re:From here @ WWDC...

[catdevnull]

I don't think the expectations are for web developers to make the world ready for the iPhone but rather provide ways to create NEW content/apps specfically for the iPhone.

Of course, Apple would love for web developers to make iPhone friendly websites, but that probably won't happen.

One of the problems for web developers and the iPhone's interface is that it is mouseless--there are no "hover" states for Javascript/AJAX applications for things like mouseover. The iPhone's web interface with Safari is being touted as the next best thing over current offerings but it's gonna have problems, too.

Re:From here @ WWDC...

[Anonymous Coward]

I think they accidentally reversed the polarity of the Reality Distortion Field.

Re:From here @ WWDC...

[glesga_kiss]

Of course, Apple would love for web developers to make iPhone friendly websites, but that probably won't happen.

I wouldn't be so sure on that; there are many PDA-friendly websites already and most devices on the market already do a fairly decent job of displaying full-size websites. Some of my /. posts are written on my PDA. By the time Apple enter the market there will be a lot of content already.

The iPhone's web interface with Safari is being touted as the next best thing over current offerings but it's gonna have problems, too.

Not neccasarilly a good idea really. For example, Firefox has been ported to the PPC platform and frankly it's the worst browser available. It's far to heavy and it has little abilities to scale content to the small screen. The MS default, Pocket Internet Explorer is infinitely better, and Opera is even better than that.

When it comes to mobile devices, developing a specific lightweight client for the job is generally the best approach.

Re:From here @ WWDC...

[amper]

I haven't seen or heard anything to indicate that "Web 2.0" (whatever that means) will be the *only* development platform for the iPhone.

Remember the "Web Clip" feature that His Steveness has been talking up for a year already? Wondering why that isn't in the Safari 3 Public Beta? Still wondering why Apple is making Safari for Windows?

I still maintain my belief that Dashcode will also be a development environment for the iPhone. After watching the keynote, I realized that one of the most common items I use Internet access on a portable device to look up is local movie listings. My bet is the 12th app is the "Movies" widget that His Steveness demo'd at WWDC. Funny how that widget seems to be the perfect size for a iPhone screen, and even it's UI almost looks like a iPhone.

Over the years, Apple has proven themselves to be the only technology company out there that is consistently capable of establishing entirely new paradigms in computing. They did it with the Apple II, the Mac, the Newton, the iPod, and I expect the iPhone will be no different. Watch closely, you're seeing history in the making once again.

Re:From here @ WWDC...

[catdevnull]

If you want to see just how cool a "Webkit" based app can be, check out what this guy did with it:

  http://www.apple.com/downloads/dashboard/transport ation/bartwidget.html

This guy won the Apple Design Award for this year (Best Widget).

The audience in The Presidio tonight was especially impressed with how slick this little app is. In fact, after seeing this, I had an epiphany about what Apple is doing for the iPhone--it is, indeed, going to be revolutionary. The trouble is no one thought it would be this simple. They were expecting some fancy-ass API or developer environment for the iPhone. With Dashcode--ANYONE can make a Widget. I imagine the iPhone possibilities will not be too far from this simplicity.

My BUGS

[Trendkill_84]

1) crashes when prompting for authentication to isa server 2004 2) cannot set proxy server manually through edit -> prefences , it is greyed out so i havent even been able to browse the web on it yet. and it's a shame too, mainly because i'm a mac user so it was nice to think i would have safari at work while i do my system admin work..

humm

[crashelite]

didnt the wifi hack that he had turn out to be a hoax anyways and he put up a retraction in the smallest place on the web he could find and added the no search bot.txt file so no one could find it with google...

Re:humm

[doh123]

there was no retraction. he initially mislead people and kept on doing it, and kept claiming things were possible, yet only proving something else completely when asked for proof. He acts completely like a politician, he cant answer a question asked to him, he has to twist it around to how it suits him best to get attention.

YES!

[tivoKlr]

I hate that bookmarks sidebar, when I sit at one of my users desks to work on their computers it takes everything I have to not close that damn thing if it's open.

I don't know why I despise it, especially how most of the time the browser window is maximized, and many of these users have widescreen LCD's so there's plenty of real estate for the real webpage that is being displayed. I do see it's utility, but there is something so asthetically displeasing to me with that large white bar on the left side of the page. I could go on and on...

Articled tagged for "Haha"

[Anonymous Coward]

Bwahahahaha!!! Isn't this just typical Apple programming?

Apple has a long and proud tradition of creating the worst, buggiest, most egregious abortions to ever be called applications on the Windows platform. Why break their perfect record with Safari? It just wouldn't be right.

Looks like the MOAB wasn't a fluke. EVERY month is a Month of Apple Bugs!

My bug is nothing by comparison

[Plug]

Safari, if maximised to the second head on my Windows machine, disappears completely. Anyone else seen this?

Re:My bug is nothing by comparison

[Auz]

Yeah. Though that was more of the beta-style bug I was expecting than this other stuff.

Sun Java Not Working

[dufachi]

Even though there's a link to the add-on, Sun Java fails to work for me in Safari. But natch the flash ads work great.

Re: Early copies of software help the developers

[Douglas Goodall]

One of the benefits of getting beta access to new software is that third party developers can get an early idea what they will have to do to be compatible with the real stuff when it arrives. Some of us consider it valuable to have access to the early versions to get a wider window of opportunity.

Well I guess

[wumpus188]

You live with beast, you have to howl...

Hilarious

[His Shadow]

I love how even tho it's painfully clear from the initial article that there will be no third party verification of these "bugs" and the information won't even be sent to the vendor (which for a fact demonstrates that the submitter has no one's best interests in mind), posters are virtually falling all over themselves to extrapolate near End Times disaster scenarios for a browser released less than 24 hours ago. I can also see that Artie McStrawman is getting a real beating in here, as he regularly does when Apple is the subject.

