Apple Safari On Windows Broken On First Day

An anonymous reader writes "David Maynor, infamous for the Apple Wi-Fi hack, has discovered bugs in the Windows version of Safari mere hours after it was released. He notes in the blog that his company does not report vulnerabilities to Apple. His claimed catch for 'an afternoon of idle futzing': 4 DoS bugs and 2 remote execution vulnerabilities." Separately, within 2 hours Thor Larholm found a URL protocol handler command injection vulnerability that allows remote command execution.

Comments

He notes in the blog that his company does not

[gsfprez]

report vulnerabilities to Apple because he is a total fsckwad loser attention hound.

Thanks for the news about the vunerabilities, Paris Maynor.

Re:He notes in the blog that his company does not

[Kadin2048]

Yeah -- what the hell.

I can understand not sitting on a vulnerability -- there are some valid points both for and against full disclosure -- but not notifying the company at all? WTF.

This is the sort of stuff that just makes the whole IT security industry, and everyone involved in it, look dangerous and irresponsible.

Re:He notes in the blog that his company does not

[DA_MAN_DA_MYTH]

Maybe they should start paying for the world. Releasing buggy software and expecting people to QA it for you FOR FREE is insane. Maybe apple, microsoft, and the rest of these asshole companies should start hiring some decent testers. You fanbois can stop whining too, or are you offering to compensate these guys for bug testing your favorite lame software?

Ah yes, giving away FREE software and expecting people to use it for FREE. In turn for that FREE use, if someone finds a bug it's absolutely ludicrous to expect them to report it.

Now mind you I understand why they may be giving it out for FREE, probably so people can FREEly develop for the iPhone, widgets and browser.

Maybe they should have created an IDE that wasn't FREE so you can pay for the tools to develop on their FREE platform, and use that money to pay for the QA department, so I can be FREE of you haters and your whining.

Re:He notes in the blog that his company does not

[ubernostrum]

I wondered who'd be the first to launch an ad hominem attack - and look, right in the first comment.

How about we try it this way:

Maynor claims to be a professional security researcher. One of the cornerstones of professionalism in that field is responsible disclosure of discovered vulnerabilities. Another is full disclosure of vulnerability details after a vendor has had a reasonable amount of time to correct the vulnerability. Yet another is working to advance the overall state of computer security. But Maynor has a track record of irresponsible, partial-at-best disclosure: he claims discovery of vulnerabilities while proclaiming that he will not report them to the vendor, and strives to hide the details of his discoveries from open review by his peers in the security community (for example, witness the endless controversy over the alleged MacBook wifi hack, all of which could have been settled quickly and objectively by simple peer review of the exploit he claimed to have used). And none of this can, so far as I can see, be construed as advancing the state of computer security in any fashion.

In other words, there is no sense of the word "professionalism" for his field which seems to be reasonably applicable to Maynor. Before you go screaming "ad hominem" or "Apple Fanboi", take note of two things:

1. All I've criticized here are the man's methods, not the man himself. I don't even speculate to his motives for operating the way he does.
2. I'm typing this on a MacBook Pro, and I do like both it and the operating system it runs, but neither are particularly essential to me -- at this point I can move between (Unix-y) operating systems with relative ease, and occasionally do as needed (prior to this MacBook, I used various forms of Linux exclusively for about six years, and still use them on a regular basis. The only OS I have a prejudice against is Windows, and I've even got that available, virtualized, when I need to test things in it).

I await your reply.

Re:He notes in the blog that his company does not

[speaker of the truth]

Ah yes, giving away FREE software and expecting people to use it for FREE. In turn for that FREE use, if someone finds a bug it's absolutely ludicrous to expect them to report it. Of course it is. There is no way I'd expect my mother to report a bug. However what isn't ridiculous is expecting someone who deliberately seeks out a bug, has the ability to reproduce it, and has blogged about it and also calls themselves a security analyst, to actually report the bug. Heck, only a link to his blog post would probably be helpful to Apple. That takes very little effort on his part, so its not unreasonable to expect it.

Re:He notes in the blog that his company does not

[argent]

Truth is, if the guy had reported the bugs/vulnerabilities to Apple, they more than likely would have done what they always do, wait months to push a fix out or just deny their existence altogether.

Did you read the disclosure policy?

Keeping with our disclosure policy, we do not report bugs to Apple.

It doesn't say

Keeping with our disclosure policy, we do not wait for a response to the bugs we report.

If it said that, your comment would make sense. That would be something like ... "We don't think Apple will fix it, so we won't wait before announcing it". I could see that (though not agree with it). But "We don't think Apple will fix it, so we won't even TELL them about it" is totally irresponsible. The only "rational" interpretation of that is he actively wants to make it harder to improve the security of Safari.

Do you have a better explanation, or a justification for that approach?

Re:He notes in the blog that his company does not

[lordsid]

No better day to blow the whistle then the same day it's released. Much smaller chance of a user base being affected by it.

Re:He notes in the blog that his company does not

[shaitand]

'Ah yes, giving away FREE software and expecting people to use it for FREE.'

Apple is a commercial entity. As long as Apple is still making a profit nothing you get from Apple is free, it may not be the guy browsing but someone is footing the bill. You can certainly bet that Apple didn't just drop their bottom line by the cost of developing and distributing the software.

It reminds me of the last time I called Comcast. I ordered Showtime for the Showtime on demand movies and while the channels came in the video on demand gave an error code (very annoying since I never waste my time watching whatever they are force feeding at the moment and watch what I want when I want with the video on demand). It took them 3 months to fix it and they had the nerve to charge me for Showtime during that time. Naturally I demanded a credit and the girl tried to claim that I was paying for the channels only and the video on demand was a free service they gave me out of the kindness of their hearts so there was nothing to credit. I told her that was wonderful, take away all that expensive programming I pay all that money for and just leave me the free stuff. She told me that it only comes free with the paid programming. I told her to make up her mind, either they are giving me the video on demand for free or they require me to pay them money in order to receive it.

Re:He notes in the blog that his company does not

[NMerriam]

apple threatened to sue if he disassembled the airport,

Yeah, the only problem is that he is the only security researcher on Earth who has ever even claimed to be told this by Apple, and he has provided no evidence whatsoever of this supposed threat. Somehow everyone else who notifies apple of vulnerabilities and even demonstrates them later has managed to not get sued or taken out by thugs in a back alley.

Basically he has posited a grand conspiracy with nothing but his own word that it exists. Nobody else who deals with the same people at the same company in the same manner has any idea WTF this guy is talking about.

Re:He notes in the blog that his company does not

[dfiguero]

What is it with the "Apple fanboi" phrase appearing on every Apple article. I don't use Macs at all and I'll probably won't use Safari as I'm pretty happy with FF and I don't see a reason to switch ATM.

However, I'll agree that the attitude this researcher has is terrible. For starters how do we know he actually discovered all these vulnerabilities? I could claim I discovered some too and I won't disclose them. Secondly, why wouldn't he share the information with Apple, why bother discovering all these vulnerabilities in the first place? It's not like he's a black hat (AFAIK) so the only other reason I see is the attention you get from such comments.

Besides I'm sure some people will gladly help Apple test their _beta_ browser. I'm all for more competition on the browser space, put some pressure on all players so they produce better stuff.

Re:He notes in the blog that his company does not

[shaitand]

'Next time there's a store near you having a buy-one-get-one-free sale, go on in and tell them you'd rather not have two of whatever it is, and could they please just give you the free one by itself. See how well that works for you ;)'

That's my point. You aren't getting anything free with a buy-one-get-one-free sale. The 'free' ones cost the store money, they are an expense, the store bases its prices on its expenses plus a markup. That 'free' one increased the price of other items in the store. In other words, it wasn't free at all.

