Slashdot Mirror
Safari 3.1 For Windows Violates Its Own EULA, Vulnerable To Hacks
recoiledsnake writes "The new Safari 3.1 for Windows has been hit with two 'highly critical'(as rated by Secunia) vulnerabilities that can result in execution of arbitrary code. The first is due to an improper handling of the buffer for long filenames of files being downloaded, and the second can result in successful spoofing of websites and phishing. This comes close on the heels of criticism of Apple for offering Safari as a update for approximately 500 million users of iTunes on Windows by default, and reports of crashes. There are currently no patches or workarounds available except the advice to stay clear of 'untrusted' sites." Further, Wormfan writes "The latest version of Safari for Windows makes a mockery of end user licensing agreements by only allowing the installation of Safari for Windows on Apple labeled hardware, thereby excluding most Windows PCs." Update: 03/27 17:23 GMT by Z : Dave Schroeder writes with the note that the license has been updated to correct this mistake.
Sometimes it's just really not a good idea to push a piece of software out to hundreds of millions of people on its first release just because they use/update your other products. This is the real way that it could come back and bite them, and it certainly seems to have.
EULA's have gotten to the point that they conflict with themselves. One can then assume that Safari is intended for the Windows install on Mac machines, *or* on machines to which someone has applied an Apple brand sticker.
I am waiting for the EULA that requires all users to declare the programmer their god and send off their first born child to him in sacrifice.
Karma Whoring for Fun and Profit.
Can someone please explain to me how software could possible "violate its own EULA" (even theoretically, not necessarily restricted to this case)?
;)
I agree that the EULA makes no sense, assuming that Apple wants as many Windows users as possible to use Safari. But that's an entirely different matter.
In fact, the EULA can be adhered to without any problem: afterall, you can install Windows just fine on Mac hardware these days. So you can actually run Safari for Windows on "Apple labeled hardware".
I seriously doubt the way it is stated in the EULA is really Apples intention though
Every expression is true, for a given value of 'true'
Not that I dislike apple more now then I did before I RTFA, which is to say I have a fairly neutral view on them, but if you look at a lot of articles lately I do believe that in general, they are a little less liked now then they were when they initially released the iPod.
Anyways, going back to the article, I think the EULA is just a mistake and believe they will correct it. It does however bring up a valid point about the usefulness and legalities around EULA's.
You are mistaking "signature" and "agreement." Signatures are not a prerequisite to a valid contract, they are merely very good evidence of agreement. You can get out of some contracts you signed and you can be held to some contracts you didn't. The lack of a signature is not the reason EULAs are of questionable enforceability.
Also, if you do choose to buy an ipod, you don't have to use itunes.
You don't even have to use apple-firmware in your ipod. There's an upgrade-firmware that makes itunes totally obsolete.
It's not available for all ipod-models yet though...
All in all, though, an installer that offers the option of installing irrelevant software (like installers that offer "google toolbar" or "Safari" or "superduper spywareinstaller") should have that option unselected as default.
/.Mattsson - My native language is not English, so please don't whine over linguistic errors. (That's lame anyway...)
Anyone who installs Apple software had better be prepared to join the cult, otherwise stay the hell clear of it.
SJW: Someone who has run out of real oppression, and has to fake it.
Apple has gotten where it is almost exclusively by taking the low road, with borderling false advertising and Microsoft-style tactics. They originally make an excellent product (MacOSX, Ipods, etc), get a name from it, then push it further using the low road. Its always been that way. If you're going to move away from Microsoft because of shady marketing as one of your primary reasons, stay clear from Apple. Jobs makes Balmer look like a saint in that department.
If Safari becomes the default browser on these systems, you end up with critical vulnerabilities in a browser installed on non-tech-savvy individuals' computers.
So first we have to have a user who is unaware of what Safari is or careless enough to not uncheck the box in Apple Software Update. It seems highly unlikely to me that many of the users who download Safari without thinking about it are going to go looking for it in the Programs menu and launch it. And it's not vulnerable if it's not running.
It was silly and wrong for Apple to leave the box checked by default, but this is not a big problem, and it's not going to become one.
Oh blow me. Can you imagine the shitstorm of a comment thread that would result from this exact same thing being the result of MS's doing? The massive gaping security hole *is* a big deal, it is not made less so just because Apple did it and not MS.
And what the hell are you talking about with MS giving guidelines? You mean like, MS should give you guidelines on what you should and should not do with your PC? Dude, seriously, where the hell did you come up with your ideas?
I hate printers.
Safari is marketed as the perfect browser for Windows, without flaw, without question. They have the gall to assume that everyone who uses iTunes would prefer Safari simply because it has an Apple logo on it.
And when Safari falls victim to Security vulnerabilities just like every program out there, those of us who know what we're talking about don't blame Apple for their complete incompetence as programmers. Security vulnerabilities happen. It's the way of programming. It's virtually unavoidable. Yet fanboys turn around and say Apple isn't obligated as a company to produce secure software and back up their own marketing hype simply because Windows is a crap platform. It sickens me. And they get away with it.
The Computations of AdamR
http://www.adamreyher.com
Look at it another way. You have a Mac, and you run Office. Somewhere during the routine update process, some new, not-ready-for-primetime version of IE gets installed and is set as your default browser.
The issue is in part that Safari is not related to iTunes or Quicktime. There's no reason to believe that by installing music software, the manufacturer will also push a browser to you.
All this will do is piss people off and make them turn off automatic update options, which will eventually result in some flaw in iTunes or Quicktime being less widely patched. It was not a capital crime, but it was dumb and irresponsible of Apple.
And the EULA thing is just funny. What with the ample fleet of lawyers they have in Cupertino, I'm surprised ANYTHING gets out without a full legal vetting. Software gets out with bugs, but EULAs don't typically get out without great scrutiny.
It is pitch black. You are likely to be eaten by a grue.
This space for rent.