Safari Exists on Windows for One Reason

[cadeon]

To serve as a Windows development / testing platform for iPhone apps.

Comment removed

[account_deleted]

Comment removed based on user account deletion

BBEdit/TextWrangler?

[PAPPP]

Have you looked at BareBones Software's BBEdit (shareware) or TextWrangler (freeware, feature subset), I haven't used them for quite a while (moved to linux w/ scite/nano), but it really is a nice editor, it meets all your requirements except being OSS, and it uses a peculiar "Document Drawer and Navigation Bar" system, that looks and feels about the same as tabs (feature was added since I last used it much, can only say that people I know who use it seem to like it). I think all the specifically addressed features are in TextWrangler (=free).

Re:BBEdit/TextWrangler?

[Fordiman]

Used it. Bloated (at some 10M, vs. scite's 0.5M) and doesn't work well. And the 'useful' version (BBEdit) is for-pay. Not willing to pay for something on my Mac that I can get for free on my Win PC/Linux box. Sorry. Having all three means the Mac usually just sits there.

Bringing apps to Windows

[Rolman]

Steve Jobs wondered while introducing Safari for Windows: "How good are we at bringing apps to Windows?"

After reading "4 DoS bugs and 2 remote execution vulnerabilities", I'd say: "Pretty good!"

Windows bugs... who cares?

[Anonymous Coward]

Hey its a windows app who gives a shit....What the hell do you expect with the apple devs writing code to the windows spaghetti hell api. I would be surprised if there were no bugs to exploit.

Thank you software ENGINEERS at apple

[Anonymous Coward]

And you guys want to call yourself software engineers. How is it a structural engineer can make a bridge or skyscraper perfect every time with no bugs and you guys don't seem to be able to do it ever. Engineer my ass!

Re:Thank you software ENGINEERS at apple

[crimperman]

How is it a structural engineer can make a bridge or skyscraper perfect every time with no bugs

*Every* time????

You might like to have a look at London's millenium bridge ( designed by one of the biggest Civil/Structural engineering firms in the world ) or Ronan point (to name just two of the famous ones) and reconsider that statement a little.

Re:Thank you software ENGINEERS at apple

[Anonymous Coward]

The Tacoma Narrows bridge would like a word with you.

It's currently littering the bottom of the Tacoma Narrows, so it's willing to wait a bit - please work your way down there on foot, okay?

Yes I know its a beta! Why was it really released

[ernest.cunningham]

I have tried the browser in Windows XP Professional SP2 and all works perfectly fine for me. The browser is quick and responsive.

Now it may be a beta, but the browser seams VERY buggy, too buggy to be a beta (according to other peoples testimonies, not my own experiences). I think apple has missed out on a great opportunity to gain market share here becuase there will be many people who have tried the browser, had major issues, and now will never go back. Yes I know it is a beta! (preempting the hoards).

I also think that the product was rushed to market, and that apple would never have released the browser in this condition had it not been for WWDC 07. I think they just could not get it to the point they would have wanted in time. And I agree with those above who have said the browser exists mainly for testing iPhone Apps in. Time will tell if they made the right decision here.

I would sugegst to anybody out there to wait a couple revisions before really trialling this application unless you are going to use it to connect to trusted websites you already know, or looking to develop for the iPhone.

Now where is my developer copy of Leopard. We non attending Apple Developer Select Members always get made to wait a couple months :(

Hmmm

[goldcd]

Not sure about the software you develop.
Alpha would be when I've cobbled it all together and it works after a fashion.
Beta would be when I've ironed out any bugs I can find (or at least are aware of them and report them up front), so I then give it to other people to stumble across the obscure ones.
Now working on the assumption that Apple can code, which they certainly can - they must have been aware of serious issues and released anyway. I assume whatever Alpha code they were currently working on has been ripped from their hands and thrust onto the world to enable a certain somebody to make a big announcement. I also know if were them I wouldn't be too happy.

That's not what beta means

[Nicolas MONNET]

Alpha means features still missing

Beta means feature complete, blocker bugs remain

What you call "beta" is actually "release candidate"

Re:That's not what beta means

[kannibal_klown]

What you call "beta" is actually "release candidate"

Yep.

People seem to forget there is a level between beta and gold. However the "release candidate" doesn't get much public attention anymore, lately those releases are internal or obscure enough that Joe Sixpack doesn't hear about them. All Joe hears about is: Google's beta software, public beta tests of games, and Firefox beta.

Personally I blame Google and the game companies for corrupting the lay definition of beta.

The entire UI is broken

[DrXym]

Every single dialog box and effect is Aqua style. Even though both OS X and Windows XP / Vista have theme engines meaning there should be absolutely no reason at all for doing this. The engines allow apps to render their controls in the native style irrespective of how they are implemented. It's why Firefox in its default skin looks like a Windows app on Windows, like a Mac app on a Mac and so on - because rendering is handed off to the theme engine. Same happens for Java too. But not Safari it seems.

Re:The entire UI is broken

[Anonymous Coward]

Uh, I don't know what planet your Firefox is from, but the only thing about Firefox that looks like a Mac are the window glyphs in the corner. As for the Windows version, I'd hardly call it a "Windows" look. It looks like a GTK app, which is a Linux look modeled after Windows. The coloring is specifically targeted for Windows. It doesn't look like either a KDE app or a Gnome app in Linux.

Firefox looks roughly the same on all platforms. So does Safari, now that it has grown to multiple platforms.

Re:The entire UI is broken

[gnasher719]

'' Every single dialog box and effect is Aqua style. Even though both OS X and Windows XP / Vista have theme engines meaning there should be absolutely no reason at all for doing this. ''

But there is a very good reason to do this. Apple wants Windows users who don't think about looking at a Mac to have a good look at MacOS X.