Re:He notes in the blog that his company does not

[theTrueMikeBrown]

He probably did discover those vulnerabilities - the reason why I say this is because I also discovered similar mysterious vulnerabilities, ones that will disappear if I ever tell anyone about them. Oh, and I discovered 598 of them, and they would allow me to elevate my privileges AND mind control the owner of the computer running the software EVEN THROUGH TINFOIL HATS!

Yeah, so you all can shower me with undeserved praise now and slashdot my website and argue over weather I hate macs, or weather I am a communist, or the anti-Christ (or both).

Re:He notes in the blog that his company does not

[Pc_Madness]

What does it matter..the total amount of Safari for Windows users is what? A few thousand? He was definitely irresponsible putting all of those people who decided to try out beta software in harms way. [/endsarcasm]

What did he achieve? He managed to make Apple look stupid with their crap about how secure they are. He wasn't even trying and find holes in their software.

Oh and I own two Macs before anyone calls me a fan boy of something else.

Re:He notes in the blog that his company does not

[Sparks23]

Offtopic here, but that's generally a really severe pressure that game developers get from their publishers, unfortunately. It's particularly severe there; it is not as if you have 'Electronic Wordprocessor Monthly' grading the latest import productivity apps, and raising the hype on them all.

("Capcom ExpenseBlaster 3 Turbo gets an 8/10 for the blazing next-generation way it lets me balance my checkbook!" "I'm sorry, but this one felt lacking to me. It was anemic in terms of features, especially compared to other contenders like Rockstar's 'Grand Theft Accounting,' and the money-laundering options. Only a 4/10.")

That doesn't stop people from proclaiming doom and gloom and trying to point out alternative software if non-game products slip, of course. Which means more than game developers get the market pressure to just 'get a 1.0 app out there, and patch it later,' albeit a bit less than game developers do. Which sucks, but... the cause of this one unfortunately lies with both the developers and consumers, I think.

Re:He notes in the blog that his company does not

[eldepeche]

1. This is beta software. It has bugs in it.

2. Officially released software has bugs in it, unless you just run the base NetBSD system with only port 22 open, which is reasonably useless.

3. What is the difference between publicizing a bug and telling the developers what it is, and publicizing a bug and not telling the developers anything? There's a higher likelihood of the bug getting fixed if the devs are notified, and you still get traffic to your stupid blog. If you give a shit about software security and not just ad revenue, maybe you ought to report the bug.

4. THIS IS A BETA TEST VERSION OF A WEB BROWSER.

Re:He notes in the blog that his company does not

[hattig]

He's correct though. This isn't related to Apple in any way, it's related to mature, professional disclosure of computer software bugs, holes and issues to the maintaining company so that they can fix it, and thus keep computers secure.

Re:He notes in the blog that his company does not

[john83]

If it said that, your comment would make sense. That would be something like ... "We don't think Apple will fix it, so we won't wait before announcing it". I could see that (though not agree with it). But "We don't think Apple will fix it, so we won't even TELL them about it" is totally irresponsible. The only "rational" interpretation of that is he actively wants to make it harder to improve the security of Safari.

Do you have a better explanation, or a justification for that approach? [note: I'm not the 'you' referred to in the parent]
Why would someone announce that he's found a vulnerability but refuse to disclose it to the vendor? Some ideas:
a) He wants to hurt the reputation of the product/vendor. (This doesn't even require the existence of a real vulnerability.)
b) He wants to sell the specifics vulnerability, either to the vendor or to the highest bidder (in which case, this is advertising).
c) He doesn't care about the security side of things, he's just earning himself some free PR on sites like this which will publish his unsupported claims uncritically.
d) This is his idea of fun.

Anything I've missed?

Re:He notes in the blog that his company does not

[SharpFang]

Citing the blog:


UPDATE 5: I've been asked what our disclosure policy is. Its pretty simple, in most cases we will give vendors as long as they need to fix problems. If the vendor is unresponsive or make threats, we will give them 30 days then release details. If a vendor answers a vulnerability disclosure with marketing and spin attempts, we no longer report vulnerabilities to that vendor but the information goes into our Hacker Eye View program for customers and will be used in pentesting. We do not sell the vulnerabilities to any 3rd party.

Seems the very likely scenario that they reported a critical vulnerablity and Apple tried to troubleshoot them "Is the network cable plugged in?" or "Our software is absolutely secure, your don't need to worry about it, our software has been throughoutly tested." or such. A security expert who gets flushed down the toilet by a marketoid is quite likely to hold a grudge against given company and report the following bugs elsewhere than said company.

Re:He notes in the blog that his company does not

[rtechie]

I'll bite. Maynor described vulnerabilites. Maynor immeadately goes public with Mac vulnerabilites because he (in the past anyway) has claimed that Apple has ignored private disclosures. I've has exactly the same experience (many years ago) so I can support him on this point.

The primary question is: Are the vulnerabilites real? If so, then Maynor has provided a valuable service to the community out of the kindness of his heart. Period. Whining about him not telling Apple first is just whining. When YOU do the work then YOU can choose how to release the info.

I also seriously take umbrage at the notion that immeadiately disclosing vulnerabilites is somehow "unprofessional". Is is MORE professional to leave production environments vulnerable while you're waiting for the vendor to get his act together and send you a patch?

How the hell do you think this works in the Linux world, the world you supposedly come from? Most vulnerabilites are immeadately disclosed on Linux, because open source allows anyone to produce patches quickly, but according to you that is somhow "unprofessional".

Re:He notes in the blog that his company does not

[LKM]

I'll bite. Maynor described vulnerabilites. Maynor immeadately goes public with Mac vulnerabilites because he (in the past anyway) has claimed that Apple has ignored private disclosures. I've has exactly the same experience (many years ago) so I can support him on this point

Looking at changelists for bugfix releases of Mac OS X, Apple regularly fixes non-public vulnerabilities and credits the people who found them. They do downplay these issues, and some managers from Apple have publicly lied about vulnerabilities in the past, but they do fix them pretty quickly and give proper credit.

For all we know, Maynors own account of his issues with Apple bear little resemblance to what really happened.

Re:He notes in the blog that his company does not

[mollymoo]

I wondered who'd be the first to launch an ad hominem attack - and look, right in the first comment.

Thanks for reaffirming my faith in Apple Fanboi nature.

I wondered who'd be the first to call anyone who didn't scream 'Apple are teh sux0r' a fanboi - and look, right there in the second comment.

BTW, incorrectly using a latin phrase in an effort to look clever just makes you look like a pretentious twat.

Re:He notes in the blog that his company does not

[Altus]

Ah, I see. So this is a religious thing. I wont bother arguing then.

