Safari 3.1 For Windows Violates Its Own EULA, Vulnerable To Hacks

recoiledsnake writes "The new Safari 3.1 for Windows has been hit with two 'highly critical'(as rated by Secunia) vulnerabilities that can result in execution of arbitrary code. The first is due to an improper handling of the buffer for long filenames of files being downloaded, and the second can result in successful spoofing of websites and phishing. This comes close on the heels of criticism of Apple for offering Safari as a update for approximately 500 million users of iTunes on Windows by default, and reports of crashes. There are currently no patches or workarounds available except the advice to stay clear of 'untrusted' sites." Further, Wormfan writes "The latest version of Safari for Windows makes a mockery of end user licensing agreements by only allowing the installation of Safari for Windows on Apple labeled hardware, thereby excluding most Windows PCs." Update: 03/27 17:23 GMT by Z : Dave Schroeder writes with the note that the license has been updated to correct this mistake.

Comments

I think you're not reading closely enough

[hassanchop]

"The latest version of Safari for Windows makes a mockery of end user licensing agreements by only allowing the installation of Safari for Windows on Apple labeled hardware, thereby excluding most Windows PCs."

I got Safari as part of the iTunes update. I have a non-Apple Windows machine, running Safari. They basically forced the software on me, and the EULA says I can't use it.

Does that answer your question?

Re:Violating the EULA

[Kjella]

Your EULA is fiction, and until I see one stand up in court I'm going to ignore it. I guess you better close your eyes and hum real loud then. I'm not saying it's universal, but to take a few examples from the wikipedia page in Brower v. Gateway "the Supreme Court of New York ruled that the terms of the shrink-wrapped license document were enforceable because the customer's assent was evident by his failure to return the merchandise within the 30 days specified by the document." And regarding click-wraps: "Click-wrap licenses have met with more support in the courts, though notable counterexamples exist. In ProCD v. Zeidenberg, the license was ruled enforceable because it was necessary for the customer to assent to the terms of the agreement by clicking on an 'I Agree' button in order to install the software."

The whole section on enforcability starts with "The enforceability of an EULA depends on several factors, one of them being the court in which the case is heard. Some courts that have addressed the validity of the shrinkwrap license agreements have found some EULAs to be invalid, characterizing them as contracts of adhesion, unconscionable, and/or unacceptable pursuant to the U.C.C." If you read between the lines, it says "No court has rejected EULAs outright". If you're outside the US, it seems to be much the same. Yes, Germany declared the bundling with Windows to be unenforcable, but the EULA as such still remains. In short, you're talking about the way you want it to be not legal reality except possibly in Kansas where there was a ruling agreeing with you.

Re:Hardly surprising

[Jeff DeMaagd]

I call BS. I just uninstalled iTunes and there's no background process or anything like that running, and no executable remaining. Maybe the program should have offered to remove the program preferences in your account, but there's no binary there.

That "spyware" service you refer to is just a notifier to open iTunes when an iPod is connected. That's all it does. It's hardly malicious, and it doesn't report to Apple what you do with your computer.

Re:It has begun...

[Zonk (troll)]

Considering Apple's notorious heavy-handedness in their software updates and the aggressive way their software "takes over" your computer when installed, I wouldn't install a piece of Apple software on my computer if you put a gun to my head (I'd as soon install Realmedia player). I used to put Quicktime on my system, but I got so tired of putting up with that sneaky turd (would NOT let you completely uninstall it, insisted on always running in the background no matter what you did to stop it, would try to sneak its way back into your registry even if you deleted its entries, aggressively took over neutral file types, would constantly try to trick you into installing iTunes too, etc.) that I finally refused to even install that much (I use "Quicktime alternative").

Anyone who installs Apple software had better be prepared to join the cult, otherwise stay the hell clear of it.

I agree with that, but if you need Qucktime support in, say, an organziation there is a way around that without using Quicktime Alternative.

Download the installer. Run cabextract on it. You'll get the following files:

AppleSoftwareUpdate.msi
QuickTime.msi
QuickTimeInstallerAdmin.exe

Only install Qucktime.msi. Delete the others. Just do msiexec /qn /i Qucktime.msi.

Then run this registry file:


Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"=-


Make sure to delete the shortcuts so users can't bring it up. Doing it this way will let the browser plugins work, and also enable software that uses quicktime to work (lots of educational software uses it) without being hostile to your system. It will only take the quicktime file extensions this way.

Re:It has begun...

[MMC Monster]

To call rockbox an upgrade firmware is streching the truth a bit. Limited support for video, limited support for album art, and cluttered UI are real issues for individuals that want their players to "just work".

Mind you, I last installed it about 4 months ago. I'll try again if people say it's much better now.

Re:It has begun...

[watzinaneihm]

Thats a great suggestion .. a minor nitpick ..
"msiexec /qn /i Qucktime.msi " will run the msi with no UI at all.. replacing "/qn" with "/qb!" will do the same install with a limited UI. Atleast that way there is some indication that an install is in progress.