Re:The entire UI is broken

[DrXym]

Uh, I don't know what planet your Firefox is from, but the only thing about Firefox that looks like a Mac are the window glyphs in the corner. As for the Windows version, I'd hardly call it a "Windows" look. It looks like a GTK app, which is a Linux look modeled after Windows. The coloring is specifically targeted for Windows. It doesn't look like either a KDE app or a Gnome app in Linux.

Not true at all. Everything from the scrollbars, progress bar, dialogs, appearance of buttons, entry fields, menu bar (and positions of items such as about box, prefs etc.), keyboard shortcuts are all rendered or behave in the Mac manner.

The reason for this is due to the default theme in Firefox. The Firefox (and Thunderbird / Seamonkey) UI consists XUL that defines the structure of the UI to which a theme is applied to render it. The theme contains CSS and other files such as images and bindings that govern the layout and appearance of everything. So whenever the XUL defines a push button (for example), Firefox uses the theme's CSS to style it.

The CSS can specify any standard CSS 1/2/3 rules to draw an element but there are also special -moz-appearance directives that tell the item to render natively. All UI elements (buttons, entry fields, combos etc.) in the default theme are tagged with special -moz-appearance rules. The upshot of these rules is that when the button is rendered, the rendering is done by the platform's theme engine.

There are also bindings and overlays to ensure that the behaviour of buttons, menus and their position / text match the platform defaults.

So Firefox does look and feel native on every platform. Perhaps not good enough for some Mac purists, but then you've got Camino if you really want an OS X native UI, not just a look & feel-a-like.

Re:The entire UI is broken

[earthbound kid]

It's called "marketing." Why do you think iTunes for Windows looks the way it does?

Also, I can't tell, but it seems like your message is implying that you believe Safari uses XUL or some other Mozilla based skin settings. It doesn't. Safari = Konqueror's KHTML engine wrapped in WebKit frameworks + Stuff that makes it look like a Mac app. There's no Mozilla anything involved. (Or maybe I'm misreading you?)

Re:The entire UI is broken

[DrXym]

Also, I can't tell, but it seems like your message is implying that you believe Safari uses XUL or some other Mozilla based skin settings. It doesn't. Safari = Konqueror's KHTML engine wrapped in WebKit frameworks + Stuff that makes it look like a Mac app. There's no Mozilla anything involved. (Or maybe I'm misreading you?)

I meant that the Mac has a theme engine and Windows has a theme engine. Both have a bunch of APIs that you can call easily from any app to render a button, scrollbar, checkbox etc. in the platform style. This is exactly how Firefox and Java manage to render themselves with a native look and feel even though they don't use native widgets. In porting Safari to Windows Apple have also ported the theme engine from OS X meaning the app doesn't look or behave like any other Windows app. There appears to be absolutely no valid reason to do that when Windows has a theme engine of its own. Cocoa could invoke calls on that to render widgets but it doesn't. It makes Safari look atrocious and completely non standard when running in Windows. I'm hoping they will fix this because I don't see any reason at all to use Safari when it can't even be bothered with basic consistency.

Microsoft would be killed if they pulled the same stunt, releasing an IE port with Aeroglass theme for Linux or OS X, and rightly so. MS actually did release an IE 4 for Unix and it was abysmal, running through some Win32 thunk. I don't see why Apple should have a free pass. If anything they should know better.

Re:The entire UI is broken

[Fulkkari]

There's more to UI than the look. That is one thing that should be learned in the OSS developer community. Firefox kind of looks like an Mac application on a Mac, but it surely does not feel like one the last time I checked.

Re:The entire UI is broken

[alexgieg]

This isn't true at all. I run Firefox both in Windows XP and in Ubuntu, and while in Windows everything looks almost perfectly windowish, in Ubuntu some things follow your selected Gnome theme; some can be made to seem they follow it, for example by installing a special Ubuntu theme; and some, such as form buttons, look completely wrong, not following the Gnome standard at all and looking more like a poor man version of Windows 2000 buttons.

Proper Gnome integration is something that Firefox still lacks. The same can be said of other widely used Linux applications, such as OpenOffice, who completely ignores your Gnome font rendering settings. There's still a long way to go in this department. Firefox is just one among the many improperly behaving softwares.

Re:The entire UI is broken

[DrXym]

I didn't claim it was perfect, but it is using the GTK methods to paint the widgets. You can see the implementation of how it paints widgets here here. Anything tagged to paint natively ultimately ends up going through that function. Form buttons are handled differently from chrome buttons. I don't recall what the behaviour is for those, but there may be reasons that they don't render natively using the GTK theme.

"Hacker" ego

[Anonymous Coward]

For me there are two types of hackers: 1) the ones who make something hard work (the original meaning of hackers I think and the one I prefer) 2) the second type are the guys who find out how something doesn't work. We are told there is a subgenre of this type of hacker, the "ethical genre", who report vulnerabilities to the community AND the original software developers. This guy's point seems only to bring publicity to himself and make Apple look bad on any case ... the non-disclosure issue is ridiculous.

Crashes Safari 3 on Mac OS X too

[eturro]

Thor Larholm's vulnerability example crashes Safari 3 on Mac OS X too.

Proverbial code corruption

[The Cornishman]

> Pride comes before a fall

Pride goeth before destruction, and an haughty spirit before a fall. Proverbs 16:18

Bugs in a test version?

[nurb432]

Who would have thought.

And its irresponsible to not report them.

those are all traceable....

[cheekyboy]

as per patriot act, you are not allowed to say the number one trading commodity is GOLD. Either not taxed, or taxed real real real low because of 'legal tender value' being $10 per $650 ounce coin.
So a tax of n % on $10 is better than $650

Customs might go, step aside sir if you have cocaine or large bags of cash, but GOLD, no problem, read the customs rules. Thanks for declration, next please....

Russia will tho give you some polinium in your sushi roll.

Re:those are all traceable....