Re:He notes in the blog that his company does not

[Qwerpafw]

Before people start jumping on you (oh, too late) they should look at any of Apple's security updates. Apple routinely credits the people who report vulnerabilities. The majority of "bugs" in security updates are patches to third party stuff from the OSS community, and Apple finds stuff internally, but if you report a vulnerability and Apple patches it they credit you.

for example, in Security Update 2007-5

mDNSResponder

CVE-ID: CVE-2007-2386

Available for: Mac OS X v10.4.9, Mac OS X Server v10.4.9

A remote attacker may be able to cause a denial of service or arbitrary code execution

Description: A buffer overflow vulnerability exists in the UPnP IGD (Internet Gateway Device Standardized Device Control Protocol) code used to create Port Mappings on home NAT gateways in the OS X mDNSResponder implementation. By sending a maliciously crafted packet, a remote attacker can trigger the overflow which may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation when processing UPnP protocol packets. This issue does not affect systems prior to Mac OS X v10.4. Credit to Michael Lynn of Juniper Networks for reporting this issue.

and

VPN

CVE-ID: CVE-2007-0753

Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9,Mac OS X v10.4.9, Mac OS X Server v10.4.9

Impact: A local user may obtain system privileges

Description: A format string vulnerability exists in vpnd. By running the vpnd command with maliciously crafted arguments, a local user can trigger the vulnerability which may lead to arbitrary code execution with system privileges. This update addresses the issue by performing additional validation of the arguments passed to vpnd. Credit to Chris Anley of NGSSoftware for reporting this issue.

So shut up and read up before making up claims about how Apple hates security researchers.

Re:He notes in the blog that his company does not

[rtechie]

Maynor might be a liar or confused about the vulnerabilites. This dos not seem to be the case based on my reading, and nobody seems to be saying that the vulnerabilites he found did not exist.

The issue seems be the notion that it is somhow "wrong" for Maynor to disclose the vulnerabilites without informing Apple and giving them time to fix it. Maynor claims that IN THE PAST Apple has been uncooperative WITH HIM. So based on his OWN PAST EXPERIENCE he chose to release the vulnerabities publically. He did nothing wrong.

Frankly, I'd be a little pissed off. Maynor is doing valuable free work for Apple and he's getting pissed on by the Apple community for it.

Re:He notes in the blog that his company does not

[Mattintosh]

I'm pretty sure the "bug" button is prominent in the Safari Beta UI for a reason, and being an attention hound isn't it. If this guy found bugs, he should push the damned bug button and report it back to Apple. After he's done that, he can blog about it to gloat, inform, or whatever else he feels he should do. But to blog/gloat/inform before sending the report to Apple (remember, it's one fricking button) is just asshattery.

Re:He notes in the blog that his company does not

[pudge]

because he is a total fsckwad loser attention hound.

I wondered who'd be the first to launch an ad hominem attack - and look, right in the first comment.

Thanks for reaffirming my faith in Apple Fanboi nature. Oh, grow up. Maynor is, by definition, someone no one should care about. If he reported his vulnerabilities, he would be worth listening to. Since he does not, he is not.

Maybe that's because...

[YowzaTheYuzzum]

... it's a beta version.

Re:Maybe that's because...

[gbulmash]

What makes me scratch my head... if these guys can find holes in a few hours, why can't Apple? It's not like these guys spent months to find some really obscure bug. They banged away with known attack vectors and got near-instant results. In a case like that, "it's a beta", particularly when it's been hyped at a big event, rings VERY hollow.

IMO... If you release it quietly, so only the diehards are really pounding it, you can keep the "it's a beta" excuse. If you hype the release, you lose the excuse.

- Greg

Re:Maybe that's because...

[Jeff DeMaagd]

Given the complaints I've seen elsewhere, I think that the quality is closer to alpha stage development. Usually, "public beta" is done on software that's almost ready for use, but has minor bugs. The reports I've seen are that there are a lot of serious bugs in rendering and stability, and now, major security problems.

Re:Maybe that's because...

[jeffasselin]

Indeed. The issue not being that Windows is less secure, but that it's a different platform, and as such would expose any code to completely different vulnerabilities.

Re:Maybe that's because...

[cgenman]

What makes me scratch my head... if these guys can find holes in a few hours, why can't Apple?

Because 100,000k security researchers and hackers all typing away at keyboards will eventually write Shakespeare?

I don't care how bright your engineers are or how well you've planned your security model, the moment you put it on the 'net it WILL be hacked. That doesn't mean it will stay hacked, so much as the task of securing a system against simulated internal attacks will uncover different problems than putting it in the wild.

Re:Maybe that's because...

[moosesocks]

Eh. iTunes on Windows is alright in my opinion.

It's quicktime that's the absolute mess -- It's gotten better since iTunes came along, but compared to the lightweight framework that it is on the mac, the windows version absolutely sucks. It's just an incredibly sluggish, and somewhat useless media player.

On OS X, Quicktime is essentially a fairly versatile media framework that, given the proper codec, can play just about anything. Virtually all mac applications that require the manipulation of media files utilize it. The file format also allows for some pretty darn cool nondestructive editing -- Final Cut Pro is more or less just a fancy utility for manipulating QuickTime files.

QuickTime player is simply a front-end application that makes use of the framework. Its Windows counterpart is a mere shadow of its former self.

On the other hand, VLC natively plays every format under the sun on every platform under the sun. Come to think of it, it's the only app I know of that works extremely well on all 3 major platforms (Firefox isn't so hot on the mac)

Many people blame the presence of a Windows version for preventing Apple from transitioning iTunes over to a Cocoa app. I can hardly blame them either -- Cocoa apps tend to be a bit more stable and 'snappy' (it's a really nice framework)

I wouldn't completely knock Safari without giving it a chance. Safari itself was based off of KHTML (and the Apple devs still contribute back regularly to the KDE/Konqueror folks). If they ported it once, porting it twice shouldn't be a terribly huge issue once the initial kinks are worked out.

Re:Maybe that's because...

[ceoyoyo]

Hm... I didn't see any TV commercials about Safari on Windows. I did hear about an announcement at an annual conference for developers.

Re:Maybe that's because...

[the pickle]

"if these guys can find holes in a few hours, why can't Apple?"

David Maynor has a track record as a publicity whore first and legitimate security researcher second, so whether Maynor has actually found as many bugs as he claims to have found here is up for debate until he provides some more substantial proof. He also has a giant ax to grind after Apple embarrassed him in the AirPort bug fiasco. I'd take anything he says with a grain of salt until he gives me ample reason to trust him again.

Nice policy, by the way: find bugs and don't ever report them to Apple. Because last time you claimed to have reported a bug, Apple exposed you as a liar, so now you just don't bother. That's brilliant. We need more people in the world with that kind of attitude. And Maynor wonders why people don't take him seriously as a "security researcher". The Blogspot-based announcement doesn't help either. That's like your company e-mail address being @hotmail.com.

Thor Larholm, on the other hand, may well have found a legitimate bug. What with this being beta software and all, that's not too incredibly surprising. Equally serious bugs have been found in release versions of Firefox and IE, so I'm not sure what the big deal is here. If Safari 3 ships with these vulnerabilities still unfixed, then people should worry.

p

Re:Maybe that's because...

[Grail]

If the "known attack vector" is actually a bug in the Microsoft Windows JPEG handling API, will you still be crowing about Safari 3 for MS Windows being broken? Go have a look at the number of problems that exist for previous versions of Microsoft Windows XP, in particular relating to graphic formats of some kind or another.

Besides, from the screenshot of the crash reporter, it's a null pointer dereference (not a heap overflow) - so sure, it's a remotely exploitable denial of service attack, but the browser crashes because the software has detected a problem and decides that the safest way out is to dump core. Let's all go tell the world how broken Safari 3 for MS Windows is!

For example: http://www.trendmicro.com/vinfo/secadvisories/defa ult6.asp?VName=(MS06-078)+Vulnerability+in+Windows +Media+Format+Could+Allow+Remote+Code+Execution+(9 23689)

Have fun.

Re:Maybe that's because...

[LO0G]

The problems that were found were found by fuzzing HTML output. That's not platform specific.

