Safari 3 Beta Updated, Security Problems Fixed

Llywelyn writes "Apple has released an update to the Windows Safari 3 Beta. According to Macworld the updates '...include correction for a command injection vulnerability, corrected with additional processing and validation of URLs that could otherwise lead to an unexpected termination of the browser; an out-of-bounds memory read issue; and a race condition that can allow cross-site scripting using a JavaSscript [sic] exploit.' It is available through either the Apple Safari download site or through Apple's Software Update."

Comments

Well!

[drhamad]

It's about time! ;) What took them so long!

Re:Well!

[CheeseTroll]

I've found that a lot of web developers just don't realize which items are truly platform-independent, and which ones are not, until they test them and find out that some break. Formatting can be temperamental, as well. Just because a site is perfectly functional, doesn't mean it *looks* as good on other platforms without some adjustments.

Naturally

[Diordna]

I'm your average rabid Apple fan, but surely they had to have a fix at least this fast to keep from looking stupid. I doubt they'll be as quick in the future.

Gee

[sid0]

they haven't fixed all the vulnerabilities yet.

Re:Gee

[trolltalk.com]

Which policy would you rather your OS vendor have:

1. Wait for the monthly "patch Tuesday"
2. Close vulnerabilities ASAP

Consider this - this is just a "preview" product - and not even on "their" platform. Its good publicity. They're handling the vulnerabilities the same way Tylenol handled the poisoned pill problem - actively, instead of with their head up Gates/Ballmer's rear end going "no problemo".

Re:Bugs reported one day, fixed the next.

[Anonymous Coward]

In the interest of having a viable stable platform for iPhone development, they're going to have to keep up this quick turnaround on defect resolution. As someone mentioned a couple of days ago when Win Safari was first released, they're also going to have to work really hard for this software to compete with other browsers (which many think it can't). While I agree that it's an impressive turnaround, for Apple's sake, I hope they can keep up the momentum.

Re:not worth it

[nevali]

Er, you don't have to give an e-mail address to download it, just to sign up.

Leave the box blank and the check-box ticked and it still downloads.

Re:I dont care what you say

[Baricom]

I think the reason's pretty simple: companies like Google have been abusing the "beta" moniker lately. The betas I've seen from Apple (including Safari and earlier, Quicktime 7) have been more consistent with what I would consider a beta: they mostly work and are useful for testing, but still have significant problems.

Perhaps what they might have done is require an Apple Developer Connection account to download instead of making it available through general release.

I disagree

[WrongSizeGlass]

As someone mentioned a couple of days ago when Win Safari was first released, they're also going to have to work really hard for this software to compete with other browsers (which many think it can't). I may be wearing my ass as a hat, but I honestly don't see Apple expecting Safari to compete in the Windows browser market. It is my (potentially asshattian) opinion that Safari is available on Windows solely for the purpose of providing a testing environment for iPhone development for Windows developers. It's never going to take over the Windows browser market (or even made a serious dent).

Having Safari available on Windows removes the 'Apple Only' hardware requirement for any company who wants to develop Web 2.0/AJAX applications that run on the iPhone which opens Safari development to a much much larger pool of developers.

Re:Now if they would fix the text problem...

[Henry V .009]

Yes, I've got this problem on my Vista install at work. Clicking the little spider icon to report the bug crashes the program.

Mini-review of Safari on my home Vista install: The non-standard Windows UI is annoying. If I wanted to resize only from the bottom right corner I would have bought a Mac. The lack of an advertisement blocker makes the software a poor alternative to Firefox. The bundling is annoying. I don't want Quicktime. Quicktime is ugly, ugly software. It makes Firefox crash, grabs all sorts of MIME types, throws its icon up on the desktop every time it updates no matter how many times you delete the icon, it installs a systray icon (for a media player?!? come on), and it won't play full screen videos. ITunes is only a good media player if you own a Ipod. Don't want that either. The Apple update service is annoying as well. Why a separate service? I want my apps to check for updates when I start them or not at all.

Good points? Well, Safari displays web pages, I guess. Good for Apple.

Re:Excellent! Just one more thing...

[curunir]

The whole review misses what I believe is the point of the release entirely. They approach it from the point of view of a user who would be using it as their default browser. But I don't think Apple is really trying to win significant market share on PC browsers.

What they do want, however, is for developers to test their pages in Safari, not just FF and IE. Until the release, many developers used the fact that they couldn't run Safari on their development platform as a reason for not testing in Safari. Since Safari's CSS rendering is very compliant, most pages that render well in FF also render well in Safari. But Safari's JavaScript engine has a lot of quirks that developers won't catch unless they actually test in Safari. With the proliferation of AJAX-enabled sites out there, it's becoming more common for Mac Safari users to hit pages that just don't work for them. This is what Apple is trying to prevent.

But now that Safari is available in Windows (and hopefully Linux will follow), developers can easily test that their pages will work for Mac Safari users, even if they don't choose Safari as their default browser. This release many have lots of warts, but it's plenty good enough to fire up a couple of times a day to make sure that a specific site works.