[wealthychef]

Yes, well, good luck getting your carry-on onto the plane when it weight 350lbs from gold bricks.

Hmm

[Tinman_au]

"Apple is hoping to replicate the success of iTunes"

Only this time around, iTunes downloads tunes from you!!

Wanker.

[Anonymous Coward]

He notes in the blog that his company does not report vulnerabilities to Apple.

Wanker.

I can only assume that he sells the information to criminal organisations, thus making him a criminal wanker.

WANKER.

(this also applies to any person that doesn't have the decency to report issues to companies and allow them a grace period to fix the holes before releasing the information publically)

I sure hope all the whiners

[Anonymous Coward]

Are hitting the "file bug" button on their new toy.

Because if you aren't, you're fucking obnoxious.

Windows 2000

[ClaraBow]

FYI: I just installed Safari on win 2000, and it works perfectly!

works perfectly fine on Macs

[wiredog]

You've never used Safari on a Mac, have you?

Beta Web browser != beta hello world.

[CarpetShark]

Given the complaints I've seen elsewhere, I think that the quality is closer to alpha stage development. Usually, "public beta" is done on software that's almost ready for use, but has minor bugs.

Exactly. Given the complexity and sophistocation of today's browsers, these things ARE minor. Safari, if you include Konqueror/KHTML, has been in development for something like 10 years. I use konqueror every day, and it's easily complete enough for my needs, with some great features I can't get elsewhere.

The reports I've seen are that there are a lot of serious bugs in rendering and stability, and now, major security problems.

Stability issues are to be expected on a beta of a port to a new platform. KHTML/Webkit is actually quite good in terms of rendering, so it's probably the sites that are broken, or again, some issue with a new platform.

What comes before Alpha?

[remmelt]

Anything doesn't render. Anything that's bold doesn't render. Most italic text doesn't render. It's just not there. We've tried several sites on several computers, and the same thing all over. Slashdot's article titles? Not there. Ebay? Not a chance. Did they test this at all? The font aliasing hurts my eyes. I'm on XP, should I maybe upgrade to Vista? (tongue in cheek here, people)

I wonder why they even bother to make this "beta" public. On the first test of the first page there where show stopping bugs. Test over. Beta scrapped. Why???

Best browser in the world, according to Apple!

Re:What comes before Alpha?

[remmelt]

Damn, I meant to say anything doesn't render in the first sentence.

Re:What comes before Alpha?

[LWATCDR]

I hate to say it but there must be something very different between our systems. Slashdot titles render fine for me. Also Ebay renders and I think it is even faster than on Firefox.
I will admit that it is pretty ugly when drawing Ebay but the end result is pretty nice.
Now some of the other issues like it only leting my resize from the corner I really dislike I can resize from any edge on both Windows and KDE so that is just a little strange.
I am using XP with all service packs. Heck it even worked on the my.yahoo beta page after I told it to just do it.
My guess is that the issues you are having are not easily duplicatable and maybe caused by some other software you have installed that I just don't have.

Re:What comes before Alpha?

[remmelt]

Hmmm. It may be because I'm on a German XP. A colleague's installation is showing the same trouble but I haven't heard any other complaints on the web. It's slower than molasses as well on this computer. I don't understand.

Oh well, it's not like I was going to really use this browser anyway.

Re:What comes before Alpha?

[LWATCDR]

Could be a lot of issues from virus checkers to any number of things you have running in the background.
That is what really sucks about Windows development. People load so much crap on the system they the strangest thing can cause problems. I have found Norton anti virus to be a real pig.
Safari isn't perfect on my system but it is bloody fast and hasn't crashed yet.

Re:What comes before Alpha?

[megabyte405]

This could be a problem that is specific to the way your system (and presumably some other peoples' systems) is set up. I say this because I'm using Safari 3 Beta for Windows XP and Vista right now. On Windows 2000 Professional. As with most times a piece of software is claimed to be "completely useless", it seems here that perhaps the qualifier "in this case for my particular use" is warranted. Nobody would release a piece of software that does nothing without clearly labeling as useless - it must have worked for someone.

Re:What comes before Alpha?

[remmelt]

That's what I didn't understand at all.... We're in the web development business, so testing out new browsers is part of the deal. We installed on two different computers, and both had exactly the same kind of problems. Both have Norton installed, for what it's worth. Both German XP Pro with the works.

Disabling Norton's auto protect doesn't help things either. Safari is slow and displays a lot of stuff incorrectly.

Anyway, they'll fix it, most likely. I wonder why they came out with the windows version at all?

RSS subscription broken too

[Wormholio]

I found that the RSS subscription link was broken, but it's not a security problem.

Looks like releasing it as "beta" was a good way to find lots of little bugs, eh?

"Idle futzing" my eye...

[jpellino]

He sat down to try and break a beta release and he did it.
Woo hoo! What did he do the rest of the day, pull the wings off of house flies?

"Doesn't report vulnerabilities to Apple"
I believe that's French for "I was such a tool the last time nobody will talk to me"

OH SHIT

[Anonymous Coward]

Well I blame MS. I put a defective by desing tag on. Also, a haha tag. I boot up my linux, use lynx and blame the world, because it's not ready for linux. but o-seven is still the year of linux desktopZ-Z-Z THOUGH!!!!11!eleven

No, he was not.

[LKM]

No, he was not.

Geez, if you really believe that whole Ou-invented idea that Apple somehow "orchestrated" a smear campaign against Maynor and got Dalrymple and Chartier to play along with them, you should stop reading zdnet and start reading a real news outlet. It's one of the most inane tech conspiracy theories I've ever heard.

Re:No, he was not.

[makomk]

Yeah, great - link to a long and rambling article by an Apple fanboy which basically boils down to repeating Apple's and Maynor's statements and claiming that the former is the truth and the latter is filthy lies. Thanks, that's really helpful. (There's also a statement from Atheros, but if it's a security issue in an official driver shipped with OS X, why the hell would the security researchers contact the hardware manufacturer?)