And similarly, the canonicalization failure handling iframes is not platform specific. Apple knew about the potential for exploitation of that particular vulnerability, they mitigated it for basic links, but didn't when the link was in an iframe. So again it's not platform specific.

nuf said.

Re:Maybe that's because...

[VGPowerlord]

QuickTime player is simply a front-end application that makes use of the framework. Its Windows counterpart is a mere shadow of its former self.

Based on the wording you used, when you said "Its Windows counterpart," I thought you were referring to Windows Media Player, which, as I understand it, is just a(n ugly) GUI over top of DirectX Media. Fortunately, there are alternate players, such as Media Player Classic (an open source player that resembles Windows Media Player 6.4 with some extra features) and additional codecs, including one to play Quicktime files.

I wouldn't completely knock Safari without giving it a chance. Safari itself was based off of KHTML (and the Apple devs still contribute back regularly to the KDE/Konqueror folks). If they ported it once, porting it twice shouldn't be a terribly huge issue once the initial kinks are worked out.

I'd consider using it if it didn't completely ignore some of Windows' GUI conventions. I hate skinned apps, with a passion. I tolerate Opera and Firefox simply because they have skins that resemble my OS... thanks to a "feature" of Windows dealing with Window Handles, even Internet Explorer has to recreate all the Windows controls that it wants to use (except <select> up through IE6) rather than using OS native widgets.

Other than the obvious non-standard widgets, you have

1. Missing application menu in the upper-left corner. This menu contains menu items for Minimize, Maximize, Restore, Move, and Size. This menu is still accessible via its keyboard shortcut (Alt-Space). Present since: At least Windows 3.0, 1991
   
2. Missing minimize animation. Present since: At least Windows XP, 2001
   
3. Maximize/Restore animation is odd, it resizes one dimension at a time. Windows itself resizes both dimensions at a time. Present since: At least Windows XP, 2001
   
4. Resizing can only be done from the lower-right corner. Windows allows resizing from all four sides and corners. Also, the cursor does not change when moved over the resize area. Present since: At least Windows 3.0, 1991
   
5. Clicking on the Safari icon in the taskbar when it is minimized performs the restore operation, even if the Window was maximized before... in other words, it shows the window maximized for a split second, then resizes it.
   
6. You can resize a maximized window. Windows programs normally don't let you do this.
   
7. Clicking on a taskbar icon for a window that is currently in front should minimize that window. Present since: Most likely Windows 95, 1995.
   
8. Some dialogs are missing close buttons. History, Show All History and Help, About Safari off the top of my head. In fact, the only way I found to close the History window was counterintuitively through Bookmarks, Hide All Bookmarks.

Re:Maybe that's because...

[Tony Hoyle]

But it just seems to me that they need a "devious little shit" department

Apple have plenty of lawyers already.

Re:Maybe that's because...

[saintlupus]

But it just seems to me that they need a "devious little shit" department

They should put Neidermeyer on it?

--saint

Re:Maybe that's because...

[99BottlesOfBeerInMyF]

Given the complaints I've seen elsewhere, I think that the quality is closer to alpha stage development. Usually, "public beta" is done on software that's almost ready for use, but has minor bugs.

The standard everywhere I've worked has been:

• milestone - a development snapshot at some point for some feature set. Not feature complete or debugged.
• alpha - not feature complete, not debugged. Significant milestone - let a partner company or two take a look and give feedback.
• beta - feature complete - but not fully debugged, let selected users pound on it and find some more bugs.
• release candidate - we think we have all the important bugs out, barring appearance a new, big one, we ship this.
• gold master - the release candidate we did not find enough bugs in and are shipping out.
• recommended version - the gold master we shipped plus whatever important patches have been developed since that time.

The reports I've seen are that there are a lot of serious bugs in rendering and stability, and now, major security problems.

That sounds right for a beta to me. All of the things you list are in the category of bugs, not missing features that are supposed to be in. Beta code is not yet fully tested and has not been pounded on by users. It will almost always have these type of bugs.

Wow

[mabinogi]

Bugs in the first public beta release!
Who would've thought it!

Incidentally, it doesn't seem to like authenticating proxies at all, so my first experience with it was a bug too :/

However, making a big deal of, but not reporting bugs found in a beta release of something seems more than a little silly.

I've said it before and I'll say it again

[pboyd2004]

I'm not surprised. Apple really doesn't write more secure code, they just have a lower market share and thus aren't as much of a target.

And alot of their success at security on Mac OS is just them inheriting some of their security from the BSD kernel which I'm positive beats the hell out of the Windows kernel in terms of security.

Fuzzing, not futzing. Proofread much?

[lennier]

The quote is "an afternoon of idle _fuzzing_". As in fuzz testing.

Re:it's beta

[josepha48]

I have noticed posts like this on /. in the past year or so. Someone releases a beta and then people say it has bugs and it is broken. They said the same thing when IE7 beta's were released. What is it about the word beta that people on /. don't get?

From wikipedia -> http://en.wikipedia.org/wiki/Software_release_cycl e#Beta , this is a prototype / preview / early access.

Report the bugs and they will probably get fixed.

I'm amazed that things like this get to the story line on /. .

Re:Installing Safari 3 public beta on G4?

[Anonymous Coward]

Make sure your current copy of Safari is still in /Applications/. The beta won't install otherwise.

yes, safari is faster!

[alta]

Remote code execution 2.5 times faster than FF on windows!

Alpha or Beta?

[eebra82]

I was actually looking forward to try this browser out, but to my surprise, I could not even make it work.

The installation was smooth without any unexpected bumps on the road. First when I loaded the program, I noticed that no menu fonts nor any fonts whatsoever on the web pages existed. To make it worse, the browser would crash every time I clicked on anything with interactivity, such as the stop button. I have read quite a few solutions to this problem but so far no success. I run Win XP SP2, btw.

Anyway, there are more problems around the corner. According to the Apple forum, people can't play Windows Media files, dual monitor support is very buggy, some buttons screw up the GUI when pressed down and dragged, loads of spontaneous lockups, random letters appearing everywhere, installation problems, parental control issues and more.

Also, I am not a big fan of customized GUI:s for crucial applications like a web browser. We should be able to use Windows ClearType instead of the ported OSX version (which sucks), and most importantly, we should be able to use the standard Windows themes. I don't get why Apple thinks the average Windows user would want a significantly altered browser that looks nothing like the rest of the operating system he or she is using. How would Mac users react if Internet Explorer was ported with the Windows theme?

I think it looks like a promising project, but I am worried because it's not in Apple's nature to release beta software with so many bugs and so little heart put into it.

Re:Alpha or Beta?

[SpeedyDX]

How would Mac users react if Internet Explorer was ported with the Windows theme? If it's Internet Explorer, the theme would be the last thing I'd be worrying about.

Re:Alpha or Beta?

[cowscows]

I have no inside knowledge of any of Apple's plans, but I wonder if they didn't sort of rush the Safari for Windows beta release to quell a bit of the noise that some people have been making about the lack of 3rd party development for the iPhone. Along with this new version of safari, Apple announced today that the way to get your app onto the iPhone is through web applications, and safari is what the iPhone is going to be running. And I guess they decided to release Safari for windows now, just to show that they're serious about letting devs work on iPhone Apps.

Apple most likely wants as much free press about the iPhone as is possible as it gets closer to its release date, so why not get the dev community a little more excited. It sucks that this safari beta isn't quite ready, but safari is pretty well respected on the mac, so I have faith that it'll quickly improve on Windows.

Re:Alpha or Beta?

[bahstid]

No, no, no! Lynx has browser ascetic. You are thinking of aesthetic

Re:Alpha or Beta?