Re:No, he was not.

[LKM]

Yeah, great - link to a long and rambling article by an Apple fanboy which basically boils down to repeating Apple's and Maynor's statements and claiming that the former is the truth and the latter is filthy lies.

Yeah, calling others fanboys really shows how unbiased you are. Thanks for making my point.

Did you even read the article? How fucking stupid do you have to be to think that Apple orchestrated a smear attack against Maynor and got Dalrymple and Chartier to say what Lynn wanted? Do you also think that the moon landing was staged? I bet you're really proud of your flat earth society member card.

For the record, both Dalrymple and Chartier publicly stated that Lynn did not contact them. How stupid do you think they would have to be to let Apple tell them what to write?

Ou is a paranoid conspiracy theorist. His ideas are laughable. If you can't see that, you should be asking yourself whether that whole "fanboy" idea might apply to you.

windows is not hardy enough.

[funvin]

As you might imagine, we are upset at Windows for not being more hardy against such attacks, and even more upset with David for exposing them...

It's got some bugs, but

[jessecurry]

I like it so far. I was happy to see that a lot of the feature requests that I had sent in from my Mac were included in this new version of Safari.
I think that Apple is going to try and get users hooked on their UI and then point to all the cool features like WebClips that one can gain access to by switching to OS X.
I wouldn't even be suprised to see an OS X liveCD for PC users to try out sometime in the near future. Sure it'd be hacked to become an installable, but it woul probably get a lot of people who were ready to purchase a new computer to consider going with a Mac.

Operative word: good

[Kaseijin]

But there is a very good reason to do this.

There's an self-interested, arguably rational reason. Whether or not that's "good" is a philosophical question.

Apple wants Windows users who don't think about looking at a Mac to have a good look at MacOS X.

iTunes for Windows can serve as an sales pitch for Mac OS X because of the library interface and ease of synchronization, not because of the skin. All Apple's applications for Windows have looked alien since QuickTime 4, and the idea that it was supposed to sell Macs would have been laughable. It's a constant reminder that the application is from a different planet (specifically, Apple), but not an advertisement for the OS specifically. Also, doing it this way lets Apple keep more of the code in common.

Re:Operative word: good

[Anonymous Coward]

I'd have to agree. I can't stand it when apps have some goofy looking proprietary "theme". Whether it's Apple or some other self important vendor - they all end up looking like crap. Just build your theme to match the OS and then spend the rest of your time making an intuitive interface.

LOL

[Anonymous Coward]

im in ur Safari, executing my shit...

This really isn't the next 'browser'

[Drewsk]

Hey; I don't personally care if somebody claims to have found security bugs they won't share in a browser I won't personally be using. FF 3 alpha is more stable than the Safari I tried installing yesterday. I really don't think Safari is a 'browser' for all of us to adopt; When his 'Steveness' intro'd the iPhone and had no way for developers to introduce 3rd party apps, he had to figure out something. What I think we have here is a 'rush job' from Apple to drop us a browser (read Visual Studio for iPhone) so we can all develop pretty little apps for the thing. Personally, I don't care how many Windows bugs there are as it's kind of more interesting to wonder how many of these bugs are in iPhone... Drew.

Well, just do the normal Apple thing....

[rdforsyth]

So, can you buy an upgrade yet?

Safari

[proxy318]

Slightly off topic, but does anyone else find it interesting that Apple has released Safari for windows, but you can't get the latest version for any version of OS X except the latest (10.4.9)? 10.3 has Safari 1, which has rendering bugs that were fixed in 2, but never backported. So basically if you want the newer, more accurate Safari, you have to buy a new copy of OSX, or a new Mac.

I'm not certain, but I don't think that there are technical reasons for not letting it run on older versions of OS X. Anyone know?

One more thing

[cyfer2000]

Chinese characters rendered more ugly than Mozilla M18 build, if anybody still remember what Mozilla M18 was, the mozilla before alpha.

*Sigh*

[tekshogun]

Why would you release a Windows version of Safari anyway? Sounds rather pointless to me.

(taken from Fear & Loathing in Las Vegas and transformed)

Hunter S. ThompsonOh God! Is that another web browser?!
Dr. Gonzo: THAT'S RIGHT! MUSIC!

Re:*Sigh*

[bruns]

Safari is a pretty decent browser. Given that its not easy to get a KHTML based browser on Windows, this offers a nice chance for people who don't like the bloat that Mozilla has, or don't like the Gecko engine, to try something new.

I actually like the browser, alot. It gives K-Meleon, which is the Windows lightweight gecko backend MFC web browser, a bit of competition.

Re:*Sigh*

[tekshogun]

I don't dispute how nice the browser is. Regardless, it is another browser for another operating system. I use Safari on my iBook and Mac Mini. . . along with Firefox (and one day I'll trash teh IE 5.5 browser, but I don't use it anyway). But on my Windows machines, I use Firefox, Opera, and IE. Why? Well, to try something different all the time. Plus they all have something about them that the other does not have or does not do as well. So great, now we have another web browser, and it is full of holes too.

Broken, and I didn't tell apple.

[Coolhand2120]

I'm a web developer and am interested in cross validation, so I tried some of my drop down menus on one my my sites, seems safari only wants to listen to some of the 'onchange' events that the dropdown triggers. Without reloading the page I can click on a dropdown with the onchange event and it only work about 5 out of 7 times. Guess executing the javascript onchange event was faster than on IE if it happened in 0 seconds!

Congradulations!

[mehemiah]

You've found a bug in BETA software! You win a cookie! (baka!)

Just what we need!

[Anonymous Coward]

I've long complained bitterly about the lack of bug-ridden browsers available for Windows. Hopefully they'll bundle this with the next release of Vista.