[DrXym]

Ask them, IE 5 WAS ported with the windows theme.

Well not entirely - IE 5 had a fruit flavoured theme to go with iMacs of the day, and the UI was distinctly Mac like. But Mac users have certainly gone batshit crazy over past versions of Office.

Windows users tend to be more levelheaded and / or apathetic. Instead of protesting, they'll simply ignore Safari altogether. The Safari 3.0 UI in Vista is awful - totally nonstandard in every respect. It's bad enough to have an Aqua-esque theme foisted into iTunes (at least most secondary dialogs paid some lipservice to the system theme) but it's even worse in Safari where everything picks up Aqua. The perverse part is that OS X apps call a theme engine to render widgets. So Apple must have ported the theme engine to Windows and hardcoded it into Safari rather than using the one in the operating system.

I really don't see any reason that Safari will take off on the Mac until it tries to integrate. Ironically the reason Safari succeeded at all on the Mac was because of Apple's dissatisfaction with Firefox & Camino (an OS X app using Gecko) for not being native looking enough. Now they're foisting a totally alien Safari onto another OS and expecting it to take off - it's not gonna happen.

Re:Alpha or Beta?

[dangitman]

Also, I am not a big fan of customized GUI:s for crucial applications like a web browser. We should be able to use Windows ClearType instead of the por

Well, firstly, there appears to be some bug with the Safari beta, possibly interacting with your Windows installation.

But Cleartype? Man, that sucks. The worst thing about web browsing on Windows is that text looks like shit. It would be nice to have a Windows browser that does decent text display. This is a huge problem where I work - where web pages are often viewed on a data projector screen for a large audience. Some projectors are hooked up to a Mac, some hooked up to a Windows machine. The output from Windows machines is uniformly terrible - which makes me wonder why they even bother using Windows on machines that drive projectors. In contrast, the Mac web browsers look great. So, if Safari on Windows (if it works) hopefully will provide a way to have a decent way of rendering web pages on large screens, and help us escape the misery of Cleartype and Internet Explorer.

Re:Alpha or Beta?

[drew]

I don't get why Apple thinks the average Windows user would want a significantly altered browser that looks nothing like the rest of the operating system he or she is using.

I take it you haven't actually seen IE7 yet? Besides, somehow or other, they've convinced people to actually use iTunes on Windows, so maybe there is hope...

So many keep saying "but it's a BETA"

[lena_10326]

..."that you should expect bugs in a BETA"

Come on. You have to admit remote execution of any cmd is pretty bad even for a beta. This ain't your run of the mill bug, like a UI glitch or rendering type of bug. It makes the beta unusable and thus not a very useful beta. (Unless you're testing how your own trusted website looks under Safari.)

Re:So many keep saying "but it's a BETA"

[mabinogi]

Well the point of a Beta release is to increase the userbase so as to increase the amount of testing.

If they could guarantee they could get the security bugs out before releasing a Beta version, then they'd be able to guarantee they could get all the other bugs out too, so then it wouldn't be a Beta release, but a final release.

You just have to accept that if a company has said "this is a beta release, it will have bugs", that it will have bugs - all types of bugs, not just "safe" bugs. Also, the severity of the effect of a bug has no correlation with how easy it is to locate.

People have become way too complacent about trying beta quality software these days. Don't try it if you don't want to take the risk.

Re:So many keep saying "but it's a BETA"

[lena_10326]

Well the point of a Beta release is to increase the userbase so as to increase the amount of testing.

Yea. Increase the userbase. Of course, they just did the opposite and scared them away. Lesson here: never show your unfinished work. A first impression only comes once.

You just have to accept that if a company has said "this is a beta release, it will have bugs", that it will have bugs - all types of bugs, not just "safe" bugs.

A bug that lets any old script kiddie put up a page that can execute del /S c:\* on my PC is beyond the level of anyone's expectation of a bug. Why would I bother with Safari now? Sure. They'll release another, new, improved beta... bug free, but will I trust them?

No.

Even with a free beta I have a reasonable level of expectation. That the program not destroy my machine with basic usage. That the program not allow remote execution. That the program provide some core functionality as advertised. This version of Safari is well below those expectations.

Re:So many keep saying "but it's a BETA"

[mabinogi]

If your faith is so easily shaken, then don't install beta software.
Wait until the bugs have been found, and install the final release.

A bug is a bug, and there's nothing special about security related bugs that makes them easier or harder to find than non security related ones, so as I said before, a company cannot guarantee that a product will have no security bugs unless they can guarantee that it will have no other unknown bugs. Obviously they can choose to fix the security bugs over the non security ones, but as long as there are bugs they have not discovered, then those undiscovered bugs can be security related. That's just how it is, and no amount of whining will change that.

Re:So many keep saying "but it's a BETA"

[lena_10326]

If your faith is so easily shaken, then don't install beta software. Wait until the bugs have been found, and install the final release.

First. I refuse to have faith when the fatal flaw involves an extremely simple usage of protocol handlers, which would be the first thing to test when testing for security.

Second. When Apple posts a direct link to one of its flagship applications on the main page of its website (http://www.apple.com), do you really expect people to understand what a beta is? It's called a beta, but it's not being treated as a beta. With normal betas, a small subset of the userbase will install, test, and use the app. Betas aren't supposed to be marketed with such fanfare. The entire point is to quietly release the beta to permit the beta testing to occur; it's not to push the app to the masses. Apple is advertising this "beta" to everyone and anyone: power user, casual user, grandma user, idiot user, manager user, etc (in order of decreasing acuity). You may know what "beta" means, but your uncle Vince who just completed a course at the public library titled "Learn the Internet 101" does not.

a company cannot guarantee that a product will have no security bugs unless they can guarantee that it will have no other unknown bugs.

Code quality is measured by bug density: bugs per thousand lines of code. Finding several severe bugs right off the bat is indicative of a fairly high bug density. Lowering bug density involves testing: black box, and white box. Apparently, Apple's idea of testing appears to be letting Dan the marketing guy give it a spin for a couple hours because he's the only one with a non-development Windows desktop. I can hear it now: "Hey, it checks out with Dan, let's PUSH the code!"

This whole thing smacks of a lack of respect for the target platform: Safari on Windows. A lack of respect for the product converts to a lack of respect from me for Apple.

That's just how it is, and no amount of whining will change that.

The only ones whining here are the Apple supporters who have long enjoyed bashing Windows users/supporters over the head with security related taunts. I think the only reason the Apple zealots are getting so upset is because this is another chink in Apple's armor. Meanwhile, the rest of us are criticizing Apple for very good reason--that this is the result of sloppiness and carelessness for the consumer.

Apple users: get used to this. Increased popularity means increased scrutiny.

Btw, criticism != whining.

Re:So many keep saying "but it's a BETA"

[mok000]

I have been a loyal Safari user ever since the application came out. I have enjoyed it's speed and the many cool features that have since become commonplace in most browsers.

However, recently I finally gave up and moved to Camino. I got tired of the frequent Safari crashes, the many websites where you have to use Camino anyway because Safari doesn't work with them, and --in this case the most important point-- the nagging feeling that Apple was not doing a thing to improve Safari.

Now we know why. They have pulled their forces to make a version of Safari for Windows. Dumb move, when work is so desperately needed on the Mac version, and everybody knows that Windows users hate programs with a Mac interface.

As a Mac user, I am disappointed with Apple. I expect them to do work for me and not for the Windows crowd. And I'll stick with Camino.