It doesn't actually disappear...

[yeremein]

... it just positions itself to the right of the screen. You can right-click the taskbar icon, select "Move", and then hold the left arrow to bring it back.

What bothers me more about it is that the keyboard shortcuts for minimize and maximize don't work (Alt+Space, N / Alt+Space, X).

My guess is both these bugs came about because Apple wanted to draw their own window title (and apparently haven't heard of WM_NCPAINT).

BETA SOFTWARE...

[Anonymous Coward]

...is software that might have BUGS...Why is anyone surprised that it has bugs?

It's Still BETA People!!

[spydermac]

Dear lord, it's still a public BETA, of course there is bugs.... your talking about an inferior OS this thing is installing to. Give it time, it will rule supreme. :P

Breaking News: Software Has Bugs?!!!!!

[aaronhaley]

I just don't understand these days how telling people that software has bugs is news. Apple isn't promising it to be the most secure bug free browser ever are they? Same with IE, come on people, seriously. It's also beta software, so take it for what it's worth. Go get Firefox so at least bugs that get reported will get fixed in a timely manner.

But does it run on Linux?

[loourker]

Anybody got this to run on WINE?

PUBLIC BETA

[Oz0ne]

... Yeah? What does that mean?

It's a Beta

[NoPhD]

You guys...It's just a beta.

Why bother when...

[ivan256]

...you can release a public beta and have have thousands of publicity whores do top notch security analysis of your beta for free?

that's because... it's Apple

[Anonymous Coward]

Everything created by Apple carries with it two automatic conclusions:

First, it's going to be a buggy and poorly designed piece of crap. But it's going to be fashionable, and should match your handbag quite well.

Second, no matter how bad it is, all the Apple zealots will love it, and proclaim it to be a perfect creation from the hand of God/Jobs.

So it's hardly surprising that people are finding bugs and security holes without even trying. And, it's hardly surprising that many people (especially on Slashdot) are knee-jerk defending Apple.

Let's keep it really simple...

[wmeyer]

The security issues are not all that important to me, first because I am behind a firewall, and second, because when I installed it, Safari simply didn't work. It painted itself, but the menu text was invisible, as was all page content other than the copious ads.

Perhaps this is because I declined to install their Bonjour service, and the auto update stuff.

Bad design and test procedures. Uninstalled. Problem solved.

Re:Let's keep it really simple...

[cnettel]

You're safe from browser exploits because you're behind a firewell? Reality check?

The is a BETA version, problems are to be expected

[ChrisA90278]

Safari on Windows is a BETA version. the intent of BETA versions is for uses to use it and report any problem. Problems (of all types) are to be expected. Looks like (may) he was found one problem.

Vulnerabilities in a first release open beta!?

[krunk7]

For the love of God! Say it ain't so!

So you're saying...

[Anonymous Coward]

that on the whole, the IT security industry is NOT dangerous and irresponsible?

Considering...

[Khyber]

... that Apple probably has people that read Slashdot and Digg, the guy not informing Apple of the flaws is a non-issue. It's still going to get fixed by Apple faster than Microsoft would.

It's called "Full Disclosure"

[Anonymous Coward]

There's even a freaking mailing list. If you're a security researcher, the companies you report to will either direct you to unhelpful people, marketing, etc., threaten you or ignore you. There are relatively few exceptions. Apparently, Apple HAS done this to him in the past. Also, if these are found with that little effort, it means that Apple's QA isn't quite up to par.

As for the "oh noes! he didn't tell Apple", I'm pretty sure they know. I mean, all of Slashdot knows about this bug, so what are you worried about? I think the whole world knows now. It's not like he's keeping them secret or something.

All this crap about "responsible disclosure" is only because companies got threatened by full disclosure. They used to ignore you or threaten you without exception and it was the only damn way to get them to pay any attention to security at all. You can't just sit on bugs forever, and blowing the lid off of them very early during a public beta is actually a good time to limit the actual impact: few will have installed it yet, and it will attract more attention.

I now return you to the Apple fanboy "oh noes! they made us look bad"-fest.

One word...

[Orig_Club_Soda]

Beta

Thanks for the free debugging, guys.

He may not have to

[bflynn]

This dude may have already told Apple what he did. From the license: "3. Consent to Use of Data. You agree that Apple and its subsidiaries may collect and use technical and related information, including but not limited to technical information about your computer, system and application software, and peripherals..." fnord. Brian

BETA!

[Vexorian]

All right, thus he downloaded Safari for windows Beta, and instead of reporting the bug officially he makes buzz in his blog as if he was the ultimate security researcher for finding bugs in a BETA version!

I actually thought that part of using a Beta version of something was the responsibility to give as much feedback as possible guess I was wrong

He is actually acting foolishly this time since a more practical approach would have been waiting apple to keep the bugs in the retail release and then make the announcement ...

Well, at least it's not a report by Dvorak.

[JoshNorton]

But people still listen to Maynor? Why?

I'm not picking specifically on Maynor here, but if you read his "OMG Apple was mean to me" whines enough, it eventually makes you want to stab one of those Errata Security bloggers in the eye with a lit cigarette or something.

The other reports, I'll buy - it's not like Apple's any stranger to bugs in their code - but Maynor, no. He's demonstrated that he just wants to play the "dig ME!" game instead of actually being professional.
Never give the petulant child the attention they want - it just encourages them.

dangerous and irresponsible

[Gary W. Longsine]

No, it only indicates that a single person is dangerous and irresponsible.

Ph34r DoS !

[drozofil]

DoS is also sometimes called "nasty crash". (Like the ones you get with Firefox fairly often.) I'd like to point out that when there is no 'service' involved, there cannot be a 'denial of service'. I don't think dumb browsing is a service in any way. (Perhaps someone has an idea on this ?)

Are the anti-apple crowd that desperate

[bflynn]

Thought just occurred to me - is the anti-apple crowd really this desperate? They have to knock Apple because beta software has bugs?

It would be funny if it weren't so pathetic.

How did this get modded informative?

[SEMW]

You mean that black letters on white backgroung actually appear as black letters on white backgroud sucks? You really prefer Windows' black-letters-appear-in-rainbow-colors technology? You're an idiot. All colours on a computer screen are built up by different combinations of primary colours: red, green, and blue. See http://en.wikipedia.org/wiki/Additive_color. 'White' is just all three primary colours turned on full; 'Black' is all three turned off. Normally, letters on a computer screen are created by switch individual whole pixels on and off. The difference with subpixel font rendering is the manipulation of the individual 'subpixels' (the red, green, and blue elements that make up a pixel) to effectively triple the horizontal resolution on an LCD screen. So if you have an LCD whose subpixels are ordered RGB, the example text in the link you post will not look coloured, but will look significantly smoother than the not-subpixel-rendered text. If you have an LCD with BGR ordering, or a CRT, you will see 'color fringing'; a good font rendering implementation will automatically switch off subpixel rendering for CRTs. See the Wikipedia article for more details.

Also, I would note that Quartz (which renders fonts on modern Macs) also use subpixel font rendering; MS merely did it first.

The differences in font rendering between Windows and Mac are due to other reasons, which I explain here

Cleartype vs Quartz

[SEMW]

This really does seem to be something that splits people. People who are used to the Windows way of rendering fonts hate the Mac way, and vice versa. I explain the differences here, but the short version:

Mac fonts are designed to look as close to identical on screen as they do when printed: the Mac font renderer (part of Quartz) doesn't force glyphs into exact pixel locations and mostly ignores hints, instead using antialiasing and subpixel rendering to render fonts as print-accurate as possible. Microsoft's core Windows fonts, on the other hand, are very heavily manually hinted at small to medium sizes for maximum legibility on-screen, even if this makes them look quite different to the same fonts in print or at larger sizes.

Again, some swear by the Mac way (particularly graphics designers etc. who need things on screen to look, as much as possible, the same on-screen as what they'll end up as in print), others prefer the Windows way. (Freetype on Linux, I believe, is in-between the two, but I think closer to the Mac way). I can well imagine that on a projector, where text obviously appears very large even at small font sizes and legibility isn't an issue, the Mac way will look better; but that's not to say the Windows way has no advantages.

Re:Cleartype vs Quartz

[dangitman]

but that's not to say the Windows way has no advantages.

Maybe, but what exactly is the advantage of the horrible skinny, pixelated standard font of Internet Explorer?

Re:Cleartype vs Quartz

[SEMW]

Maybe, but what exactly is the advantage of the horrible skinny, pixelated standard font of Internet Explorer? The font you're referring to is Arial, a Helvitica knockoff, which isn't technically IE's standard font (i.e. the font that shows when no font is specified -- that honour goes to Times New Roman, for some strange reason), but rather the font that shows when a web page specifies a sans-serif font, which most web-sites do these days (e.g. Slashdot, Wikipedia, Google) since sans-serif fonts are easier to read on screen than serif fonts. And the answer is: I don't know. Actually, I happen to agree with you, it is a little narrow at small sizes; personally, I've set Segoe UI (which I'm rather fond of) as the default sans-serif font in my web browser of choice (Opera); which is a big improvement on IE's Arial.

If it's appearing pixellated, though, you just need to turn Cleartype on (even on a non-LCD, doing so will still turn on font-antialiasing). Display Settings -> Appearence -> Effects -> set Font smoothing to 'Cleartype'.

It's quite simple, really

[Anonymous Coward]

Power trip.

CS100 Lesson: Never Trust Any Input

[billstewart]

Some things have changed since I first took Computer Science 100 about 30 years ago. Some haven't. One thing that's apparently changed is that students are no longer taught never EVER to trust any input handed to their programs. One thing that hasn't changed is that you should STILL never trust any input to your programs :-)

To cut Apple some slack here, "Any time you port your program to a different operating environment with different capabilities, you need to re-examine all the decisions you made about what's safe and what's not" isn't really a CS100 kind of lesson. But it isn't a grad school lesson either.

And Safari on Windows would really rock - while I like Firefox, having another serious competitor to IE is a Really Good Thing, especially since it'll decrease the amount of IE-Specific Windows-Specific web pages out there.

Unfortunately, I've had to learn over the years that having programming safety taught as part of the intro computer course was pretty much the exception rather than the rule back when I was in school also. But on the bright side, there are lessons from those days that we've been allowed to forget, like "punch cards suck" :-) They do enforce a certain amount of valuable discipline on programmers, and I already knew how to program a keypunch drum before I got to college so I was fairly efficient about using the things, but I definitely don't miss them...

I'm seeing a lot of bashing

[BrianGKUAC]

In all directions. I have to wonder... am I the only one that saw the word BETA on the download? People's mothers won't be reporting bugs on the software because people's mothers SHOULDN'T BE BETA TESTING. Those who find bugs in the software in its current form, because it is a beta, are bound by industry standard practice to report those bugs to the vendor, not hold them in some secret report to be exposed to the public later. If your company policy forbids you from telling the vendor what the bugs you've found are due to some past experience with their customer service, you shouldn't be evaluating their BETA SOFTWARE. Am I completely off base here? Has the IT industry changed the way it operates overnight?

iTunes on Multi-User Windows XP is clumsy

[billstewart]

iTunes for Windows is the first Apple product I've used that didn't Just Work.

I run my home Windows box as multi-user - one login for me, one for my wife, and one for root - because I don't trust running Windows live on the internet with Admin privileges turned on. Unfortunately, iTunes doesn't work very well in this environment - I couldn't install it without admin privileges, so it decided to keep separate music directories for me and for root. I've been able to go in and mess with it to combine them, more or less, but it doesn't work very well and tends to forget that I did that any time I update iTunes.