Re:So many keep saying "but it's a BETA"

[VGPowerlord]

Second. When Apple posts a direct link to one of its flagship applications on the main page of its website (http://www.apple.com), do you really expect people to understand what a beta is? It's called a beta, but it's not being treated as a beta. With normal betas, a small subset of the userbase will install, test, and use the app. Betas aren't supposed to be marketed with such fanfare. The entire point is to quietly release the beta to permit the beta testing to occur; it's not to push the app to the masses. Apple is advertising this "beta" to everyone and anyone: power user, casual user, grandma user, idiot user, manager user, etc (in order of decreasing acuity). You may know what "beta" means, but your uncle Vince who just completed a course at the public library titled "Learn the Internet 101" does not.

It doesn't help that the definition of beta has become muddles over the years.

When I learned the stages of software development, it went something like this:

alpha - Code that doesn't compile or runs incorrectly. Alpha testing is literally checking to see if the code compiles and runs as expected, done by the developers themselves.

beta - The code works now, but there may still be major bugs. A small group of internal testers try it and report any bugs they find. This is now called "closed beta" by MMO developers or "alpha" by the Mozilla team.

gamma - The code works and most major bugs are fixed. The code is released to a large group of testers to find any remaining issues. This is now called "open beta" by MMO developers and "beta" by everyone else.

delta - The finished product. Only maintenance releases are done at this point. New features and major bugfixes are done on the next release. This is called "beta" by Google.

So... it sounds like Apple really does have a beta in the old meaning here, but released it to a large group of people.

Another hackable part of Safari/Windows

[Bri3D]

Apple includes CoreFoundation.dll and CoreGraphics.dll, which have the same exports as the OSX frameworks.
Therefore it's possible to use the OSX CoreFoundation and CoreGraphics headers to link to the Windows DLLs natively and create native Windows "psuedo-OSX" apps.
I believe CoreFoundation.dll has been around with WebObjects for Windows NT for a while, but I think CoreGraphics.dll is a new Apple "release" (I remember some anger over Apple not porting CoreGraphics when WebObjects/NT first came out).
I've documented some of what I've poked around today (just a screenshot and simple description for the moment) at http://pages.brianledbetter.com/

Re:Another hackable part of Safari/Windows

[BlueGecko]

Close. OpenStep for Windows NT made available FoundationKit and AppKit, which are the two major Objective-C frameworks of OS X and the core of Cocoa. They continued to be available on Windows through early versions of WebObjects 4, but are no longer available in any way from Apple. These are two of the frameworks that the GNUstep project aims to clone, with varying degrees of success.

CoreFoundation and CoreGraphics are APIs that were new in OS X. CoreFoundation is an object-oriented C-based API designed that parallels FoundationKit class-for-class. Although it's been (partially) available on Windows in the form of CF-Lite (http://developer.apple.com/opensource/cflite.html ), it never shipped with any version of WebObjects. CoreGraphics is the technical name for what Apple marketing calls Quartz, and is Mac OS X's low-level C-based drawing API. This is the first time, as far as I know, that it's been available on Windows, though iTunes 7 probably uses it statically linked.

Maybe I need a tinfoil hat...

[AikonMGB]

... but the first thing that I thought of was that here you have an app (Safari) that works perfectly fine on Macs; as soon as it gets ported to Windows, BAM, instantly full of vulnerabilities. Would Apple go so far as to break their own product to deface an opponent in the OS arena?

Aikon-

Safari or Windows vuls?

[BRSloth]

I wonder how many of those vulnerabilities are actually Safari/KHTML code and how many of those are Windows vulnerabilities.

IIRC, Firefox had that "URL protocol handler command injection" vulnerability (or something around those lines, correct me if I'm wrong) a few years ago and FF developers said it was the way Windows handles protocols. In the end, they had to change the way URLs are handled inside FF to prevent Windows from catching it.

telling Apple would be insane

[r00t]

These things are worth a lot. Spammers, governments, mobsters... all will pay. You even get your choice of payment method:

*euros
*credit card numbers
*yuan
*underage virgins
*dollars
*shekels
*death to your enemies
*rubles
*pounds, British money
*pounds, crack cocaine

Just be sure to not rip off the buyer. Most of the buyers have nasty ways to kill you. Some of them have polonium. Some of them have penis pills.

Re:shooting the messenger is now + 5 insightful?

[ceoyoyo]

They release a beta of a free product, the engine of which (and almost certainly where these bugs are located) is open source, and this "security researcher" finds a bug and refuses to report it. Deep throat he's not.

I can see the ads now...

[TheVelvetFlamebait]

Mac: Hello, I'm a Mac...
PC: ...and I'm a PC.
Mac is looking through a small viewfinder, looking very absorbed
PC: Hey Mac.
Mac: Yeah?
PC: What are you doing?
Mac: I'm browsing the internet with Safari.
PC: I do the same thing with IE.
Mac: You should try Safari. It's fast, secure, and easy to use.
Mac hands the viewfinder to PC
PC: Oh, thanks.
PC looks into the viewfinder and keels over, dead
Mac shrugs

Still waiting for the page to load...

[thebrieze]

Google.com takes 45 seconds to load. CNN.com, several minutes for just the text to load (haven't seen any images yet), I have yet to see the safari home page fully load. It has now been about 8 minutes since i started the browser and the home page is still loading and has a blank screen. OK CNN just finished loading 12 minutes later. Slashdot, about 2 minutes for just the text, and about 5 minutes for the whole page. (And yes, i've tried restarting/rebooting several times)
This is all on a 7 mbit cable connection, using Firefox, CNN.com, or mostly any other page for that matter, takes about 3 seconds or less to fully load, including all the flash animated ads. So figuring there must be something wrong with my PC, I install safari on my laptop. Nope! Same results. I upgrade ITunes, thinking there might be some strange dependency on the latest version of quicktime, but no difference. I disable my (software) firewall, and antivirus.. and again nothing.. still watching the grass grow faster than the page loads... Anyone else experience this?

Proxy Feature broken

[nicc777]

For what it's worth - I discovered the proxy feature is broken. Once you enter your user name and password, the browser crashes (Windows XP).

Re:shooting the messenger is now + 5 insightful?

[iluvcapra]

or you sincerely believe most folks that install stuff know what they are doing?

That is the responsibility they undertake, yes. They may or may not understand all the ins and outs, but it's their responsibility.

so then it is better that people don't know what's in for them when installing it, right?

Based on the blog posting, they STILL don't know what's "in for them," since the vulnerabilities are still undisclosed. They remain in Maynor's to do list, for sale to the highest bidder for all we know.

If you're a linux or MS supporter, don't waste your breath defending this guy. He wasted a year of everybody's time on that Airport vulnerability that didn't exist.

There are difference

[aepervius]

For a browser, to have "easily" testable major bug like remote execution, something which should have been caught a bit before. I disagree totally with the way this security "researcher" handled the bugs, but I also totally disagree taking off the slack because this is a beta. Bug found so quickly by testing a few known vulnerability in browser is something bad. With a big B. Smell of lack of security testing pre-beta.

Re:shooting the messenger is now + 5 insightful?

[ceoyoyo]

I didn't say he shouldn't report that there's a bug, I said that he should report the bug to Apple. The beta agreement probably requires that he do that, actually.

And if you're installing a beta then yes, you really should be aware that you're in for some bugs. It's very unfortunate that Google has diluted the meaning of "beta" so much.

Also note that he's not really failing to report a bug to Apple, he's failing to report it to the webkit/khtml open source project. I doubt very much the bugs are in Apple's closed source GUI front end to webkit.

Re:shooting the messenger is now + 5 insightful?

[Fordiman]

I doubt URL handling is part of the KHTML/KJS renderer; responsibility for acquiring content in Konqueror is done in KIO, so Apple would have had to implement their own content acquisition scheme.

It is possible that the stack failure is in (KHTML/KJS)/WebKit - but as it's not been shown that these bugs apply to either Konqueror or Mac Safari, it's most unlikely that the stack failures are the result of the open portion of the code.

Anyway, as a news story, this is a null set; it's a public beta. It's there for the public to test it and report bugs. It's not a production browser.

I'd be curious, however, to see if these bugs are Windows-only (for example, Mac OS-X and KDE have a URL handling scheme built into the OS that wouldn't be available in Windows; it would need to be implemented as part of Win Safari), or if they apply equally to Windows and Mac.

Bugs found in beta software, news at 11

[Aqua OS X]

This just in, nasty bugs were quickly discovered in the public beta of a newly ported app. Disappointment of outrageous expectations has now led to the death of several men living in their mothers' basements.

It is assumed Apple realized this devastating "beta" because they hate freedom and want the terrorists to win... and they've now won.

We will try to stay on top of this developing critical story.
My god have mercy on us all.

Re:Bugs found in beta software, news at 11

[cno3]

"Disappointment of outrageous expectations has now led to the death of several men living in their mothers' basements."

Terrorist suicide bomber, up in heaven: "These are so not the virgins I was expecting."

Shooting the messenger is + 5 insightful if...

[Anonymous Coward]

The messenger says something along the lines of:
"The Trojans are going to attack tonight. There'll be at least five cohorts, but I can't tell you where there coming from, or the time of the attack, because you know, that'll spoil all the exciting fun."

Re:shooting the messenger is now + 5 insightful?

[sitharus]

It's not present on Mac Safari, though the demo page does crash the Safari 3 Beta.

The main thing is how the URL handling works, under Windows Safari passes the URL to the Windows URL handler, which just finds the application and then dumps the rest on the command line, which gives many remote execution issues. Under MacOS the MacOS URL handler finds the application, and then dispatches an OpenURL AppleEvent (I think, similar to that anyway) towards the application, which then has the responsibility of parsing and loading the URL.

I'm guessing that the engineers didn't look too hard at how the OS deals with URLs and just assumed it would be safe.

From here @ WWDC...

[catdevnull]

From what I can tell, Apple is jumping on the consumer bandwagon (or trying to)--it seems they're trying to increase the Webkit install base to raise the "awareness" factor for iPhone's web engine. From the sessions I went to today, it seems Apple is really pushing for Web 2.0 development. I was surprised by this--for a developer conference specifically for Apple's OS, there was this weird, eerie spell cast by the presenters for pushing web apps.

The vibe amongst the attendees is a weird mix of disbelief and bewilderment. Safari for Windows was not the big deal Steve was hoping it would be. In fact, most of the conversations I've overheard are pretty critical of this direction.

I don't think Apple is serious about competing for market share against FF or IE on Windows. I think they're offering the development platform based on Webkit so that web developers can make sure their code looks OK on the iPhone. Webkit-iness seems to be the only development platform for iPhone Apps.

Or, maybe Steve is starting to drink his own Kool-Aid.

Re:You're dodging

[Anonymous Coward]

From one AC to another:

Webster's 1913 Dictionary

          Definition:
\Pro*fes"sion*al\, a.
1. Of or pertaining to a profession, or calling; conforming
      to the rules or standards of a profession; following a
      profession; as, professional knowledge; professional
      conduct. ``Pride, not personal, but professional.''
      --Macaulay. ``A professional sneerer.'' --De Quincey.

Perhaps you, yourself, should have looked up the definition, ye lazy & bilesome rapscallion!

Re:shooting the messenger is now + 5 insightful?

[Fordiman]

Offtopic:

I, like a lot of other web developers out there, wanted Safari for the purpose of adapting web pages to Yet Another Popular Browser's bugs.

So, what did I find when I downloaded Safari? The ridiculously useful debug menu was gone!

Now, all the docs on how to enable it are for Safari on the Mac, understandbly. What to do?

Kill Safari

Open C:\documents and Settings\[You]\Application Data\Apple Computer\Safari\Preferences.plist

Add, in what appears to be the logical place: IncludeDebugMenu1

Load Safari. Now developer-useful things like the Javascript Console are available to you.

Re:shooting the messenger is now + 5 insightful?

[Fordiman]

Slashdot stripped my XML. The line to add is, IncludeDebugMenu1

Re:shooting the messenger is now + 5 insightful?

[Daengbo]

It's very unfortunate that Google has diluted the meaning of "beta" so much.
It's very unfortunate that the rest of the industry (especially MS) has diluted the meaning of "gone gold" so much. Gold is the new beta; beta is the new alpha.

Re:shooting the messenger is now + 5 insightful?

[Sparks23]

No. But put it this way...

Let's say there's something built atop an open source library. Hey, there's plenty of them out there... let's pick OpenSSL as an example. It's open source and it's used in other projects, some of which are commercial or proprietary systems. Now assume that some company makes a proprietary, closed product built on that project as the core, but continue to contribute changes -- a heck of a lot of changes -- back to the original project as the develop. And then they release this as a beta.

Finally, let's say that someone finds a vulnerability in the proprietary project, a security issue with implications for the open source project. And instead of reporting the vulnerability to the proprietary folks (who would probably promptly generate a patch for both their tool and the underlying library, the person refuses to report the vulnerability to anyone and just says 'I found vulnerabilities, but I'm not telling you what they are.'

That's basically how WebKit/KHTML and Safari are tied together. Safari's just a UI atop an open source framework, WebKit, which Apple is the primary contributor to but which other people also contribute to, and which other projects (besides Safari and OS X) use. WebKit is used on Symbian OS, on Linux, and various other operating systems. And this guy is claiming to have found vulnerabilities which, given where they occur, seem to have implications for WebKit as well as Safari... and is refusing to give the details to either Apple, or to the WebKit development community.

You don't have to be an Apple 'fanboi' (or fangirl) to see that's not the way to handle security disclosures. If someone found several bugs in Firefox and said 'ZOMG I can crash Firefox or anything which uses the Gecko HTML engine. I can do it 100% of the time. But I'm not going to report the details to the Firefox team, so, nyah!' people would be up in arms about it.

Professional, good security researchers report things to the responsible parties, giving them the details necessary to fix it. Going, "Ha ha, I found a way to break your stuff but I'm not going to tell you how" is not only unprofessional, it's just downright immature.

Sure, lambaste Apple for releasing a beta/preview of something with bugs if you feel you must. But, please, don't bother trying to defend someone who basically makes a mockery of the entire security field.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Bringing apps to Windows

[Rolman]

Steve Jobs wondered while introducing Safari for Windows: "How good are we at bringing apps to Windows?"

After reading "4 DoS bugs and 2 remote execution vulnerabilities", I'd say: "Pretty good!"

Yes I know its a beta! Why was it really released

[ernest.cunningham]

I have tried the browser in Windows XP Professional SP2 and all works perfectly fine for me. The browser is quick and responsive.

Now it may be a beta, but the browser seams VERY buggy, too buggy to be a beta (according to other peoples testimonies, not my own experiences). I think apple has missed out on a great opportunity to gain market share here becuase there will be many people who have tried the browser, had major issues, and now will never go back. Yes I know it is a beta! (preempting the hoards).