I've also had some of the issues you've mentioned with Quicktime on Windows, but between Windows, Quicktime, and Mozilla's plugin frameworks, I'm not sure how much of that is because of Apple. (And I'm running Real Mozilla, not Firefox...) (Well, I've had one other Apple product that didn't Just Work, but it was an antique LC430 I bought for $2 off a pallet of dubious-condition machines acquired by a friend. I suspect it's the lithium battery or something, but it was an impulse buy and I haven't taken the time to troubleshoot it or spend more than the price of the system for the battery. I don't blame Apple for that :-)

Hey, Troll?

[billstewart]

Yeah, it's nice and stable unless you happen to browse a web page like this one or this one in which case you're toast.

Too bad - I'd really like to try Safari, and I'll put up with an occasional browser-crash exploit, but not a remote-execution exploit. After all, IE and even Mozilla have their own ways to crash, not even requiring malice on the part of the web page authors...

What the Polyannas are saying

[Zhe Mappel]

"Safari is another Trojan horse that introduces an innovation of Apple to the Windows community and entices them to the Mac platform," said Tim Bajarin, an industry analyst at Creative Strategies, a technology consultancy.

Er, um, you might call it that.

"Safari is another enticement for the Windows community to look at the Mac platform," says Van Baker, an analyst at market researcher Gartner. "If it can bring some new people into the fold, perhaps a few percentage points, that's goodness."

That's "goodness"? Ladies and gentlemen, my market analyst: the Sundance Festival groupie.

Remember, Apple never said "don't be evil"

[Anonymous Coward]

Agog with interest, I installed the beta version of Safari yesterday.

This morning, what do I find?

A pop-up box asking me if I want to download Quicktime & Itunes.

I most certainly didn't ask to be told about updates even to Safari, never mind any other Apple products. Is there any way to turn this crap off, or do I have to uninstall Safari? Or even after?

Bastards.

Maynor's exploit seems to be real

[sentientbrendan]

The exploit against airport seems to be real as far as I can tell... there were a bunch of youtube videos circulating showing that he actually hacked a machine with stock airport instead of a third party wireless card as he implied in the video, but the exploit itself seems real... after all a patch was issued that checks for malformed 802.11 frames...

If there's some real evidence that apple didn't get their bug from him, I'd like to see it. Most of the stuff on the web seems to merely point out that he *could* have faked the exploit video (indeed it would be easy to fake such a thing). They also point out that he was misleading about using a third party wifi card, possibly to make it clear that his hack wasn't apple specific (I'm unclear on the reason for this).

I'm not saying I'm some kind of expert on this guy, I'd never heard of him before you mentioned him, but some googleing suggests that he may have been legitimate, but was subject to a smear campaign by a bunch of people offended by the idea that he hacked a mac. I'd really like to see some conclusive information either way about his hack, preferably from apple.

Some of his other (unrelated complaints) against OSX seem to be legitimate in that OSX doesn't implement address space layout randomization and other features to break buffer overloy exploits which vista does. This seems like a reasonable complaint, or at least a reasonable feature request.

Re:Maynor's exploit seems to be real

[the pickle]

All you need to know about Maynor, from the level-headed and well-spoken John Gruber:

http://daringfireball.net/search?q=maynor

Gruber is probably somewhat biased in favour of the Mac as a platform but certainly has no compunctions about taking Apple to task for their flaws either.

p

You're still wrong. Firefox renders its own UI.

[Anonymous Coward]

Firefox renders its own UI, rather than passing it on to Windows. Need proof? Run it on Windows 95 (with an updated comctl32.dll) or on Windows NT 3.51 SP5 (also with proper patches) or on NT 4.0. Notice how the menu bar behaves completely different than inside its own environment. No native app on 95 / NT looks like this.

Also check it out on XP. Right click on the scroll bar. There is no "Scroll Here" or other options.

Take a look here to see some examples of what I am talking about. A picture is worth a thousand words.

Re:shooting the messenger : Bearded guy?

[Einstein's Bees]

Surely, you must be referring to
Jesux ??

OK. Sorry- I won't call you surely anymore...

Repeat after me...

[bandmassa]

Beta Version, people, Beta Version.

Blank, unusable

[crm911]

Nobody has mentioned this that I can see, but I get completely blank buttons. No text on them. I know there are buttons as they show outlines when I mouse over them. I can click and get the canned pages to load. I cannot enter any URL of my choice. Let's see what the release version brings.

No mention of the XP taskbar bug?

[Despero]

For some reason, when I am using Safari on my computer (Windows XP SP2), and Safari is maximized, my taskbar cannot be accessed. I have my taskbar set to auto-hide, so this is possibly what is causing the problem (I haven't checked to see if turning auto-hide off will fix the problem, because frankly I'm too lazy, don't care, and I am not going to change my Windows settings to cater to Safari, as I am only using it to test it out and see what it's like. I have already decided to go back to Opera very soon). Either way, this is quite an annoying bug, and has accelerated my decision to return to using Opera so soon. It's too bad Apple couldn't have polished this release more before unwrapping it to the public. I am aware that it is a beta release, but I've used many different beta versions of browsers before that are far superior to this one. I've heard many reports of bugs, errors, faulty security, etc. with Safari that makes it seem almost on the same level as IE. Apple's bringing iTunes to Windows was a great idea that was executed well. I have used iTunes on Windows since day one, and I haven't been disappointed. It's sad that Apple couldn't repeat this success with Safari, since Safari is such a great browser on Mac OS X. When my new MacBook Pro finally ships, I will very happy to use Safari on it, but unfortunately I will have to wait until then, because on Windows I'm definitely sticking with Opera. And before I switched to Safari, I would switch to Firefox, which I still use a lot but not as my default browser.