I also think that the product was rushed to market, and that apple would never have released the browser in this condition had it not been for WWDC 07. I think they just could not get it to the point they would have wanted in time. And I agree with those above who have said the browser exists mainly for testing iPhone Apps in. Time will tell if they made the right decision here.

I would sugegst to anybody out there to wait a couple revisions before really trialling this application unless you are going to use it to connect to trusted websites you already know, or looking to develop for the iPhone.

Now where is my developer copy of Leopard. We non attending Apple Developer Select Members always get made to wait a couple months :(

The entire UI is broken

[DrXym]

Every single dialog box and effect is Aqua style. Even though both OS X and Windows XP / Vista have theme engines meaning there should be absolutely no reason at all for doing this. The engines allow apps to render their controls in the native style irrespective of how they are implemented. It's why Firefox in its default skin looks like a Windows app on Windows, like a Mac app on a Mac and so on - because rendering is handed off to the theme engine. Same happens for Java too. But not Safari it seems.

Re:The entire UI is broken

[DrXym]

Also, I can't tell, but it seems like your message is implying that you believe Safari uses XUL or some other Mozilla based skin settings. It doesn't. Safari = Konqueror's KHTML engine wrapped in WebKit frameworks + Stuff that makes it look like a Mac app. There's no Mozilla anything involved. (Or maybe I'm misreading you?)

I meant that the Mac has a theme engine and Windows has a theme engine. Both have a bunch of APIs that you can call easily from any app to render a button, scrollbar, checkbox etc. in the platform style. This is exactly how Firefox and Java manage to render themselves with a native look and feel even though they don't use native widgets. In porting Safari to Windows Apple have also ported the theme engine from OS X meaning the app doesn't look or behave like any other Windows app. There appears to be absolutely no valid reason to do that when Windows has a theme engine of its own. Cocoa could invoke calls on that to render widgets but it doesn't. It makes Safari look atrocious and completely non standard when running in Windows. I'm hoping they will fix this because I don't see any reason at all to use Safari when it can't even be bothered with basic consistency.

Microsoft would be killed if they pulled the same stunt, releasing an IE port with Aeroglass theme for Linux or OS X, and rightly so. MS actually did release an IE 4 for Unix and it was abysmal, running through some Win32 thunk. I don't see why Apple should have a free pass. If anything they should know better.

Re:shooting the messenger is now + 5 insightful?

[Anonymous Coward]

Did they strip your Preview button too?

Re:shooting the messenger is now + 5 insightful?

[Nullav]

Or how about everyone stop treating their choice of operating system as a religion? Hmm?

Re:shooting the messenger is now + 5 insightful?

[Asgerix]

That's a nice way to get karma! If you post a comment that you suspect is going to be modded insightful, remember to include some errrors, so you can post a correction and get some more positive moderation for the second comment! ;-)

(...waiting for this comment to be modded insightful)

Crashes Safari 3 on Mac OS X too

[eturro]

Thor Larholm's vulnerability example crashes Safari 3 on Mac OS X too.

Proverbial code corruption

[The Cornishman]

> Pride comes before a fall

Pride goeth before destruction, and an haughty spirit before a fall. Proverbs 16:18

Re:shooting the messenger is now + 5 insightful?

[digitig]

You don't have to be an Apple 'fanboi' (or fangirl) "Fangrrl", please!

Re:shooting the messenger is now + 5 insightful?

[FreakyLefty]

remember to include some errrors, so you can post a correction and get some more positive moderation for the second comment

So when are you coming back for your second dose of moderation? Or do I get to steal them because I beat you to it? Informative surely *fingers crossed* :-)

Re:You're dodging

[edumacator]

Did you just really use the word rapscallion in a real world sentence?

Awesome.

Re:shooting the messenger is now + 5 insightful?

[NemosomeN]

I think the company you're looking for is Mirabilus. Mirabilus diluted the meaning of Beta. Thanks for playing.

Re:shooting the messenger is now + 5 insightful?

[peragrin]

not to be mean but
  It's a friggin BETA!!!!!

it's supposed to have bugs in it.

besides it's not like IE where the bugs are in the shipping version and part of it's core design.

Re:shooting the messenger is now + 5 insightful?

[Fred_A]

Or how about everyone stop treating their choice of operating system as a religion?

What do you mean it's not a religion ? Why did that bearded guy insist that I attend the "Church of GNU" every sunday then ?

Re:shooting the messenger is now + 5 insightful?

[LKM]

releasing software with remotely exploitable bugs to the general public to the fanfare of the press (release of safari is in all major news) by a large company is surely a more irresponsible act than a bug report about the said software.

Yes. Every application release ever by a large company was irresponsible. And why limit it to large companies? No software should ever have been released because they all contain bugs which could be exploited by hackers!

What Maynor does is absurd. We all know software has bugs. The developers must be held accountable. But you can't do that unless you tell them what the hell the bug is, because they can't fix the bug until you tell them what it is!

No, he was not.

[LKM]

No, he was not.

Geez, if you really believe that whole Ou-invented idea that Apple somehow "orchestrated" a smear campaign against Maynor and got Dalrymple and Chartier to play along with them, you should stop reading zdnet and start reading a real news outlet. It's one of the most inane tech conspiracy theories I've ever heard.

Re:shooting the messenger is now + 5 insightful?

[gEvil (beta)]

"Fangrrl", please!

Don't be such a nrrrd!

Re:Thank you software ENGINEERS at apple

[crimperman]

How is it a structural engineer can make a bridge or skyscraper perfect every time with no bugs

*Every* time????

You might like to have a look at London's millenium bridge ( designed by one of the biggest Civil/Structural engineering firms in the world ) or Ronan point (to name just two of the famous ones) and reconsider that statement a little.

Re:shooting the messenger is now + 5 insightful?

[Anonymous Coward]

I think the company you're looking for is Mirabilus.

Don't you mean Mirabilis?

I hate grammar Nazi's.

You're welcome.

Also, that should be "Nazis."

Why bother when...

[ivan256]

...you can release a public beta and have have thousands of publicity whores do top notch security analysis of your beta for free?

Re:shooting the messenger is now + 5 insightful?

[The MAZZTer]

OS independent path (IE Vista-friendly): %APPDATA%\Apple Computer\Safari\Preferences.plist

Re:shooting the messenger is now + 5 insightful?

[Molochi]

And "no longer supported" is the new gold.

How did this get modded informative?

[SEMW]

You mean that black letters on white backgroung actually appear as black letters on white backgroud sucks? You really prefer Windows' black-letters-appear-in-rainbow-colors technology? You're an idiot. All colours on a computer screen are built up by different combinations of primary colours: red, green, and blue. See http://en.wikipedia.org/wiki/Additive_color. 'White' is just all three primary colours turned on full; 'Black' is all three turned off. Normally, letters on a computer screen are created by switch individual whole pixels on and off. The difference with subpixel font rendering is the manipulation of the individual 'subpixels' (the red, green, and blue elements that make up a pixel) to effectively triple the horizontal resolution on an LCD screen. So if you have an LCD whose subpixels are ordered RGB, the example text in the link you post will not look coloured, but will look significantly smoother than the not-subpixel-rendered text. If you have an LCD with BGR ordering, or a CRT, you will see 'color fringing'; a good font rendering implementation will automatically switch off subpixel rendering for CRTs. See the Wikipedia article for more details.

Also, I would note that Quartz (which renders fonts on modern Macs) also use subpixel font rendering; MS merely did it first.

The differences in font rendering between Windows and Mac are due to other reasons, which I explain here

Re:You're dodging

[Sciros]

March 23, 2004, although the details of how or why elude me.